Businesses are still failing to understand the corruption risks their organizations face and are still struggling to put the right anti-bribery and corruption (ABC) practices in place.
Forty percent of the 7,000 anti-corruption risk assessment procedures evaluated by GoodCorporation, and published in the paper Combating corruption: businesses still at risk, were found to be inadequate, with no improvement in adequacy in the five-year period from 2014 – 2019. This lack of improvement should be ringing alarm bells.
Any company that fails to identify and assess its exposure to specific bribery risks cannot be sure that its ABC program is protecting the company sufficiently. Consequently, such organizations are vulnerable to corruption and also limited in their ability to demonstrate an effective compliance program as their line of defense, should they face prosecution.
Legislators, including the UK Ministry of Justice, U.S. Department of Justice and the French Anti-corruption Agency (AFA) all state that organizations must understand their exposure to the risk of corruption in order to implement effective bribery prevention programs.
One reason this is so crucial is that an informed risk assessment will ensure that organizations take a proportionate approach to developing their ABC systems. It will also enable them to put in place controls that are appropriate to their size, structure, location and the nature of their activities. Not only does this ensure that management time and resources are not unnecessarily diverted, it also allows companies to prioritize the most important risks and implement mitigation measures where they are most needed.
More than three quarters of the companies in the bottom quartile of GoodCorporation’s data set have not conducted an appropriate risk assessment. Likewise, 83 percent of companies in the bottom quartile are not regularly monitoring and reviewing their ABC controls.
By contrast, the best companies have recognized that this is both important and achievable, with 94 percent of companies in the top quartile conducting appropriate ABC risk assessments and 89 percent regularly monitoring and updating their ABC controls.
Part of the problem is that risk assessments are undermined by being too high-level or generic. A detailed risk assessment will focus on the granular details of corruption risks. Key areas include selling through intermediaries and operating in sectors and countries where bribery demands for facilitation payments to obtain licenses and permits are commonplace.
Other risks include a lack of transparent payment processes, as well as sales incentives that are too heavily contingent on sales success and risk encouraging inducement payments.
Not only would taking a more risk-based approach to bribery prevention improve the overall adequacy of the ABC program, it would also help with conducting ABC due diligence of third parties.
This is the weakest anti-corruption control with 53 percent of the due diligence procedures tested by GoodCorporation graded inadequate. While this is an improvement from 63 percent in 2014, this is still a concern, particularly as the majority of corruption prosecutions involve alleged bribe payments to third parties.
All too often companies attempt to conduct due diligence across too many third parties and suppliers. The results from such an approach are only ever superficial. The best strategy is to begin with a careful risk-based assessment of third parties to identify those that pose a real threat. This more targeted approach ensures that ABC due diligence is proportionate, manageable and, most importantly, effective.
Risk assessment and due diligence are areas of ABC control that simply cannot be overlooked and yet all too often they are. These may be challenging to implement, but they are essential in order to minimize any exposure to corrupt practices. The best companies in GoodCorporation’s anti-corruption benchmark demonstrate what can be achieved. Those that flounder in their endeavors may leave costly penalties in their wake.