Combining internal audits with anti-corruption compliance monitoring

 

Post by Prof. Hernan Huwyler, MBA, CPA, CAIO
AI GRC Director | AI Risk Manager | Quantitative Risk Lead
Speaker, Corporate Trainer and Executive Advisor

Top 10 Responsible AI and Risk Management by Thinkers360

Why Detecting Concealed Payments Has Become A Board Level Priority

Detecting illegal payments concealed in accounting records remains a top priority for both internal audit and anti-bribery compliance functions. Corruption risk is a significant and growing concern for global organizations, driven by an expanding web of extraterritorial anti-corruption legislation. The U.S. Foreign Corrupt Practices Act, the UK Bribery Act 2010, France's Sapin II, and Brazil's Clean Company Act all impose obligations that extend well beyond domestic borders, creating overlapping enforcement regimes that demand coordinated internal controls.

Enforcement activity continues to intensify. The U.S. Department of Justice and the Securities and Exchange Commission have collectively imposed billions of dollars in FCPA-related penalties over the past decade. Whistleblower programs, particularly under the Dodd-Frank Act, have created powerful financial incentives for individuals to report suspected violations directly to regulators, with the SEC Whistleblower Program having awarded over two billion dollars since its inception. These dynamics make it essential for organizations to detect and prevent improper payments before they surface externally.

Identifying illegal payments hidden in accounting records is no longer a narrow compliance exercise. It is a core governance issue that sits at the intersection of anti bribery compliance, financial controls, internal audit, third party risk management, and investigations. For global companies, the stakes are high. Enforcement authorities continue to pursue cases under extra territorial anti corruption laws, whistleblower activity has increased, and regulators now expect companies to demonstrate not only that they have policies in place, but that they can identify and respond to suspicious transactions in practice.

Improper payments are rarely recorded as bribes. They are usually disguised as legitimate business expenses. In many cases, they appear as commissions, consulting fees, rebates, customs charges, facilitation arrangements, marketing support, travel expenses, charitable contributions, or vendor payments that appear ordinary on the surface. In more sophisticated schemes, illegal payments are concealed through inflated invoices, success fee arrangements with vague deliverables, layered subcontracting, shell entities, or payment flows involving offshore accounts and unrelated jurisdictions.

That is why anti bribery risk cannot be addressed through policy language alone. It requires a control architecture capable of identifying transactions that are technically booked within approved accounting categories but are economically inconsistent with the underlying business purpose.

Why Accounting Records Remain Central To Anti Bribery Detection

Under major anti corruption enforcement regimes, including the US Foreign Corrupt Practices Act, the integrity of books and records remains a central issue. Companies can face enforcement not only for improper payments themselves, but also for failures in internal accounting controls and the maintenance of inaccurate records. This is one of the most important practical realities in anti bribery compliance. Illegal payments are often detected not from direct evidence of intent, but from inconsistencies in documentation, approval logic, service validation, pricing patterns, vendor onboarding, or payment behavior.

For that reason, the most effective anti bribery programs do not separate ethics risk from financial control design. They treat accounting data, procurement data, third party due diligence, and approval workflows as connected evidence streams.

Why Improper Payments Are Difficult To Detect

Improper payments are deliberately designed to evade detection. The most straightforward schemes disguise bribes as legitimate business expenses such as agent commissions, third-party fees, consulting charges, or reimbursed travel and entertainment costs. More sophisticated arrangements involve inflated invoices, deceptive commission structures, fictitious services, and the use of complex webs of intermediaries, shell companies, and offshore bank accounts.

Under the FCPA, even when a substantive bribery charge cannot be proven, organizations face significant liability for books and records violations and failures to maintain adequate internal accounting controls. This means that the quality of accounting records and the integrity of the control environment are themselves compliance obligations, not merely audit concerns.

Mapping The Risk Factors Behind Improper Payments

Effective corruption risk assessment requires evaluating the full environment surrounding each transaction rather than relying on a single risk indicator. Organizations that anchor their bribery risk maps exclusively to country-level corruption indices, such as the Transparency International Corruption Perceptions Index, miss the broader transactional context that drives actual exposure.

A robust risk mapping framework balances four dimensions.

Where the transaction occurs encompasses the jurisdiction where the service is provided, the location from which payment is requested, and the domicile of the supplier. High perceived corruption jurisdictions, tax haven countries, new market sectors, and offshore locations all elevate this dimension of risk.

Who is involved examines the parties to the transaction, including public officials, politically exposed persons, small or newly established companies, new vendors without established track records, subcontractors, joint venture partners, associations, and any associated persons as defined by applicable legislation. The completeness and findings of due diligence, including any unresolved red flags, and the verification of beneficial ownership are critical elements of this assessment.

What service is provided evaluates the nature of the engagement. Consulting and advisory services, government licenses and permits, customs and logistics services, public procurement, complex or first-of-their-kind projects, and transactions where incentives or pressures exist to complete a deal on aggressive timelines all carry elevated risk.

How the service is contracted and paid focuses on the commercial and financial mechanics. The payment method, flat-fee structures versus success-based compensation, commission clauses, reimbursed expenses, upfront payments, the use of cash, and the routing of payments through jurisdictions unrelated to the underlying service are all relevant indicators.

Balancing these four dimensions provides a holistic view of corruption exposure. Organizations that assess only one or two of these factors, typically the country dimension alone, create gaps in their risk coverage that more sophisticated bribery schemes are specifically designed to exploit.

 

How Corruption Risk Should Be Assessed In Practice

Many companies still make a basic but costly mistake in corruption risk assessments. They over concentrate on country risk and assume that corruption exposure is driven primarily by geography. Geography matters, but it is only one element of the transaction risk profile. A stronger model evaluates corruption risk through the interaction of location, counterparties, business purpose, and payment mechanics.

A more complete risk view starts with where the service is delivered, where the payment is requested, where the third party is domiciled, and whether the transaction touches jurisdictions associated with weak transparency, sanctions concerns, customs complexity, or tax opacity. It also considers who is involved, including public officials, state owned entities, politically exposed persons, newly formed vendors, subcontractors, joint venture partners, customs brokers, commercial agents, and intermediaries with limited operating history or negative due diligence findings.

The nature of the service is equally important. Certain services are structurally higher risk because they are difficult to verify or can be used to justify discretionary payments. These often include consulting, licensing support, customs clearance, permit acquisition, business development, logistics support, market access work, and public procurement support. Risk also rises when a project is unusually complex, commercially pressured, fast tracked, or dependent on external approvals.

The final dimension is how the transaction is structured and paid. Payment method, fee logic, reimbursement provisions, use of advances, round sum compensation, success based compensation, vague statements of work, accelerated approvals, split invoices, foreign currency requests, or payments to accounts in unrelated jurisdictions can all materially elevate risk.

A mature corruption risk model balances all of these dimensions. It does not treat any single factor as determinative. It recognizes that a low transparency jurisdiction does not automatically make a transaction improper, and that a payment in a lower risk country may still be highly suspicious if the service cannot be substantiated or the payment structure lacks economic logic.

Why Compliance And Internal Audit Need A Shared Detection Model

Compliance and internal audit both play important but distinct roles in detecting illicit payments. Compliance typically owns anti bribery policy, third party due diligence standards, training requirements, escalation protocols, and ongoing monitoring of high risk transactions and third parties. Internal audit provides independent assurance over the design and operating effectiveness of controls, the adequacy of governance, and the consistency of execution across business units.

These roles should not be merged, but they should be coordinated. In practice, both functions rely on overlapping risk indicators, control points, and transactional evidence. If they use different definitions of bribery risk, different red flag criteria, or different scopes for testing, the result is fragmented oversight and duplicated effort. If they align on risk factors, data triggers, and control objectives, they can achieve stronger coverage with less burden on the business.

The most effective model is one in which compliance and internal audit share a common view of transaction risk, while preserving their separate mandates. Compliance performs targeted monitoring and program oversight. Internal audit independently evaluates whether the anti bribery control environment is designed and operating effectively. Each function benefits from the work of the other, but neither substitutes for the other.

A Better Way To Structure Collaborative Reviews

A practical way to coordinate anti bribery detection is to organize the review model around control design, operating effectiveness, and risk based monitoring. This structure is more useful than dividing work only by function because it aligns the assurance approach to how illicit payments actually bypass controls.

When organizations evaluate control design, they assess whether the preventive and detective control framework is capable of stopping or surfacing improper payments before they are embedded in normal accounting activity. When they evaluate operating effectiveness, they test whether those controls are consistently functioning in real transactions and whether exceptions are being challenged. When they monitor, they use data and trigger based review to identify payment behavior that warrants additional investigation or targeted audit attention.

This three part structure creates a practical bridge between governance, transaction testing, and analytics.

Evaluating Control Design Through An Anti Bribery Lens

Control design reviews should go beyond traditional financial authorization logic. They should assess whether the process architecture makes concealment difficult.

A strong design review examines segregation of duties across vendor onboarding, contract approval, service confirmation, invoice approval, master data changes, and payment release. The objective is not simply to confirm that different individuals are involved, but to ensure that the sequence of approvals creates meaningful challenge and that approval authority is appropriate to transaction risk and value.

Contracting controls also deserve close attention. Agreements with third parties should include anti corruption clauses, audit rights where appropriate, compliance with applicable laws, cooperation obligations, and termination rights tied to misconduct or control failures. It is equally important that the actual statement of work be specific enough to allow later verification of what the third party was expected to deliver.

The integrity of accounting descriptions is another underappreciated control. Accounting teams should be trained to use booking categories that reflect the economic substance of the transaction and to maintain meaningful entry descriptions. Large manual journal entries supported only by auxiliary spreadsheets, especially where line item support is missing or vague, create opportunities for concealment and should be tightly controlled.

Financial controllers and approvers should also be trained to identify anti bribery red flags in routine finance activity. This includes unusual travel and entertainment patterns, unsupported reimbursements, high risk petty cash usage, weak service confirmations, inconsistent vendor banking details, and commercially irrational pricing patterns.

Testing Operating Effectiveness Where Illegal Payments Actually Hide

Testing for operating effectiveness should focus on whether the control framework can withstand real world pressure. This means selecting transactions not only through conventional statistical sampling, but also through judgment based selection informed by known bribery risk patterns and red flags. Statistical samples are useful for some control objectives, but on their own they may miss the very transactions that merit scrutiny because corruption schemes are often low frequency, non random, and intentionally structured to look exceptional but explainable.

A stronger testing approach includes payments across multiple risk levels, with deliberate inclusion of transactions that are not necessarily high value but display unusual characteristics. These may include unnecessary intermediaries, vague consulting arrangements, success based compensation with no measurable output, emergency vendor onboarding, repeat reimbursements without adequate support, unusual discounts or rebates, or payments approved shortly before key regulatory or commercial milestones.

Third party testing is especially important. Reviews should examine whether due diligence was completed before engagement, whether red flags were resolved rather than simply documented, whether the third party had the capability to perform the service, whether beneficial ownership and control were understood, whether screening was refreshed appropriately, and whether the actual service provided can be corroborated through evidence beyond the invoice itself.

Approvals should also be tested for substance. Effective approval is not the presence of a signature in workflow. It is evidence that the approver assessed legitimacy, reasonableness, service performance, pricing, and potential conflicts of interest. If a company cannot demonstrate how an approver validated the business purpose of a payment, then the approval may have limited control value even if it was technically completed.

Using Monitoring To Surface Concealed Risk Earlier

Ongoing monitoring is one of the highest value areas in anti bribery detection because it can identify suspicious activity before it becomes systemic. The most effective monitoring models use data analytics to identify transactions and vendor behavior that deviate from expected patterns and then route those signals into compliance review, finance challenge, or internal audit follow up.

Monitoring should focus on transaction types that historically present bribery and fraud exposure, including gifts, meals, entertainment, travel, sponsorships, charitable donations, political contributions where permitted by law, agent commissions, distributor rebates, consulting fees, customs and logistics charges, and manual adjustments that affect vendor balances or expense classifications.

It is also important to monitor payment destinations and methods. Payments to offshore accounts, payments in currencies that do not align with the contractual arrangement, split payments, advances, round dollar payments, unusual prepayments, credits and rebates without clear commercial support, and sudden changes in bank account details all warrant closer review.

Trend analysis can be particularly effective. Out of pattern commissions by service type, abrupt pricing increases or decreases, changes in lease or equipment related expenses, repeated invoice amounts just below approval thresholds, and recurring payments to recently created vendors can all signal elevated risk. On their own, these indicators do not prove misconduct. Their value lies in helping the organization prioritize review where the transaction logic appears economically weak or control behavior appears abnormal.

What High Performing Programs Do Differently

Organizations with stronger anti bribery detection capability do not rely on isolated controls. They connect due diligence, contracting, procurement, accounts payable, general ledger data, employee expenses, and issue management into a coherent control environment. They also understand that corruption risk overlaps with fraud risk, sanctions risk, and money laundering exposure. That overlap matters because the same transactional patterns that indicate a bribery concern may also indicate vendor fraud, collusion, false billing, or concealment of beneficial ownership.

High performing programs also avoid treating anti bribery testing as a once a year review. They use targeted analytics and focused assurance cycles that adapt as the business changes. Market entry, distributor model changes, public sector expansion, customs intensive operations, and urgent project delivery environments all create periods where transaction scrutiny should increase.

Most importantly, mature programs ensure that findings lead to response. A red flag is only useful if the organization has a clear process to investigate it, escalate it, document conclusions, and adjust controls where necessary.

Common Weaknesses That Undermine Detection

Several recurring weaknesses tend to reduce the effectiveness of anti bribery detection even in otherwise mature organizations.

One is overreliance on due diligence at onboarding without enough scrutiny of what happens after the third party is engaged. A third party may pass initial screening and still become a bribery risk through changes in ownership, personnel, subcontracting, payment structure, or business pressure.

Another is excessive dependence on form based approvals. If the approval process captures signatures but not real challenge, then improper payments can move through the system with apparent control compliance.

A third weakness is insufficient integration between compliance monitoring and internal audit assurance. If compliance identifies recurring anomalies but audit does not assess whether the underlying control design is flawed, the organization treats symptoms instead of causes. If internal audit identifies design weaknesses but compliance does not adapt monitoring to reflect those weaknesses, risk remains under observed.

A final weakness is poor accounting transparency. Ambiguous general ledger descriptions, inconsistent use of expense categories, unsupported manual journal entries, and poor vendor master governance can make even a good anti bribery program far less effective.

Final Perspective

Detecting illegal payments in accounting records requires more than vigilance and more than policy. It requires a transaction level view of corruption risk supported by control discipline, data analysis, and coordinated assurance. Companies that treat anti bribery compliance, internal audit, and financial control as separate worlds will continue to miss important signals. Companies that connect them through a shared risk model and a common evidence base will be far better positioned to prevent, detect, and respond to concealed payments.

For boards, audit committees, chief compliance officers, and heads of internal audit, the practical question is no longer whether anti bribery controls exist. The more important question is whether those controls can detect a payment that was intentionally designed to look ordinary. That is the standard that matters.

References

US Department of Justice and US Securities and Exchange Commission. A Resource Guide To The US Foreign Corrupt Practices Act

US Department of Justice. Evaluation Of Corporate Compliance Programs

Organisation For Economic Co operation and Development. Good Practice Guidance On Internal Controls, Ethics, And Compliance

International Organization for Standardization. ISO 37001 Anti Bribery Management Systems Requirements With Guidance For Use

Committee of Sponsoring Organizations of the Treadway Commission. Internal Control Integrated Framework

Institute of Internal Auditors. Global Internal Audit Standards and guidance relevant to fraud and corruption risk oversight

Association of Certified Fraud Examiners. Occupational Fraud Reports and anti fraud control guidance

Get the latest in corporate governance, risk, and compliance on Twitter

Audit Procedures for FCPA Testing

Article by Prof. Hernan Huwyler, MBA, CPA, CAIO
AI GRC Director | AI Risk Manager | Quantitative Risk Lead
Speaker, Corporate Trainer and Executive Advisor

Top 10 Responsible AI and Risk Management by Thinkers360

FCPA Audit Procedures: A Practical Framework For Testing Anti-Bribery Controls

The Role Of Periodic Testing In FCPA Compliance

An effective Foreign Corrupt Practices Act compliance program requires more than policies and training. It requires periodic testing of the controls designed to prevent, detect, and respond to corrupt payments. Testing reveals whether the controls that management has designed are actually functioning in practice, identifies areas of vulnerability that may not be visible through routine monitoring, and provides the evidentiary foundation for demonstrating program effectiveness to regulators in the event of an inquiry.

The DOJ and SEC Resource Guide to the U.S. Foreign Corrupt Practices Act, originally published in 2012 and updated in 2020, identifies testing as a hallmark of an effective compliance program. The DOJ Evaluation of Corporate Compliance Programs, most recently updated in 2023, specifically asks whether the organization conducts periodic reviews and testing of its compliance controls, and whether the results of that testing inform updates to the program. The DOJ guidance makes clear that prosecutors will evaluate not only whether testing occurs but whether the organization acts on the results, updating policies, controls, and risk assessments to address identified weaknesses.

The FCPA contains two distinct sets of provisions that create compliance obligations. The anti-bribery provisions prohibit the payment of anything of value to foreign government officials for the purpose of obtaining or retaining business. The books and records and internal accounting controls provisions under Sections 13(b)(2)(A) and 13(b)(2)(B) of the Securities Exchange Act require issuers to maintain books and records that accurately and fairly reflect transactions and to devise and maintain a system of internal accounting controls sufficient to provide reasonable assurances that transactions are executed and recorded in accordance with management's authorization. These accounting provisions apply regardless of whether a bribe has occurred and are frequently the basis for enforcement actions even in the absence of a proven corrupt payment. An effective FCPA audit program must test controls that address both sets of provisions.

The following framework organizes common FCPA audit procedures by control domain, providing a structured approach for internal audit, compliance, and external advisors conducting periodic reviews.

Entity-Level And Program-Level Controls

The foundation of any FCPA audit begins with an evaluation of the organization's entity-level anti-corruption controls, meaning the policies, governance structures, and oversight mechanisms that establish the compliance framework within which all transaction-level controls operate.

Anti-Corruption Policies And Procedures. The audit should verify that the organization maintains clearly articulated FCPA and anti-corruption policies and procedures that are applicable to all company personnel, directors, officers, and third-party intermediaries including agents, consultants, distributors, and joint venture partners. The policies should address not only the FCPA but also the UK Bribery Act 2010, France's Sapin II, and other applicable extraterritorial anti-corruption laws under which the organization may have obligations. Policies that address only the FCPA without acknowledging other applicable regimes create compliance gaps that the audit should identify.

Policy Communication And Accessibility. The audit should confirm that anti-corruption policies have been communicated to all levels of employees, including personnel in overseas operations, and that translations are available in the local languages of every jurisdiction where the organization operates. Communication should not be limited to initial distribution. The audit should evaluate whether periodic reinforcement occurs and whether employees are required to acknowledge receipt and understanding of the policies.

Training Programs. The audit should assess whether mandatory anti-corruption training is provided to all personnel with FCPA-relevant responsibilities, including sales and business development teams, legal staff, internal audit, accounting and finance personnel, and management at all levels. Training should also extend to agents, sub-agents, distributors, and business partners who act on behalf of the organization. The audit should evaluate whether training content is tailored to the specific risks of each audience, whether it is refreshed periodically to reflect changes in the regulatory environment and enforcement trends, and whether completion is tracked and enforced.

Whistleblower And Reporting Mechanisms. The audit should verify the existence and effectiveness of a compliance hotline or other reporting mechanism that allows employees and third parties to report suspected violations confidentially and, where permitted by local law, anonymously. The evaluation should extend beyond the existence of the channel to assess whether the mechanism is accessible, trusted, and actively used. Low reporting volumes may indicate either a strong ethical culture or a channel that employees do not trust or know about. The audit should examine how reports are triaged, investigated, and resolved, and whether the organization tracks reporting trends and response times as compliance metrics.

Compliance Governance And Oversight. The audit should confirm that responsibility for FCPA compliance has been assigned to one or more senior executives with adequate authority, resources, and access to the board or audit committee. The DOJ Evaluation of Corporate Compliance Programs specifically examines whether the compliance function has sufficient autonomy, stature, and resources to be effective and whether the compliance officer has direct access to the board.

Disciplinary Framework. The audit should evaluate whether the organization maintains and enforces appropriate disciplinary procedures for anti-corruption violations. The disciplinary framework should be applied consistently across all levels of the organization, including senior management. The DOJ guidance specifically examines whether disciplinary measures have been applied and whether senior employees have been held to the same standards as junior staff.

Facilitation Payments. The FCPA contains a narrow statutory exception for facilitating or expediting payments made to foreign officials to secure the performance of routine governmental actions such as processing permits, visas, or customs clearances. However, this exception is narrowly construed, does not exist under the UK Bribery Act or most other international anti-corruption laws, and has been the subject of increasing regulatory scrutiny. Many multinational organizations have eliminated the facilitation payment exception from their policies entirely. The audit should evaluate the organization's policy on facilitation payments, determine whether any such payments are being made, and if so, assess whether they fall within the narrow statutory exception. If the organization maintains a general ledger account or cost center for facilitation payments, the audit should examine all transactions recorded to that account, evaluate whether the payments genuinely qualify for the exception, and assess whether the accounting treatment accurately reflects the nature of the transactions. The existence of a dedicated facilitation payment account should itself be evaluated as a potential control weakness, because it may normalize a category of payment that carries significant legal and reputational risk.

Legal And Commercial Risk Identification

The audit program should include procedures designed to identify legal and commercial arrangements that create elevated FCPA risk, often through transactions and relationships that are not flagged by routine financial controls.

International Business Arrangements. Working with legal advisors and business managers, the audit team should identify international business agreements where corruption risk may be elevated. This includes contracts that were not competitively bid or awarded through non-transparent processes, ongoing governmental disputes or tax controversies that may create incentives for improper payments to resolve them, commercial litigation in foreign courts where the organization may be vulnerable to extortion or solicitation, and any arrangement where the commercial rationale for the terms or the selection of the counterparty is not clearly documented.

Government Touchpoints. The audit should map the organization's interactions with foreign government officials across all business functions, including sales, permitting, customs, tax, regulatory compliance, and litigation. Each touchpoint represents a potential corruption exposure, and the audit should evaluate whether adequate controls exist at each point of interaction.

Commercial Cycle Testing

The commercial cycle presents significant FCPA exposure because it encompasses the transactions through which corrupt payments are most commonly disguised.

Transactions With Government-Related Counterparties. The audit should identify and examine transactions with customers, suppliers, and distributors that are government-owned or government-controlled entities, or that involve individuals who are foreign government officials as defined under the FCPA. This definition extends beyond traditional government employees to include employees of state-owned enterprises, public international organizations, and political parties, as well as candidates for political office. The audit should also scrutinize one-off or unusual payments within otherwise recurring commercial relationships, as irregular transactions may indicate concealed improper payments.

Pricing Anomalies And Invoice Adjustments. The audit should review discounts, rebates, refunds, promotional incentive programs, and other invoice adjustments for evidence of payments that lack a legitimate commercial justification. Unusual pricing patterns, particularly when applied to government-related customers or in high-corruption-risk jurisdictions, may indicate that value is being transferred as a disguised bribe.

Agent And Distributor Audits. The organization should conduct periodic compliance audits of its key agents and distributors, particularly those operating in high-risk jurisdictions or those whose compensation structure includes success-based fees, commissions, or other variable arrangements. These audits should evaluate the agent's compliance with the organization's anti-corruption policies, verify the legitimacy and delivery of services for which the agent has been compensated, and assess whether the agent has sub-contracted or delegated responsibilities to additional intermediaries without the organization's knowledge or approval.

Commission And Finder's Fee Analysis. The audit should analyze all commission, finder's fee, and referral fee payments to determine whether the amounts are reasonable and proportionate to the services provided, whether the payment terms are consistent with industry norms, and whether the recipients have been subject to appropriate due diligence. Commissions that exceed industry benchmarks, that are paid to entities in jurisdictions unrelated to the underlying transaction, or that are structured as success fees tied to the award of a government contract warrant heightened scrutiny.

Government Contract Review. The audit should examine all contracts with government entities or government-controlled counterparties, evaluating the procurement process, the pricing terms, the performance of contractual obligations, and the involvement of any intermediaries in securing the contract.

Contract Compliance Review. The audit should review standard provisions in commercial agreements, distribution contracts, and renewals to confirm that they contain the anti-corruption representations, warranties, audit rights, and termination clauses required by the organization's policies and the FCPA compliance program.

Credit Terms And Pricing Review. The audit should evaluate whether favorable or abnormal credit terms, extended payment periods, or below-market pricing have been extended to any counterparties without documented commercial justification. These arrangements may represent the transfer of value to a corrupt counterparty or their associates.

Customs, Duties, And Logistics. The audit should identify unusual duties, taxes, or charges involving excessive processing, shipping, or logistics fees. These cost categories are frequently used to disguise improper payments, particularly in jurisdictions where customs clearance involves direct interaction with government officials.

Services And Professional Fees Testing

Professional service engagements provide one of the most common mechanisms for disguising corrupt payments, because the intangible nature of services makes it difficult to verify delivery and value.

Consultant And Intermediary Scrutiny. The audit should examine payments to consultants, sales representatives, agents, attorneys, lobbyists, marketing firms, and other professional service providers. For each engagement, the audit should verify that the intermediary is fulfilling a legitimate and documented business need, that a written rationale for the engagement exists and was approved before the services commenced, and that the intermediary's qualifications, resources, and track record are consistent with the services billed. Engagements where the services are described in vague or unspecified terms, where deliverables cannot be identified or confirmed, or where the intermediary was recommended by a foreign government official are significant red flags.

Third-Party Due Diligence Verification. The audit should verify that pre-engagement due diligence was completed for all third-party intermediaries before the relationship was established. Due diligence should include verification of beneficial ownership, sanctions and watchlist screening, review of the intermediary's reputation and business history, and assessment of whether the intermediary has any relationships with government officials that could create a conflict of interest. The DOJ and SEC Resource Guide identifies due diligence on third-party partners as one of the most critical components of an effective FCPA compliance program.

Commission And Bonus Reasonableness. The audit should confirm that commissions, bonuses, and success fees paid to intermediaries fall within expected and reasonable ranges for the type of service, the jurisdiction, and the industry. Compensation that significantly exceeds market norms warrants investigation into whether the excess is being passed through to government officials.

FCPA-Sensitive Account Auditing. The audit should specifically examine transactions recorded to accounts that are commonly associated with FCPA risk, including gifts, hospitality, entertainment, travel, rebates, refunds, commissions, charitable and political donations, professional fees, event sponsorships, credit card charges and advances, and logistics and shipping expenses. These account categories should be tested through both targeted sampling based on risk indicators and data analytics that identify outliers, unusual patterns, and transactions that match known corruption typologies.

Keyword And Text Mining. Where the organization's ERP and financial systems permit, the audit should deploy automated queries to search transaction descriptions, invoice text, and supporting documentation for keywords associated with corruption risk. These searches should be conducted in multiple languages relevant to the organization's operating jurisdictions and should include terms associated with improper payments such as commission, fee, discount, charitable, bonus, expedite, facilitation, and similar terms in the applicable local languages. The search terms should be periodically updated to reflect emerging corruption typologies and the specific terminology observed in recent enforcement actions.

Treasury And Cash Management Testing

Treasury operations require specific FCPA audit attention because they involve the movement of funds and the potential for payments to be routed through structures designed to obscure their ultimate destination.

Unusual Payment Identification. The audit should flag unusual payments or financial arrangements for investigation, including payments to consultants or service providers routed through offshore entities or holding companies, payments directed to jurisdictions where the organization does not conduct business, payments to newly established entities with no operating history, and payments involving multiple intermediary accounts before reaching the stated beneficiary.

Cash And Bank Transaction Review. The audit should review cash payments and bank transactions, with particular attention to transactions involving rounded values, payments structured to fall below approval or reporting thresholds, and payments that lack adequate supporting documentation. In SAP and other ERP environments, automated exception reports can be configured to identify these patterns systematically.

Charitable And Political Contributions. The audit should monitor all charitable donations and political contributions to determine whether they were properly authorized, whether the recipient organization has been subject to due diligence, and whether there is any connection between the contribution and a pending or anticipated government decision affecting the organization. Charitable contributions have been used in FCPA enforcement cases as a mechanism for channeling value to government officials through entities they control or are affiliated with.

Expense Report Review. The audit should examine employee expense reports, with targeted review of high-risk expense categories including meals, entertainment, travel, and gifts involving foreign government officials. The audit should verify that expense reports are submitted through the accounts payable process with appropriate approvals and supporting documentation, that expenses involving government officials comply with the organization's gifts, hospitality, and entertainment policy, and that no expenses have been reimbursed outside the normal expense reporting process through direct invoice payment or other alternative channels.

Risk Mapping And Corruption Risk Assessment

The audit program should be informed by a corruption risk assessment that evaluates the organization's exposure across multiple dimensions.

Country Risk. The organization should assess FCPA risk by jurisdiction, incorporating objective indicators such as the Transparency International Corruption Perceptions Index, the World Bank Worldwide Governance Indicators, and country-specific enforcement history. However, as discussed in the earlier post on detecting illegal payments, country risk is only one dimension of a comprehensive corruption risk assessment and should not be used as the sole determinant of audit scope.

Industry And Product Risk. Certain industries carry elevated corruption risk due to the nature of their interaction with government authorities and the structure of their commercial relationships. These include oil and gas, energy, infrastructure and construction, defense and aerospace, telecommunications, medical devices and pharmaceuticals, and any industry operating in heavily regulated markets where government approvals, permits, or procurement decisions are required. The audit scope should reflect the specific risk profile of the organization's industry and product portfolio.

Third-Party And Channel Risk. The organization should assess the corruption risk associated with its sales channels and intermediary relationships, with particular attention to joint ventures and collaborative arrangements with government-related entities, sales channels that require the use of third-party agents or distributors to interact with government officials, transactions where intermediaries are involved in both pre-sale and post-sale activities, and relationships with intermediaries who were recommended or required by government counterparties.

Transaction And Regulatory Interaction Risk. Transactions that involve direct interaction with foreign regulators, including permitting, licensing, inspection, customs clearance, and tax administration, present inherent FCPA risk that the audit program should address through targeted testing procedures.

Mergers, Acquisitions, And Structural Changes

The DOJ and SEC have consistently emphasized that pre-acquisition FCPA due diligence and post-acquisition integration of the target's compliance program are critical components of an effective anti-corruption compliance framework. The audit program should include procedures to evaluate whether FCPA due diligence was conducted before the organization completed any acquisition, investment, or joint venture involving international operations, and whether the target's compliance program has been integrated into the acquiring organization's standards within a reasonable period following the transaction.

Several significant FCPA enforcement actions have involved conduct at acquired companies that was not identified during due diligence or not remediated during post-acquisition integration. The audit should assess whether the organization's M&A due diligence process includes anti-corruption risk assessment, third-party review, and books and records evaluation as standard components.

From Testing To Program Improvement

FCPA audit procedures are not an end in themselves. They are the mechanism through which the organization validates the effectiveness of its anti-corruption controls and generates the information needed to improve the compliance program continuously. Every finding from the audit program should be evaluated for its implications for the organization's corruption risk assessment, its policies and procedures, its training content, its third-party due diligence requirements, and its monitoring and detection capabilities.

The DOJ Evaluation of Corporate Compliance Programs explicitly examines whether the organization has a process for incorporating lessons learned from its testing, investigations, and enforcement developments into its compliance program. An audit program that identifies weaknesses but does not drive remediation and program evolution provides limited value and may actually increase the organization's regulatory exposure by creating documented evidence of known deficiencies that were not addressed.

The organizations that derive the greatest value from FCPA testing are those that treat it not as a periodic compliance obligation but as a continuous source of intelligence about the effectiveness of their anti-corruption controls and the adequacy of their risk assessment. This orientation transforms the audit function from a retrospective assurance exercise into a forward-looking component of the organization's anti-corruption governance.

Get the latest in corporate governance, risk, and compliance on  Twitter
 

FCPA Enforcement Patterns By Country

Article by Prof. Hernan Huwyler, MBA, CPA, CAIO
AI GRC Director | AI Risk Manager | Quantitative Risk Lead
Speaker, Corporate Trainer and Executive Advisor

Top 10 Responsible AI and Risk Management by Thinkers360

What The Data Reveals And How To Use It In Compliance Risk Assessment

The Question Behind The Data: How Do You Assess Country-Level Corruption Risk

Every multinational organization that operates or transacts business internationally must assess its corruption risk exposure by country. This assessment informs the design of the anti-corruption compliance program, the allocation of compliance resources across jurisdictions, the scope and intensity of third-party due diligence, the internal audit plan, and the board-level reporting on the organization's aggregate anti-corruption risk profile.

The question of how to perform this country-level assessment is more difficult than it appears. No single data source provides a complete and reliable picture of corruption risk for any jurisdiction. The most commonly used indicator, the Transparency International Corruption Perceptions Index, measures the perceived level of public sector corruption as assessed by experts and business executives, but it does not measure actual corruption incidence, it does not differentiate between the types of corruption most relevant to a specific organization's operations, and its methodology captures perceptions that may lag behind or diverge from actual enforcement and compliance conditions.

FCPA enforcement data provides a different and complementary perspective. The enforcement record reveals which countries appear most frequently as the jurisdictions where the corrupt conduct occurred, which industries are most heavily represented in enforcement actions, what penalty magnitudes are associated with different types and scales of corrupt conduct, and how enforcement patterns have evolved over time. This data does not measure the level of corruption in a country. It measures the intersection of corrupt conduct with the FCPA's jurisdictional reach and the enforcement priorities of the DOJ and SEC. These are related but distinct concepts, and conflating them produces analytical errors that can distort the compliance risk assessment.

What FCPA Enforcement Data Actually Measures

The FCPA enforcement record, maintained through databases including the Stanford Law School Foreign Corrupt Practices Act Clearinghouse and the enforcement statistics published by the DOJ and SEC, captures the cases that U.S. enforcement authorities have chosen to investigate, have successfully resolved through guilty pleas, deferred prosecution agreements, non-prosecution agreements, SEC administrative orders, or trial verdicts, and have made public through enforcement announcements and court filings.

This dataset is valuable but it is subject to several systematic biases that must be understood before drawing conclusions about country-level corruption risk.

Enforcement reflects U.S. prosecutorial priorities, not global corruption incidence. The cases that appear in the enforcement record represent the subset of global corruption that falls within the FCPA's jurisdictional reach and that the DOJ and SEC have chosen to pursue. Corrupt conduct that occurs in jurisdictions without significant U.S. commercial connections, that does not involve issuers or domestic concerns, or that falls below the enforcement agencies' resource and priority thresholds will not appear in the data regardless of its severity.

Self-reporting and cooperation incentives skew the dataset. The DOJ Corporate Enforcement Policy provides significant benefits for organizations that voluntarily self-disclose FCPA violations, which means that the enforcement record is disproportionately composed of cases involving organizations sophisticated enough to have compliance programs that detect violations and cultures that support self-disclosure. Countries where violations occur within organizations that lack detection and self-reporting capabilities may be underrepresented in the enforcement data.

Coordinated multi-jurisdictional resolutions complicate country and penalty attribution. Many of the largest FCPA enforcement actions in recent years have involved coordinated resolutions with enforcement authorities in multiple countries. The Airbus resolution in 2020, which produced approximately $3.9 billion in combined penalties, was a coordinated settlement involving the DOJ, the UK Serious Fraud Office, and the French Parquet National Financier. The conduct spanned multiple countries, and the penalty was shared across three enforcement authorities. Attributing the full penalty to the FCPA or to a single country of corrupt conduct would be analytically incorrect. Similarly, the Goldman Sachs resolution related to the 1MDB scandal produced over $2.9 billion in combined global penalties through settlements with authorities in the United States, the United Kingdom, Hong Kong, Singapore, and Malaysia. These coordinated resolutions reflect a global enforcement trend, discussed in the earlier post on FCPA enforcement trends, in which the total penalty encompasses the combined enforcement of multiple national authorities.

The absence of enforcement does not indicate the absence of corruption. Countries with no FCPA enforcement actions may have low corruption, or they may have high corruption that has not been detected, reported, or prosecuted under the FCPA. Using enforcement case counts as a direct measure of corruption risk inverts the relationship between the indicator and the underlying condition. A country with many FCPA cases may have high corruption, or it may have high levels of U.S. commercial activity combined with effective enforcement cooperation and corporate self-reporting. A country with few FCPA cases may have low corruption, or it may have corruption that has not been exposed through U.S. enforcement channels.

The Flawed Logic Of Media Attention As A Corruption Risk Proxy

The approach of measuring country-level corruption risk by counting the number of search engine results for keywords such as fcpa, bribery, and whistleblower in each country's media is methodologically unsound for several reasons that disqualify it as a basis for compliance risk assessment.

Media volume measures media interest, not corruption incidence. The number of news articles containing FCPA-related keywords in a given country reflects the local media's interest in the topic, the country's press freedom and investigative journalism capacity, the language and terminology used in the local media to discuss corruption, and the volume of English-language media produced in or about that country. None of these factors is a reliable proxy for the actual level of corruption or the organization's compliance risk exposure in that jurisdiction.

The directional interpretation is incorrect. The original analysis concluded that countries with more FCPA-related media coverage likely have lower anti-bribery compliance risk, on the theory that higher awareness indicates better compliance. This conclusion inverts the more plausible interpretation. Countries with extensive FCPA media coverage may have that coverage precisely because significant FCPA enforcement actions have occurred there, because local media has investigated corruption stories involving multinational companies, or because whistleblower cases have generated public attention. High media volume is at least as likely to indicate high corruption exposure as it is to indicate effective compliance.

Search engine result counts are not a stable or reliable data source. The number of results returned by a search engine for a given query varies based on the search engine's indexing algorithms, the user's location and search history, the language settings, and temporal factors including the recency of relevant news events. These counts are not reproducible, not comparable across languages, and not suitable as inputs to a quantitative risk assessment methodology.

The trade volume normalization introduces additional distortion. Normalizing media hit counts by the country's trade volume with the United States creates a ratio that has no interpretive meaning. A country with high trade volume and moderate media coverage produces a different ratio than a country with low trade volume and the same media coverage, but the ratio does not correspond to any meaningful measure of corruption risk, compliance maturity, or enforcement exposure.

Country-level corruption risk assessment requires purpose-built indicators that are designed to measure the specific risk factors relevant to the organization's compliance program, not general-purpose proxies derived from media volume analysis. The methodology described in the earlier post on building a criminal compliance risk map provides a structured framework for mapping compliance risks across jurisdictions using the four-dimensional assessment of where, who, what, and how that was developed in the post on detecting illegal payments in accounting records.

How To Use FCPA Enforcement Data In Compliance Risk Assessment

Despite its limitations, FCPA enforcement data provides valuable intelligence for compliance risk assessment when used correctly, meaning as one input among several rather than as a standalone risk measure.

Enforcement patterns identify the industries and transaction types that attract prosecutorial attention. The FCPA enforcement record demonstrates that certain industries are disproportionately represented in enforcement actions. Energy and extractive industries, infrastructure and construction, aerospace and defense, telecommunications, pharmaceuticals and healthcare, and financial services have generated the highest volumes of enforcement activity. Organizations operating in these sectors should calibrate their compliance programs to reflect the elevated enforcement attention that their industry attracts, regardless of the specific countries in which they operate.

Enforcement data reveals the jurisdictions where the corrupt conduct most frequently occurs. The Stanford FCPA Clearinghouse and similar databases document the countries identified in enforcement actions as the locations where bribes were paid or where corrupt schemes were operated. Countries that appear frequently in the enforcement record, including China, Brazil, Mexico, Nigeria, Russia, India, Indonesia, Saudi Arabia, and several others, warrant heightened due diligence, more intensive training, and more robust monitoring within the organization's compliance program. However, this heightened attention should supplement rather than replace the organization's own assessment of the specific risk factors present in each jurisdiction.

Penalty data reveals the financial consequences of violations by scale and type. The progression of FCPA penalties over the past two decades demonstrates that enforcement consequences have increased dramatically. The Siemens resolution of approximately $800 million in combined DOJ and SEC penalties in 2008 was a landmark at the time. Subsequent resolutions have substantially exceeded that level. The scale of penalties is relevant to the compliance business case discussed in the earlier post on FCPA enforcement trends because it quantifies the financial consequence of compliance program failure.

The ratio of foreign-headquartered to U.S.-headquartered defendants reveals jurisdictional reach. The enforcement record demonstrates that a significant proportion of FCPA corporate enforcement actions involve non-U.S. companies, and that these companies have on average paid larger penalties than their U.S. counterparts. This pattern reflects the FCPA's broad jurisdictional reach, which extends to any issuer with securities registered in the United States and to any person who commits an act in furtherance of a corrupt payment while within U.S. territory. Non-U.S. companies that have U.S.-listed securities, that transact through U.S. financial institutions, or that have any other jurisdictional nexus with the United States are subject to FCPA enforcement and should design their compliance programs accordingly.

Coordinated international enforcement is the emerging norm. The trend toward multi-jurisdictional resolutions involving the DOJ, SEC, and enforcement authorities in the United Kingdom, France, Brazil, the Netherlands, and other countries demonstrates that FCPA enforcement increasingly operates within a global enforcement ecosystem. Organizations should assess their corruption risk exposure not only against the FCPA but against the full range of anti-corruption laws under which they may face enforcement, including the UK Bribery Act 2010, France's Sapin II, Brazil's Clean Company Act, and the growing number of national anti-corruption laws with extraterritorial reach.

Building A Defensible Country Risk Assessment Methodology

A defensible country-level corruption risk assessment for compliance program design should integrate multiple validated data sources rather than relying on any single indicator.

Objective corruption perception and governance indicators provide the broadest assessment of country-level corruption risk. The Transparency International Corruption Perceptions Index, the World Bank Worldwide Governance Indicators, and the TRACE Bribery Risk Matrix each measure different dimensions of corruption risk and governance quality and provide complementary perspectives when used together. These indicators should be consulted as a starting point for identifying high-risk jurisdictions, not as a definitive assessment.

FCPA and international enforcement data identifies the jurisdictions, industries, and transaction types that have generated the most significant enforcement activity. This data should inform the organization's assessment of enforcement risk, which is distinct from but related to corruption risk, and should direct enhanced due diligence and monitoring toward the jurisdictions and business activities where enforcement attention is concentrated.

Organization-specific risk factors must supplement the external indicators with the assessment of how the organization's specific operations, counterparties, and business activities interact with the corruption risk characteristics of each jurisdiction. As discussed in the earlier post on detecting illegal payments, the risk assessment should evaluate where the organization operates, who it does business with, what services are provided, and how transactions are structured and paid. A jurisdiction that is rated as moderate risk by external indicators may present high risk for a specific organization based on the nature of its local operations, the government touchpoints inherent in its business model, and the third-party relationships through which it operates.

Regulatory and enforcement environment assessment evaluates the local anti-corruption enforcement capacity, the independence and effectiveness of the local judiciary, the existence and enforcement of local anti-corruption legislation, and the level of international enforcement cooperation. Jurisdictions with active enforcement programs and cooperative relationships with U.S. and European enforcement authorities present different risk profiles than jurisdictions with weak enforcement infrastructure, even if the underlying corruption levels are similar.

Internal compliance data including the results of compliance monitoring, internal investigations, whistleblower reports, audit findings, and training completion rates in each jurisdiction provides the organization-specific evidence that external indicators cannot capture. This internal data reveals the actual compliance conditions within the organization's own operations and should be given significant weight in the risk assessment.

The integration of these multiple data sources into a coherent country risk assessment requires a defined methodology that specifies how each data source is weighted, how the sources are combined to produce a composite risk rating, and how the assessment is updated in response to changes in the data inputs. The earlier post on building a criminal compliance risk map provided the structural framework for this methodology, and the earlier post on risk assessment in rapidly changing environments addressed the mechanisms through which the assessment is kept current as conditions evolve.

From Data Collection To Compliance Intelligence

The volume of data available for corruption risk assessment, from enforcement databases and perception indices to media analysis and trade statistics, has never been greater. The challenge for compliance professionals is not obtaining data but converting data into intelligence that supports defensible compliance program decisions.

Intelligence requires analysis, and analysis requires methodology. A data point without methodology is an anecdote. A collection of data points without methodology is a database. Only when data is collected through validated sources, analyzed through a defined methodology, interpreted in the context of the organization's specific operations and obligations, and presented through governance reporting that enables informed decision-making does it become the compliance intelligence that the board, the chief compliance officer, and the risk committee need to fulfill their governance obligations.

The FCPA enforcement record, the corruption perception indices, the organization's internal compliance data, and the jurisdiction-specific risk factors described in this post provide the raw materials for this intelligence. The compliance risk assessment methodology transforms those raw materials into the prioritized, evidence-based, and defensible risk profile that drives every downstream compliance program decision, from resource allocation and due diligence scope to training design and monitoring intensity.

The organizations that build this analytical capability will find that their compliance programs are not only more effective at preventing corruption but more defensible when their effectiveness is evaluated by the regulators, prosecutors, and enforcement authorities whose expectations the earlier posts on FCPA enforcement trends, FCPA audit procedures, and global compliance program design described in detail.

Bribery & Corruption Perception World Map * Transparency International