How does a risk assessment provide a structured approach to establishing effective internal controls. After preparation of the risk assessment, the next step is to prioritize the listing of the risks and which locations they are common. This begins by mapping existing internal controls to risks and then assessing whether the internal controls are sufficient to mitigate the risks.
To help with consistency in this evaluation process, it may be useful to assign a risk weight to each of the elements in the risk assessment. For example, a construction company might assign a higher weight to the presence of movable fixed assets while a company which sells exclusively through local distributors, might assign a higher weight to the sales function than one that exclusively uses company employees for sales activities. However, it is structured, the assessment should result in the assignment of individual risk scores and a composite risk score for each location. These scores can then be used to prioritize the locations in terms of dealing with control risks.
One of the biggest risks under the FCPA is where sales are conducted through third parties. If your company is moving to new geographic markets or new products and does not plan to use an internal sales team to facilitate these new efforts it presents a high compliance risk. The 2019 SEC FCPA enforcement action against Quad Graphics was just such a situation, where a newly emerging international sales operation, acquired through an acquisition, was executed through third party agents.
The compliance function should understand the corporate or business unit controls over the international business in addition to the necessary controls over agents. Some of the questions you might consider are the following: Is there a U.S. based international sales manager who is responsible for growing the business? What is the incentive compensation plan? How good are the SODs? In other words, can the international sales manager unilaterally make high-risk decisions, or must a senior officer of the business unit or the corporate home office be part of the approval process? Finally, and in a point not to be forgotten or dismissed, how are these internal controls documented?
What about a situation in opposite to the above scenario, where your company’s primary sales channel uses a U.S. based sales force which only travels to locations outside the U.S. for temporary visits of generally short duration? This situation minimizes, retains and shifts some compliance risks. The minimized compliance risks come from the lessening on the reliance of third parties so that a company, at least in theory, would have more control over its own work force than those employed outside the company.
The retained risks are the risks associated with gifts, travel and entertainment; approval of credit terms to customers; product pricing; special arrangements with customers such as providing product samples; knowing who the ultimate customer is and where the goods are ultimately shipped; and use of freight forwarders and customs agents. Shifted risks are created if there is no physical location outside the U.S. because the accounting must be done in the U.S. This means that compliance risks regarding the accounting function simply shift to the U.S. accounting department where transactions are processed and recorded and where the financial statements are prepared.
These identified risks need to be subject to appropriate internal controls because it is well established that the issuance of a Code of Conduct and/or compliance policy and training of said policy’s requirements is a good practice, but it does not provide reasonable assurance that employees will comply with the policies. What is needed are written procedures and work instructions, in the native language of the respective employees, that defines exactly what the procedures to be performed are and how they will be evidenced. As difficult as it is for U.S. employees to translate, by themselves, what it means to comply with policies, it may be significantly more difficult for employees outside the U.S., not only due to language but also due to traditional local business practices, cultures and customs.
You can also utilize the COSO 2013 Internal Controls Framework, which created a more formal structure to design or assess the effectiveness of internal control within the five COSO components. A companion document, “Internal Control over External Financial Reporting: A Compendium of Approaches and Examples”, catalogued possible approaches and examples in the context of internal controls over financial reporting, and could be useful for companies complying with compliance internal controls under the FCPA. COSO has also published an additional companion document, “Illustrative Tools for Assessing Effectiveness of a System of Internal Control”, which provides templates that may be used to support an assessment of internal controls and includes various scenarios which illustrate several practical examples of how the templates may be used.
Finally, consider a business unit in a geographic area such as the Far East where there is a significant amount of deference to supervisors in the local culture; such that even if an employee saw inappropriate behavior it would not be expected that the employee would make any report or comment. Such situations can have huge impact on your internal controls environment.
[View source.]
