10/3/2013
MAPPING YOUR PROGRAM TO
THE FEDERAL SENTENCING
GUIDELINES FOR
ORGANIZATIONS (FSGO)
S h e ll ey A u l,
C C EP
Ve r non
S p e shock,
C C EP
A p o llo
G r o up, I n c .
AGENDA
Overview of the FSGO
Participant Activity
Resources/Templates
Closing
HOW MUCH DO YOU KNOW ABOUT
THE FSGO?
1
10/3/2013
FEDERAL SENTENCING GUIDELINES
FOR ORGANIZATIONS
FSGO
Enacted by the U.S. Sentencing Commission in November 1991
Designed to help federal judges impose fair/consistent
sentences when corps violate U.S. law. Previously was largely
discretionary.
No affirmative duty to create compliance programs
Encourage the establishment of compliance/ ethics programs
to help ‘prevent and detect organizational wrongdoing’
A metaphorical “carrot” to induce good corporate behavior
Not limited to “sentencing” but rather to evaluating compliance
efforts to determine whether or not to charge/prosecute, incl.
the nature and size of fines or other remedies
Have achieved significant success in reducing misconduct;
Nurturing a vast compliance and ethics movement; Enlisting a
self-policing effort
ELEMENTS OF THE FEDERAL SENTENCING
GUIDELINES FOR ORGANIZATIONS
FSGO
Develop/implement standards and procedures
Designate ‘high-level’ individuals for oversight of the program;
provide resources and responsibility
Provide due diligence by excluding anyone in positions of
substantial authority who engaged in illegal behavior
Communicate the program standards; training and awareness
Monitor and audit the program, incl. a reporting system to
detect and report misconduct
Enforce and promote the program with consistent disciplinary
measures and incentives for proper performance
Respond to violations by making modifications to the program
as necessary to prevent similar violations in the future
Periodically assess the risk of misconduct and take
appropriate steps to reduce this risk
FEDERAL SENTENCING GUIDELINES
FOR ORGANIZATIONS
FSGO
Guideline Elements
Requirement
Due Diligence and
Ethical Culture
Exercise due diligence to prevent and detect criminal conduct and promote an
organizational culture that encourages ethical conduct and a commitment to
compliance with the law.
Standards and
Procedures
The organization shall establish standards and procedures to prevent and detect
criminal conduct.
Governing Oversight
The organization's governing authority shall be knowledgeable about the content
and operation of the compliance and ethics program and shall exercise reasonable
oversight with respect to the implementation and effectiveness of the compliance
and ethics program.
Someone In Charge
High-level personnel of the organization shall ensure that the organization has an
effective compliance and ethics program, as described in this guideline. Specific
individual(s) within high-level personnel shall be assigned overall responsibility for
the compliance and ethics program.
Day-to-Day
Responsibility
Specific individual(s) within the organization shall be delegated day-to-day
operational responsibility for the compliance and ethics program.
2
10/3/2013
FEDERAL SENTENCING GUIDELINES
FOR ORGANIZATIONS
FSGO
Guideline Elements
Guideline Controls
Due DiligenceAuthority
The organization shall use reasonable efforts not to include within the substantial
authority personnel of the organization any individual whom the organization knew, or
should have known through the exercise of due diligence, has engaged in illegal
activities or other conduct inconsistent with an effective compliance and ethics
program. Investigate all issues/concerns and apply appropriate and consistent
discipline.
Education and
Awareness
The organization shall take reasonable steps to communicate periodically and in a
practical manner its standards and procedures, and other aspects of the compliance
and ethics program.
Monitoring and
Auditing
The organization shall take reasonable steps—(A)to ensure that the organization's
compliance and ethics program is followed, including monitoring and auditing to
detect criminal conduct.
Measuring
Effectiveness
Evaluate periodically the effectiveness of the organization's compliance and ethics
program.
Anonymous
Reporting
Have and publicize a system, which may include mechanisms that allow for
anonymity or confidentiality, whereby the organization's employees and agents may
report or seek guidance regarding potential or actual criminal conduct without fear of
retaliation.
FEDERAL SENTENCING GUIDELINES
FOR ORGANIZATIONS
FSGO
Guideline Elements
Guideline Controls
Incentives
The organization's compliance and ethics program shall be promoted and enforced
consistently throughout the organization through (A) appropriate incentives to
perform in accordance with the compliance and ethics program.
Discipline
The organization's compliance and ethics program shall be promoted and enforced
consistently throughout the organization through (B) appropriate disciplinary
measures for engaging in criminal conduct and for failing to take reasonable steps
to prevent or detect criminal conduct.
Modify the Program
After criminal conduct has been detected, the organization shall take reasonable
steps to respond appropriately to the criminal conduct and to prevent further similar
criminal conduct, including making any necessary modifications to the
organization's compliance and ethics program.
Assess Risk
The organization shall periodically assess the risk of criminal conduct and shall take
appropriate steps to design, implement, or modify each requirement set forth in
subsection (b) to reduce the risk of criminal conduct identified through this process.
GENERAL BENEFITS OF AN
EFFECTIVE COMPLIANCE PROGRAM
Demonstrates strong commitment to stakeholders , including
employees and the public, of the company’s commitment to
ethical conduct and behavior
Identifies unethical and criminal behavior so problems are
addressed and adverse consequences are minimized
Serves as a mitigating factor in possible indictments if
criminal behavior occurs
May diminish exposure of the company if sentenced for
criminal behavior
The Ethics Resource Center’s 2011 National Business Ethics
Survey (NBES) shows that employees in companies with
effective meaningful codes of conduct and programs based on
the FSGO witness fewer incidents of misconduct and are far
more likely to report misconduct when observed
3
10/3/2013
THE POSITIVE BOTTOM LINE
“Simply put, workplaces with programs based on the FSGO are
better places to work. Our economy and our society are better
off when corporations and their employees obey the law and
operate within ethical frameworks that direct them to “do the
right thing.” The FSGO contribute mightily to this objective by
establishing standards to guide company management in the
development and implementation of effective compliance and
ethics programs and ethical cultures.”
The Federal Sentencing Guidelines for Organizations at Twenty Years, A Call to Action for More Effective Promotion and Recognition of
Effective Compliance and Ethics Programs, Report of the Ethics Resource Center’s Independent Advisory Group on the 20th Anniversary of
FSGO, Ethics Resource Center, 2012
EXAMPLE OF BENEFIT TO HAVING A
FSGO COMPLIANCE PROGRAM
SEC Announces Non-Prosecution A greement with Ralph Lauren
Corporation Involving FCPA Misconduct (April 22, 2013)
SEC announced a non-prosecution agreement (NPA) with Ralph
Lauren Corporation in which the company will disgorge more
than $700,000 in illicit profits and interest obtained in
connection with bribes paid by a subsidiary to government
officials in Argentina from 2005 to 2009.
The misconduct was uncovered in an internal review
undertaken by the company and promptly reported to the SEC.
Took into account the significant remedial measures
undertaken by Ralph Lauren Corporation, including a
co mprehensive new co mpliance pr o gram thr oughout i ts
o pe rations . Among Ralph Lauren Corporation’s remedial
measures have been new compliance training, termination of
employment and business arrangements with all individuals
involved in the wrongdoing, and strengthening its internal
controls and its procedures for third party due diligence.
PARTICIPANT ACTIVITY
4
10/3/2013
DUE DILIGENCE
What You Need
Exercise due diligence to prevent and detect criminal conduct
What You Do
Background checks
Reference checks
Detailed/accurate job descriptions
Schedule of Executive Authority
ETHICAL CULTURE
What You Need
Otherwise promote an organizational culture that encourages
ethical conduct and a commitment to compliance with the law.
What You Do
Code of Business Ethics
Helpline education and awareness
Ethics education and awareness
Internal compliance conference
Ethics & Compliance Week
Ethics and Compliance Liaison Program
Tone from the top
STANDARDS AND PROCEDURES
What You Need
The organization shall establish standards and procedures to
prevent and detect criminal conduct.
What You Do
Code of Business Ethics
Corporate policies & procedures
5
10/3/2013
GOVERNING OVERSIGHT
What You Need
The organization's governing authority shall be knowledgeable
about the content and operation of the compliance and ethics
program and shall exercise reasonable oversight with respect to the
implementation and effectiveness of the compliance and ethics
program.
What You Do
Documented Board oversight/responsibility
Regular CECO reports to the Board & executive management
Board approved Code
Board training
SOMEONE IN CHARGE
What You Need
High-level personnel of the organization shall ensure that the
organization has an effective compliance and ethics program, as
described in this guideline. Specific individual(s) within high-level
personnel shall be assigned overall responsibility for the
compliance and ethics program.
What You Do
Board appointed CECO
DAY TO DAY RESPONSIBILIT Y
What You Need
Specific individual(s) within the organization shall be delegated
day -to-day operational responsibility for the compliance and ethics
program.
What You Do
CECO heads the Ethics and Compliance Department
6
10/3/2013
DUE DILIGENCE - AUTHORIT Y
What You Need
The organization shall use reasonable efforts not to include within
the substantial authority personnel of the organization any
individual whom the organization knew, or should have known
through the exercise of due diligence, has engaged in illegal
activities or other conduct inconsistent with an effective
compliance and ethics program.
What You Do
Background checks (hire/transfer/periodic)
EDUCATION AND AWARENESS
What You Need
The organization shall take reasonable steps to communicate
periodically and in a practical manner its standards and procedures,
and other aspects of the compliance and ethics program, to the
individuals referred to in subparagraph (B) by conducting effective
training programs and otherwise disseminating information
appropriate to such individuals' respective roles and responsibilities.
What You Do
Annual required trainings
New hire training
Ongoing/targeted training
Regular compliance
notices/alerts
Ethics and Compliance Week
Internal compliance conferences
Newsletters
Intranet articles
Intranet compliance site
Posters
MONITORING/AUDITING
What You Need
The organization shall take reasonable steps—(A)to ensure that the
organization's compliance and ethics program is followed, including
monitoring and auditing to detect criminal conduct;
What You Do
Quality assurance teams
Internal Audit
External audit firms
Internal monitoring teams
Program specific monitoring
7
10/3/2013
MEASURE EFFECTIVENESS
What You Need
Evaluate periodically the effectiveness of the organization's
compliance and ethics program;
What You Do
Third party review
Review QA/ monitoring/ audit/ investigation trends
Internal audit reviews
Review Programs periodically
Ethics survey trends
Risk assessment trends
ANONYMOUS REPORTING
What You Need
Have and publicize a system, which may include mechanisms that
allow for anonymity or confidentiality, whereby the organization's
employees and agents may report or seek guidance regarding
potential or actual criminal conduct without fear of retaliation.
What You Do
Anonymous 24/7 Helpline (preferably 3 rd party)
Other reporting options (web, email, HR, etc.)
Test the Helpline
INCENTIVES
What You Need
The organization's compliance and ethics program shall be
promoted and enforced consistently throughout the organization
through (A) appropriate incentives to perform in accordance with
the compliance and ethics program;
What You Do
Included in performance reviews & bonus goals
Internal recognition by peers and management
Ethical leadership awards
8
10/3/2013
DISCIPLINE
What You Need
The organization's compliance and ethics program shall be
promoted and enforced consistently throughout the organization
through(B) appropriate disciplinary measures for engaging in
criminal conduct and for failing to take reasonable steps to prevent
or detect criminal conduct.
What You Do
Trained Investigations team
Documented procedures
Investigate all received concerns
Law enforcement referrals
Apply consistent discipline
MODIFY THE PROGRAM
What You Need
After criminal conduct has been detected, the organization shall
take reasonable steps to respond appropriately to the criminal
conduct and to prevent further similar criminal conduct, including
making any necessary modifications to the organization's
compliance and ethics program.
What You Do
Law enforcement referrals
Modify policies, procedures, training, etc.
ASSESS RISK
What You Need
The organization shall periodically assess the risk of criminal
conduct and shall take appropriate steps to design, implement, or
modify each requirement set forth in subsection (b) to reduce the
risk of criminal conduct identified through this process.
What You Do
Annual compliance/fraud/internal audit/ERM risk assessments
Regularly review trends and make needed program adjustments
9
10/3/2013
CONTROL MATRIX TEMPLATE
Program
Element
Training
and
Awarenes
s
Legal or Regulatory
Requirement
Citation
Internal Control
(What You
Should Do/Ideal
State)
Control
Owner
(Day to
Day
Owner)
Process
Owner
(Control
Owner's
Manager)
Remediation Activities
(What You Need to Do for
the Internal Control to Be
True)
(4)(A)The organization
8B2.1
shall take reasonable
(4A)
steps to communicate
periodically and in a
practical manner its
standards and procedures,
and other aspects of the
compliance and ethics
program, to the individuals
referred to in
subparagraph (B) by
conducting effective
training programs and
otherwise disseminating
information appropriate to
such individuals' respective
roles and responsibilities.
AND NOW YOU HAVE
MAPPED YOUR PROGRAM!
Program
Element
Training
and
Awarenes
s
Legal or Regulatory
Requirement
Citation
(4)(A)The organization
8B2.1
shall take reasonable
(4A)
steps to communicate
periodically and in a
practical manner its
standards and procedures,
and other aspects of the
compliance and ethics
program, to the individuals
referred to in
subparagraph (B) by
conducting effective
training programs and
otherwise disseminating
information appropriate to
such individuals'
respective roles and
responsibilities.
Control
Process
Internal Control
Owner
Owner
(What You
(Day to
(Control
Should Do/Ideal
Day
Owner's
State)
Owner)
Manager)
All employees John
Jane Rogers
complete Code Smith
of Business
Ethics training
on at least a
biennial basis, if
not more
frequently.
Remediation Activities
(What You Need to Do for
the Internal Control to Be
True)
Confirm with business
owner Code training is
scheduled every other year.
Determine if a master
calendar exists as evidence.
CLOSING
Slides and templates will be available in the SCCE portal
Shelley Aul, shelley.aul@apollogrp.edu
Vernon Speshock, vernon.speshock@apollogrp.edu
10