by Scott Moritz
Managing Director – Leader, Protiviti’s Fraud Risk Management Practice
In recognition of the 25th anniversary of the Association of Certified Fraud Examiners (ACFE) and International Fraud Awareness Week, Protiviti, whose practitioners include more than 100 members of the ACFE, is releasing a series of tips on fraud awareness to help raise awareness of the various ways that fraud can affect an organization and the proactive steps organizations can take to better position themselves in the ongoing fight against fraud.
Many uncomfortable conversations with the SEC, Department of Justice or the Serious Fraud Office start with the questions:
– Who among your customers are state-owned companies?
– How do you identify your state-owned customers?
– What heightened standard of care do you hold them to?
You either know the answers to those questions off the top of your head or you don’t. If you don’t, you have a lot of work to do. There is nothing improper about doing business with foreign government agencies or state-owned companies. In fact, in certain industries, the vast majority of your customers are government agencies or state-owned companies (think aerospace & defense or oil & gas). However, working with state-owned entities means heightened risk of violating the U.S. Foreign Corrupt Practices Act (FCPA), UK Bribery Act (UKBA) and other anti-corruption statutes that are in force.
Getting ready with the answers to the above questions isn’t too difficult if you follow the steps below:
1) First, you need to obtain or build a master customer list. Sounds simple, but if you have hundreds of different ERP systems spanning a hundred or more countries, this alone may take a little time. Once you have the list, sort it alphabetically. This will enable you to see any duplicate entries and convert them to a single entry.
2) You will then see certain companies on your master list that are obviously government agencies and others that are widely recognizable state-owned companies (think Ministry of Defense and Petróleos de Venezuela, S.A. (PDVSA)). Segregate those obvious government agencies and state-owned companies in some way, possibly into a separate list. If there are obvious non-government entities such as widely recognized publicly traded companies, consider segregating them too (think GE or Microsoft).
A word of caution here: Just because a name is one that is well-known and publicly traded doesn’t necessarily mean that it is not state-owned. Before adding any public company to the “safe list,” look at the investor relations section of the company’s website and examine the composition of the board of directors. You will be looking for government officials on the board and for a large shareholder section of government shareholders. For example, most people would view DHL as a competitor to FedEx and UPS in the package delivery business but very few realize that it is partially owned by the German Post Office and that’s its full name is Deutsche Post DHL.
3) Once you have culled the known state-owned entities from the list, there are a few options. If the remainder has hundreds of thousands of company names, searching them individually may not be cost effective. Consider batch-processing the list against a subscription database of known state-owned companies. While you will incur some expenses doing this, it will likely be less expensive than investigating each company individually. Our experience in using some of these databases has been that when there is a “hit” indicating a company is state-owned, that is usually accurate, although in some cases the information could be out of date if it was based on the prior year’s annual report and things have changed in the past year. What is most important to note is that when an entity is not listed as a state-owned company, it is incorrect to conclude that it is not state-owned. Keep in mind that even the most comprehensive databases are not 100 percent complete and that there is no unabridged listing of every state-owned company.
4) Once you have matched your customers against the state-owned company database and determined they are indeed state-owned, you can segregate them and then perform some additional research of the remaining names. Search the Internet to see if the entity has a website. If so, look at the investor relations section under corporate governance and major shareholders. If the company is state-owned, the government probably has appointed government officials to the board of directors, executive board or management board of the company.
Another way to determine state ownership is to look at annual reports. Often, the annual report of a publicly traded company lists major shareholders. If any are government agencies, other state-owned companies or government pension funds, this is a good indicator the company could be state-owned.
There are also certain industries in which foreign governments play a dominant role. Oil & gas, other natural resources, aerospace & defense, telecommunications, higher education and health care systems all can be wholly or partially state-owned. At the risk of stating the obvious, when in doubt, ask. Even if what you are finding in your research may be opaque, most companies will provide you with some transparency into their ownership if you ask them.
Once you have grouped your customers according to the four-step process above, you will be in a much better position to manage the risks your state-owned customers pose. You will need to examine closely your dealings with these customers. Gifts, entertainment, paying for travel and providing anything of value is generally prohibited. Your examination process should also consider avenues for the indirect transfer of value. One commonly abused area for transferring value improperly is charitable giving. Having an approval process for anything of value and for all charitable giving will enable you to apply appropriate and consistent scrutiny to proposed expenditures before they are incurred, thus avoiding possible liability for improper payments.