Nursery Rhymes, A Chinese Proverb, The HP FCPA Enforcement And The Myth Of The Rogue Employee

by Thomas Fox

Cow Jumping Over the MoonHey diddle diddle,

The Cat and the fiddle,

The Cow jumped over the moon.

As my friend and colleague Jay Rosen is want to remind us, he continually learns much about compliance and ethics from his Kindergarten-aged daughters. I submit that you need only look to children’s nursery rhymes in the context of the recent Hewlett-Packard (HP) Foreign Corrupt Practices Act Enforcement (FCPA) to fully appreciate the inanity of the myth of the ‘rogue employee.’ HP has been cited as the prime example of the case where a small group of evil or ‘rogue employees’ purposely mislead their ultimate US corporate parent (HP Co) by engaging in bribery and corruption for which their US corporate parent, who did not engage in the corrupt action, were forced to pay the fines and penalties (and attendant investigative costs, remediation costs and negative publicity). For the purposes of this discussion we will leave out the millions of dollars that HP potentially benefited from via the illegal actions of its alleged ‘rogue employees’; or if there has ever been a case involving ‘rogue employees’ who, intentionally or otherwise, took a company down into FCPA grief.

I. HP-Poland – the Tale of Little Jack Horner – what a good boy I am

Little Jack Horner

Sat in the corner,

Eating a Christmas pie;

He put in his thumb,

And pulled out a plum,

And said ‘What a good boy am I!’

This is the one where commentators are having a Eureka moment. After all, the settlement documents point to one man, HP’s Poland Country Manager, and his John Le Carré-esque meetings. In this bribery scheme, the Country Manager engaged in a multi-year bribery scheme to pay bribes to one Polish government official to secure a large number of contracts. These bribes were paid surreptitiously, using a variety of techniques to evade detection but they all had one thing in common which I will ask you to figure out from the Bribery Box presented below.

HP-Poland Bribery Box Score

Bribe Amount

Method of Payment

Year Paid

Business Received


Bag of cash, delivered to home of Polish gov official


Contract valued at $15.7MM


Bag of cash, delivered in parking lot to Polish gov official



$130,000 to $140,000

Bag of cash delivered to Polish gov official


Contract executed January 2008


Bag of cash


Contract executed in April 2008


Bag of cash delivered to Polish gov official


Contract executed May 2008


Bag of cash delivered to Polish gov official


Final 3 contracts totaled $32MM in value




For contract signed in 2010 valued at $4MM


Delivered as gifts


Total contracts valued at $60MM

For those of you not so quick on the draw the common element, at least until the end of the Box Score, is that all the bribes were paid in cash. For part of my in-house legal career, I did legal work for the energy industry and I have some familiarity in the amount of money that Country Manager’s made, at least the range of their salary and bonus, and it certainly was not enough to fund bribes in the amount of $600,000 in cash over a couple of years.

So let me get this straight, no one else at HP-Poland aided the Country Manager while he helped himself to the kitty? Didn’t anyone even notice, say in 2007, one of our $250,000 was missing? If not, the Country Manager had to have help in siphoning off funds from HP itself to fund these bribes? So my first question is where was HP internal audit? At the country level? At the region level? At the corporate level? Where was HP Co, when HP-Poland landed $60MM in contracts, in determining how these contracts were procured? Where were HP internal controls?

Was the Country Manager like Little Jack Horner? What a good boy I am?

II.   HP-Russia – Yes Sir, Yes Sir, Three Bags Full

Baa, baa, black sheep,

Have you any wool?

Yes, sir, yes, sir,

Three bags full.

HP-Russia seems to confuse commentators the most about the myth of the ‘rogue employee’. Here they point to the coded spreadsheets (the “Encrypted Spreadsheet”), which could only be unlocked and read by the conspirators themselves. And after all, they lied, lied, when they were asked about some of the details of the transaction in questions. I am sure Inspector Renoir is still shocked, shocked, to discover that gambling is still occurring on the premises of Rick’s Café American in Casablanca.

So why three bags full? Well, first of all, if you are from a certain university in central Texas you’ll immediately know what it means. For the less delicate among you, it would mean a large load of Col. Sherman Potter’s horse-hockey; three bags full in fact. This deal had been floating around HP for years, was well-known enough to raise multiple Red Flags inside the company and was simply internally shopped until it slid through by hook, nook or crook; or in this case, three bags full.

The initial deal was inked with the Russian government in June 2001 but as the Russian government could not fund it, they sought another foreign government to fund and that government was the US. However, to do so, it required that at least 85% of all goods and services were of US origin. To meet this requirement, the initial deal was changed to substitute a US intermediary (Intermediary 2) who replaced the Swiss intermediary on the deal (Intermediary 1). HP Co conducted due diligence on Intermediary 2 and then met with Intermediary 2 in the US to conduct additional due diligence. However, Intermediary 2 balked at answering more “pointed questions” about its expertise and financial wherewithal to handle the transaction. HP Co then told HP-Russia that they would not approve the transaction.

Not to be deterred from a good deal, the foreign government financing was switched from the US to Germany. In addition, Intermediary 2 was ditched for a one-man shop, Burwell Consulting Ltd (Burwell). Burwell and others were eventually paid nearly $21MM in bribes for the Russia government contract. There has been much discussion about how HP-Russia tricked HP-Germany’s employees through the use of “encrypted, password protected spreadsheets that tracked the deal’s financial inflows and outflows”. However, what I found more interesting was the discussion about how not only had HP-Russia shopped the deal internally and been told a resounding NO by HP Co for obvious Red Flags present but also the discussion of how HP-Russia internally funded the bribery scheme.

They did so by the classic ‘stuffing the channel’ that every software lawyer, accountant, bookkeeper, auditor, sales rep and anyone else subject to GAAP or IFSR learns on their first day of training on their first job. It goes like this: HP-Russia sold products to a channel partner; who then sold them to Intermediary 3; who then sold them back to HP with a mark-up and voila, you have a big pile of cash with which to bribe.

So what does the HP-Russia deal tell us about HP as a company? As with HP-Poland, you would have to question where was internal controls while this was playing out, at the country level, at the region level, at the anywhere level? But there is far more than simply internal controls going on here. Based on what was publicly announced in the settlement documents, HP Co had actual knowledge that the deal was rife with Red Flags as it was presented. It was so bad they shut it down. Of course, the business guys simply resurrected it in another place, in another guise. What does that say about the overall effectiveness of the compliance function at the time if HP-Russia could bring a Red Flagged deal to HP Co only to have it stopped, then to shove it through HP-Germany due to weak controls? What about the internal controls on how HP-Russia was able to generate $21MM in scammed money to pay the bribes in the first place? Think anyone else might have thought about running that scam through those robust internal controls? After all, its only three bags full…

III.   HP-Mexico – Fool Me Once…

Fool Me Once,

Shame on You;

Fool me twice,

Shame on Me.

The above did not come from George Bush (The Younger) but is purported to be an old Chinese proverb. I like that thought anyway and it certainly informs our look the claim of ‘rogue employee’ in Mexico. Here, for reasons far beyond my comprehension, HP was able to secure a Non-Prosecution Agreement (NPA) from the Department of Justice (DOJ) for the actions of its subsidiary in Mexico in paying a bribe of $1.6MM to facilitate the winning of a contract worth $6MM. But the lesson learned from the ancient Chinese proverb certainly informs our look at the allegation of the ‘rogue employee’ down Mexico way.

HP-Mexico wanted to use a certain agent involving a deal with Pemex because he had a very close relationship with the Pemex official who would be making the decision on the contract. HP-Mexico even signed a contract with this agent where his description of services was an “influencer fee” for which he would receive a 25% commission. This agent could apparently neither meet HP Co’s due diligence requirements, accept HP Co’s mandatory commission rate or both but whatever the reason, they were not approved as an agent on the Pemex deal. But like all good HP business folks (beginning to see a pattern here?) HP-Mexico simply subcontracted this agent to an existing, approved HP channel partner. HP-Mexico then amazingly (or perhaps not) said that they needed to raise the commission rate of this channel partner from 1.5% to 26.5% because this channel partner was now “managing discounts with Pemex” which coincidentally, this channel partner had never done. Because this channel partner was previously approved by compliance, the request for increase in commission rate was never submitted to compliance for approval. Think an internal control or two might have been appropriate in this situation?

What do the nursery rhymes and Chinese proverb tell us about HP and the Myth of the Rogue Employee? All three of the bribery schemes involved showed that there were multiple failures of numerous systems that allowed the schemes to run rampant. But perhaps the thing that they speak to the most is the culture that existed at the company during the time frames in question. While the FCPA Professor and others have noted that some of the conduct in question began in Russia as long ago as 1999, the settlement documents speak to conduct in Poland as recently as 2010. Certainly, the NPA for HP-Mexico’s conduct was for actions in 2009. What was the tone set that not only allowed employees to think that they could get away with subverting the law but that they had to do so. That, perhaps, is the most troubling questions unanswered by the Myth of the Rogue Employee.

Whatever the answer to HP’s culture of compliance may have been at the time of the conduct which led to the enforcement action, the claim that the company does not bear responsibility for either setting that tone, facilitating the conduct by looking the other way when convenient or not having appropriate internal prevention and detection controls in place to prevent massive fraud by its own employees; the reality is that when a employees of a company can evade controls to generate multi-millions of dollars to generate pools of money to pay bribes, there is no ‘rogue employee’ or even small group of rogue employees. Or there is about as much chance as a cow jumping over the moon.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Thomas Fox, Compliance Evangelist | Attorney Advertising

Written by:

Thomas Fox

Compliance Evangelist on:

Readers' Choice 2017
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
Sign up using*

Already signed up? Log in here

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
Privacy Policy (Updated: October 8, 2015):

JD Supra provides users with access to its legal industry publishing services (the "Service") through its website (the "Website") as well as through other sources. Our policies with regard to data collection and use of personal information of users of the Service, regardless of the manner in which users access the Service, and visitors to the Website are set forth in this statement ("Policy"). By using the Service, you signify your acceptance of this Policy.

Information Collection and Use by JD Supra

JD Supra collects users' names, companies, titles, e-mail address and industry. JD Supra also tracks the pages that users visit, logs IP addresses and aggregates non-personally identifiable user data and browser type. This data is gathered using cookies and other technologies.

The information and data collected is used to authenticate users and to send notifications relating to the Service, including email alerts to which users have subscribed; to manage the Service and Website, to improve the Service and to customize the user's experience. This information is also provided to the authors of the content to give them insight into their readership and help them to improve their content, so that it is most useful for our users.

JD Supra does not sell, rent or otherwise provide your details to third parties, other than to the authors of the content on JD Supra.

If you prefer not to enable cookies, you may change your browser settings to disable cookies; however, please note that rejecting cookies while visiting the Website may result in certain parts of the Website not operating correctly or as efficiently as if cookies were allowed.

Email Choice/Opt-out

Users who opt in to receive emails may choose to no longer receive e-mail updates and newsletters by selecting the "opt-out of future email" option in the email they receive from JD Supra or in their JD Supra account management screen.


JD Supra takes reasonable precautions to insure that user information is kept private. We restrict access to user information to those individuals who reasonably need access to perform their job functions, such as our third party email service, customer service personnel and technical staff. However, please note that no method of transmitting or storing data is completely secure and we cannot guarantee the security of user information. Unauthorized entry or use, hardware or software failure, and other factors may compromise the security of user information at any time.

If you have reason to believe that your interaction with us is no longer secure, you must immediately notify us of the problem by contacting us at In the unlikely event that we believe that the security of your user information in our possession or control may have been compromised, we may seek to notify you of that development and, if so, will endeavor to do so as promptly as practicable under the circumstances.

Sharing and Disclosure of Information JD Supra Collects

Except as otherwise described in this privacy statement, JD Supra will not disclose personal information to any third party unless we believe that disclosure is necessary to: (1) comply with applicable laws; (2) respond to governmental inquiries or requests; (3) comply with valid legal process; (4) protect the rights, privacy, safety or property of JD Supra, users of the Service, Website visitors or the public; (5) permit us to pursue available remedies or limit the damages that we may sustain; and (6) enforce our Terms & Conditions of Use.

In the event there is a change in the corporate structure of JD Supra such as, but not limited to, merger, consolidation, sale, liquidation or transfer of substantial assets, JD Supra may, in its sole discretion, transfer, sell or assign information collected on and through the Service to one or more affiliated or unaffiliated third parties.

Links to Other Websites

This Website and the Service may contain links to other websites. The operator of such other websites may collect information about you, including through cookies or other technologies. If you are using the Service through the Website and link to another site, you will leave the Website and this Policy will not apply to your use of and activity on those other sites. We encourage you to read the legal notices posted on those sites, including their privacy policies. We shall have no responsibility or liability for your visitation to, and the data collection and use practices of, such other sites. This Policy applies solely to the information collected in connection with your use of this Website and does not apply to any practices conducted offline or in connection with any other websites.

Changes in Our Privacy Policy

We reserve the right to change this Policy at any time. Please refer to the date at the top of this page to determine when this Policy was last revised. Any changes to our privacy policy will become effective upon posting of the revised policy on the Website. By continuing to use the Service or Website following such changes, you will be deemed to have agreed to such changes. If you do not agree with the terms of this Policy, as it may be amended from time to time, in whole or part, please do not continue using the Service or the Website.

Contacting JD Supra

If you have any questions about this privacy statement, the practices of this site, your dealings with this Web site, or if you would like to change any of the information you have provided to us, please contact us at:

- hide
*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.