Global expansion without adequate controls is asking for trouble. That’s the lesson of a $19 million settlement between WPP, the world’s largest advertising agency, and the U.S. Securities and Exchange Commission (SEC) to resolve alleged violations of the Foreign Corrupt Practices Act (FCPA).

According to an SEC order memorializing the settlement, WPP’s trouble began when it launched a rapid worldwide growth strategy, acquiring locally operated ad agencies around the world, including some in what the SEC calls “high-risk markets,” like China, Brazil, India, and Peru. The order emphasized that, in purchasing the local agencies, WPP allowed the agencies’ founders to remain in control, an approach that increased the risk that the agencies would continue to operate as they did before being purchased.

Unbeknownst to WPP, some of the agencies had a practice of using vendors as intermediaries for improper payments, including bribery of government officials. For example, an India subsidiary received $1.5M from the Department of Information and Public Relations (DIPR) of the Indian state of Telangana supposedly to execute an ad campaign. In fact, no such ad campaign occurred, and instead the India subsidiary’s CEO arranged for a vendor to falsify documents so the subsidiary could justify paying most of the $1.5M to the vendor. The vendor then paid some of the money to an intermediary responsible for making payments to DIPR officials, while sending the rest back to the subsidiary and its CEO.

There is no allegation in the SEC order that WPP corporate headquarters knew of the subsidiaries’ practices when it purchased them. But, a purchasing company will invariably be held responsible for what happens after it assumes control, and WPP was deemed liable for the post-acquisition conduct of its subsidiaries and for failing to implement adequate internal controls.

This is because the FCPA does not just prohibit bribery of government officials. It also imposes duties on corporations to devise and maintain a system of internal accounting controls and to keep books and records that accurately and fairly reflect the transactions of the corporation.

According to the SEC order:

1. WPP lacked sufficient internal accounting controls with respect to its expansive international network;
2. WPP had no compliance department during the relevant period;
3. WPP lacked meaningful coordination between its legal and internal audit departments and its subsidiaries; and
4. WPP did not provide adequate oversight of the subsidiaries to ensure that they implemented WPP’s internal accounting controls and compliance policies. As a result, the order said, WPP failed to respond adequately to warning signs of corruption.

This last point was crucial. For example, when WPP received an anonymous complaint about the India subsidiary’s bribery scheme that identified the CEO as its architect, WPP’s Financial Director for the India region hired an international accounting firm to investigate the allegations and review the India subsidiary’s processes for transactions involving government clients. According to the SEC order, the accounting firm relied on information from the subsidiary and its CEO, without contacting third parties, and the report it provided to WPP contained no conclusions regarding bribery allegations. The report did cite red flags concerning the vendor allegedly involved, and yet, WPP continued to use the vendor for servicing government clients. It was not until two years later – after several more anonymous but specific complaints about the same bribery scheme – that WPP deployed its legal team to investigate, this time conducting a review of emails and third-party due diligence of the CEO, DIPR officials, and the vendor. Based on the results of the investigation, WPP terminated the CEO.

The SEC deemed this too little, too late. “It is essential for companies to identify the root cause of problems when red flags emerge to prevent a pattern of corrupt behavior from taking hold,” said SEC’s FCPA Unit Chief Charles Cain. “A company cannot allow a focus on profitability or market share to come at the expense of appropriate controls.”

WPP’s fate is a classic cautionary tale of the perils of rapid growth. After WPP completed implementation of its growth strategy, it employed more than 100,000 employees and operated in 112 countries. Expansion that rapid presents the challenge of growing compliance resources and mechanisms to keep pace. For companies that fall sort of that challenge, government enforcement awaits.