The Halliburton FCPA Enforcement Action - Lessons for Chief Compliance Officers on Internal Controls Failures

by Thomas Fox
Contact

Thomas Fox - Compliance Evangelist

In late July, there was an announcement by the Securities and Exchange Commission (SEC) of the resolution of its outstanding Foreign Corrupt Practices Act (FCPA) enforcement action with Halliburton. [Full disclosure - I am a Halliburton shareholder] In a Cease and Desist Order which also covered former employee Jeannot Lorenz, the SEC spelled out a bribery scheme facilitated by both a failure and over-ride of company internal controls. The matter involved Halliburton’s work in Angola with the national oil company Sonangol, which had a local content requirement. The nefarious acts giving rise to the FCPA violation involved a third-party agent for Halliburton’s contracts with the state-owned enterprise. 

Background

According the SEC Press Release, “officials at Angola’s state oil company Sonangol advised Halliburton management in 2008 that it was required to partner with more local Angolan-owned businesses to satisfy local content regulations for foreign firms operating in Angola. Halliburton tasked Lorenz to spearhead these efforts. When a new round of oil company projects came up for bid, Lorenz began a lengthy effort to retain a local Angolan company owned by a former Halliburton employee who was a friend and neighbor of the Sonangol official who would ultimately approve the award of the contracts. It took three attempts but Halliburton ultimately outsourced more than $13 million worth of business to the local Angolan company.”

Facts

There was an initial attempt to bring a local Angolan company in as a commercial agent for Halliburton but, as the Order noted, the idea was abandoned because of the lengthy internal process for approving agents at the company. The agent was then moved to a supplier so the approval process would be easier. The local Angolan company was to provide “real estate maintenance, travel and ground transportation services” but would be approved through the supplier process, which required the internal controls of business justification and competitive bidding, both which were over-ridded and a Consulting Contract was entered into with the local Angolan company. However, the true purpose of the Consulting Contract, “to provide bridge payments as a show of good faith to the Sonangol government official and the local Angolan company until the latter successfully emerged from the bidding process”, was never provided to the contract approvers. Instead a fictional purpose was articulated, as stated in the Order, “the scope of work falsely stated that the local Angolan company would be “developing reports with respect to findings and recommendations” addressing local content requirements and how Halliburton could meet those requirements with respect to areas of travel, local logistics, and real estate.” As the Order noted, this violated Halliburton’s internal controls which mandate “an assessment of the critically or risk of a material or services”; not with a particular supplier and certainly not without “competitive bids or providing an adequate single source justification.” There were also delegation of authority controls which were over-ridden. 

Yet this Consulting Contract was not deemed sufficient local content by Sonangol officials. In an attempt to salvage the relationship, there was the involvement of an un-named senior executive of Halliburton who “flew to Portugal to meet the Sonangol government official at the vacation home of the Sonangol government official’s friend, the owner of the local Angolan company. Both Lorenz and the friend were present. The Halliburton senior executive explained to the Sonangol government official the delays associated with a large company’s procurement processes and affirmed that Halliburton was negotiating a deal with the local Angolan company to satisfy local content requirements. The Halliburton senior executive also asked the Sonangol government official for his support for the international oil company’s award of an upcoming contract to Halliburton, in light of progress Halliburton was making to satisfy Halliburton’s local content requirements.”

After all of this and further negotiations, Halliburton entered into a near agreement where the “local Angolan company would lease commercial and residential real estate and then sublease the properties to Halliburton at a substantial markup, and also provide real estate transaction management consulting services.” (the ‘Real Estate Transaction Management Agreement’). This proposed agreement was questioned internally by Halliburton for its use of a single source for procurement, the upfront payment terms, the high costs, and the rationale for entering into subleases for properties that would cost less if leased directly from the landlord.” Indeed, “One Finance & Accounting reviewer at headquarters noted that he could not think of any legitimate reason to pay the local Angolan company over $13 million under the Real Estate Transaction Management Agreement and that it would not have cost that much to run Halliburton’s entire real estate department in Angola.” Senior executives allowed the Real Estate Transaction Management Agreement to move forward to execution in May 2010. 

After receipt of an anonymous email alleging “possible misconduct surrounding the transactions with the local Angolan company” Halliburton terminated the Real Estate Transaction Management Agreement in April 2011 after paying out some $3.705MM. As noted in the Order, “Between May and December 2010, Sonangol approved the award of seven lucrative subcontracts to Halliburton and Halliburton profited by approximately $14 million.”

Penalties

Halliburton agreed to pay some $29.2MM, consisting of  $14,000,000 for profit disgorgement, along with prejudgment interest of $1.2 million and a civil penalty of $14,000,000. The company also agreed to an 18 month Monitorship (termed ‘Independent Consultant’ in the Order) where the role “responsibility is to review and evaluate Respondent’s anti-corruption policies and procedures, including policies and procedures related to retaining local content and the use of single source justifications, for Respondent’s business operations in Africa” and to make recommendations on them. Additionally, “The Independent Consultant shall consider whether the ethics and compliance function has sufficient resources, authority, and independence, and provides sufficient training and guidance to the business operations in Africa”. The individual involved, Lorenz, agreed to a civil penalty of $75,000.

This FCPA enforcement action emphasizes that company’s must do more than have internal compliance controls, they must also be effective. The Order is replete with examples where the company allowed the internal controls to be disregarded or over-ridden. Even the company’s internal audit reports were not followed up on, when they noted deficiencies in the contracting process. As bribery and corruption schemes become more sophisticated, we will likely see more enforcement actions like this Halliburton FCPA enforcement action. Chief Compliance Officers (CCOs) and compliance professionals need to take note that in high risk jurisdictions internal controls must be enforced and followed to be effective. Additional auditing, monitoring and testing should be routinely performed to ensure that policies and procedures are not only in place, but being followed. 

Failures of Internal Controls

There are multiple issues in this enforcement action around internal controls, their effectiveness (or lack thereof) and management over-ride of internal controls for the compliance practitioner.

In a Cease and Desist Order which also covered former employee Jeannot Lorenz, the SEC spelled out a bribery scheme facilitated by both a failure and over-ride of company internal controls. The matter involved Halliburton’s work in Angola with the national oil company Sonangol, which had a local content requirement. The nefarious acts giving rise to the FCPA violation involved a third-party agent for Halliburton’s contracts with the state-owned enterprise.

According the SEC Press Release, this matter initially began in 2008 when officials at Sonangol, Angola’s state oil company, informed Halliburton management it had to partner with more local Angolan-owned businesses to satisfy local content regulations. The company was successful in meeting the requirement for the 2008 contracting period.

However, when a new round of oil company projects came up for bid in 2009, Sonangol indicated, “Halliburton needed to partner with more local Angolan-owned businesses in order to satisfy content requirements.” The prior work Halliburton had on local content was deemed insufficient and “Sonangol remained extremely dissatisfied” with the company’s efforts. Sonangol backed up this dissatisfaction with a potential threat to veto further work by Halliburton for Sonangol. It was under this backdrop that the local business team moved forward with a lengthy effort to retain a local Angolan company (Angolan agent) owned by a former Halliburton employee who was a friend and neighbor of the Sonangol official who would ultimately approve the award of the business to Halliburton.

In each of these attempts, the company bumped up against its own internal controls around third parties, both on the sales side and through the supply chain. The first attempt to hire the Angolan agent was as a third-party sales agent, which under Halliburton parlance is called a “commercial agent”. In this initial attempt, the internal control held as the business folks abandoned their efforts to contract with the Angolan agent.

The first attempt to hire the Angolan agent was rejected because the local Business Development (BD) team wanted to pay a percentage fee based, in part, upon work previously secured under the 2008 contract and not new work going forward. Additional fees would be paid on new business secured under the 2009 contract. This payment scheme for the Angolan agent was rejected as the company generally paid commercial agents for work they helped obtain and not work secured in the past. Further, the company was not seeking to increase its commercial agents during this time frame (Halliburton had entered into a Deferred Prosecution Agreement (DPA) for FCPA violations in December 2008 for the actions of its subsidiary KBR in Nigeria).

Finally, “As outlined by Halliburton’s legal department, to retain the local Angolan company as a commercial agent, it would be required to undergo a lengthy due diligence and review process that included retaining outside U.S. legal counsel experienced in FCPA compliance to conduct interviews. Halliburton’s in-house counsel noted that “[t]his is undoubtedly a tortuous, painful administrative process, but given our company’s recent US Department of Justice/SEC settlement, the board of directors has mandated this high level of review.”” In other words, the internal controls held and were not circumvented or over-ridden.

The Angolan agent was then moved from commercial agent status to that of a supplier so the approval process would be easier. The proposed reason for this switch in designations was that the Angolan agent would provide “real estate maintenance, travel and ground transportation services” to the company in Angola. However, the internal controls process around using a supplier also had rigor as they required a competitive bidding process which would take several months to complete. Over-riding this internal control, the local business team was able to contract with the Angolan agent for these services in September 2009 and increase the contract price, all without the Angolan agent going through the procurement internal controls.

A second internal control which was over-ridden was the procurement requirement that the supplier procurement process begin with “an assessment of the critically or risk of a material or services”; not with a particular supplier and certainly not without “competitive bids or providing an adequate single source justification.” However, as the Order noted, the process was taken backwards, with the Angolan agent selected and then “backed into a list of services it could provide.” Finally, there was a separate internal control that required “contracts over $10,000 in countries with a high risk of corruption, such as Angola, to be reviewed and approved by a Tender Review Committee.” Inexplicably this internal control was also circumvented or over-ridden.

Yet this arrangement was not deemed sufficient local content by Sonangol officials. After all of this and further negotiations, Halliburton entered into another agreement with the Angolan agent, where the company would lease commercial and residential real estate and then sublease the properties back to Halliburton at a substantial markup, and also provide real estate transaction management consulting services (the “Real Estate” contract).

This Real Estate contract also had to go through an internal control process. Initially, there were questions by the company about the Real Estate contract as a single source for the procurement function, the upfront payment terms to the Angolan agent, the high costs, and the rationale for entering into subleases for properties that would cost less if leased directly from the landlord. Indeed, “One Finance & Accounting reviewer at headquarters noted that he could not think of any legitimate reason to pay the local Angolan company over $13 million under the Real Estate Transaction Management Agreement and that it would not have cost that much to run Halliburton’s entire real estate department in Angola.”

Halliburton internal controls required that when a single source was used by the company it had to be justified. This justification would require a showing of preference for quality, technical, execution or other reasons, none of which were demonstrated by the Angolan agent. Finally, if such a single source was used, the reasons had to be documented or in Halliburton’s internal controls language “identified and justified”. None were documented by the company.

Finally, as the internal controls were either circumvented or over-ridden; “As a consequence, internal audit was kept in the dark about the transactions and its late 2010 yearly review did not examine them.” This was yet another internal control failure but was built on the previous failures noted above.

So how many internal controls failures can you spot? Whatever the number, the lesson for the compliance practitioner is that you must do more than have internal controls. They must be followed and be effective. If you are doing business in high risk regions, you have to test the controls and then back up your testing by seeing if payments are being made in those regions. Perhaps the best concept would simply be Reaganian, trust but verify.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Thomas Fox, Compliance Evangelist | Attorney Advertising

Written by:

Thomas Fox
Contact
more
less

Compliance Evangelist on:

Readers' Choice 2017
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
Sign up using*

Already signed up? Log in here

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
Privacy Policy (Updated: October 8, 2015):
hide

JD Supra provides users with access to its legal industry publishing services (the "Service") through its website (the "Website") as well as through other sources. Our policies with regard to data collection and use of personal information of users of the Service, regardless of the manner in which users access the Service, and visitors to the Website are set forth in this statement ("Policy"). By using the Service, you signify your acceptance of this Policy.

Information Collection and Use by JD Supra

JD Supra collects users' names, companies, titles, e-mail address and industry. JD Supra also tracks the pages that users visit, logs IP addresses and aggregates non-personally identifiable user data and browser type. This data is gathered using cookies and other technologies.

The information and data collected is used to authenticate users and to send notifications relating to the Service, including email alerts to which users have subscribed; to manage the Service and Website, to improve the Service and to customize the user's experience. This information is also provided to the authors of the content to give them insight into their readership and help them to improve their content, so that it is most useful for our users.

JD Supra does not sell, rent or otherwise provide your details to third parties, other than to the authors of the content on JD Supra.

If you prefer not to enable cookies, you may change your browser settings to disable cookies; however, please note that rejecting cookies while visiting the Website may result in certain parts of the Website not operating correctly or as efficiently as if cookies were allowed.

Email Choice/Opt-out

Users who opt in to receive emails may choose to no longer receive e-mail updates and newsletters by selecting the "opt-out of future email" option in the email they receive from JD Supra or in their JD Supra account management screen.

Security

JD Supra takes reasonable precautions to insure that user information is kept private. We restrict access to user information to those individuals who reasonably need access to perform their job functions, such as our third party email service, customer service personnel and technical staff. However, please note that no method of transmitting or storing data is completely secure and we cannot guarantee the security of user information. Unauthorized entry or use, hardware or software failure, and other factors may compromise the security of user information at any time.

If you have reason to believe that your interaction with us is no longer secure, you must immediately notify us of the problem by contacting us at info@jdsupra.com. In the unlikely event that we believe that the security of your user information in our possession or control may have been compromised, we may seek to notify you of that development and, if so, will endeavor to do so as promptly as practicable under the circumstances.

Sharing and Disclosure of Information JD Supra Collects

Except as otherwise described in this privacy statement, JD Supra will not disclose personal information to any third party unless we believe that disclosure is necessary to: (1) comply with applicable laws; (2) respond to governmental inquiries or requests; (3) comply with valid legal process; (4) protect the rights, privacy, safety or property of JD Supra, users of the Service, Website visitors or the public; (5) permit us to pursue available remedies or limit the damages that we may sustain; and (6) enforce our Terms & Conditions of Use.

In the event there is a change in the corporate structure of JD Supra such as, but not limited to, merger, consolidation, sale, liquidation or transfer of substantial assets, JD Supra may, in its sole discretion, transfer, sell or assign information collected on and through the Service to one or more affiliated or unaffiliated third parties.

Links to Other Websites

This Website and the Service may contain links to other websites. The operator of such other websites may collect information about you, including through cookies or other technologies. If you are using the Service through the Website and link to another site, you will leave the Website and this Policy will not apply to your use of and activity on those other sites. We encourage you to read the legal notices posted on those sites, including their privacy policies. We shall have no responsibility or liability for your visitation to, and the data collection and use practices of, such other sites. This Policy applies solely to the information collected in connection with your use of this Website and does not apply to any practices conducted offline or in connection with any other websites.

Changes in Our Privacy Policy

We reserve the right to change this Policy at any time. Please refer to the date at the top of this page to determine when this Policy was last revised. Any changes to our privacy policy will become effective upon posting of the revised policy on the Website. By continuing to use the Service or Website following such changes, you will be deemed to have agreed to such changes. If you do not agree with the terms of this Policy, as it may be amended from time to time, in whole or part, please do not continue using the Service or the Website.

Contacting JD Supra

If you have any questions about this privacy statement, the practices of this site, your dealings with this Web site, or if you would like to change any of the information you have provided to us, please contact us at: info@jdsupra.com.

- hide
*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.