Financial controls are rarely given top billing in an anti-corruption compliance program under the Foreign Corrupt Practices Act (FCPA) or UK Bribery Act. However, it turns out that financial controls are essential to the long term success of not only a compliance program but also to the great health and success of a company. This was the message delivered by Stephen Arbogast, Executive Professor at the University of Houston, Bauer College of Business, Department of Finance, in a presentation to the Greater Houston Business and Ethics Roundtable (GBHER). Arbogast worked at Exxon Chemical and ExxonMobil Chemical Company from 1997-2004. In his academic career he has focused on International Finance, Project Finance and Business Ethics.
Arbogast thesis was that while financial controls are generally viewed as a set of burdensome rules and procedures, which are designed to constrain how a person does business, the reality is that they are essential to the long term success of any organization. He cited general propositions for this thesis. The first is that financial controls promote a culture of honesty, so that employees do not cheat in doing business and do not steal from the company. The second is that having financial controls in places helps to ensure information and data integrity so that reporting up the chain provides accurate information about what is really happening, not what people want the higher-ups to believe. The third reason is that financial controls not only assist in effective risk management but also help to identify risks and develop procedures to manage those risks. Arbogast believes that such practices do not ensure a business will be successful but without them a business will fail, sooner or later. I would add that I cannot think of any FCPA enforcement action where there was not a failure or lack of financial controls in place.
While most compliance practitioners will certainly be familiar with financial controls in the detect prong of a compliance program, I came away from Arbogast’s presentation with a greater understanding of how financial controls help to prevent compliance violations. Arbogast explained that financial controls are a “structure of checks and balances” that can (1) compensate for human ethical weakness and (2) provide necessary support to individuals of integrity who are facing unethical behavior. More specifically, financial controls provide assistance to compliance regimes. In other words, they are designed to not only prevent cheating but promote doing business ethically.
Arbogast said that financial controls work by helping to set the expectations of the ethical behavior which is required of a company’s employees. It does so in a couple of ways. First it narrows the scope for unethical behavior, coupled with raising the risk of discovery and punishment. Having financial controls in place also acts to train employees in proper practice and procedures. And, finally, but certainly not least, is that financial controls help to protect employees who report unethical behavior. This final point is not to be discounted when considering the Dodd-Frank and Sarbanes-Oxley Whistleblower protections and the Dodd-Frank whistleblower bounty.
A large part of the reason that I found Arbogast’s talk so persuasive is that he made clear that financial controls are not about rules and regulations but they are really about a company’s culture. A commitment to financial controls is a commitment to doing business the right way. He said that the most effective controls are those embedded “in the line” which he defined as being used directly by line management and not simply the company’s finance or accounting group. In this manner, such financial controls became the responsibility of management and simply a corporate function such as Internal Audit. Further, if it is only Internal Audit which “owns” or uses financial controls, it becomes an “us against them” mentality.
Arbogast believes that, as with a safety first doctrine, successful management teams have determined that the “mindset underpinning good financial controls is also critical to good operations”. Some of these key management mindsets Arbogast identified were to “do it right the first time and do it right every time”. With everyone working under the same set of financial controls, it is the team or company which is emphasized; that everyone must buy in to be on the same page. Financial controls can also provide the information to allow continuous improvements through continuous feedback. Finally, Arbogast emphasized the importance of management having accurate data to be successful. He characterized this as “You are what the data says you are”. The rewards for using financial controls include accountability, data integrity and improvement of results.
Arbogast concluded by noting that company management often under-estimated the contributions that financial controls make to a long term strategy success. He listed six economic rationales for their incorporation into your company’s system. He divided them into “Preventative” and “Positive” Contributions.
Preventative Contributions included not only a check on employee behavior such as preventing theft from a company but also as a check on what he called the “management agency behavior” where a company’s management runs the business for the themselves and their personal benefit rather than for the stakeholder. Also included in the Preventative column are that financial controls help a company to avoid claims, judgments, lawsuits and monetary damages. I would add that financial controls certainly help to avoid FCPA liability because in addition to the actual fines and penalties assessed in a FCPA violation, the actual costs for such an investigation and resolution are usually estimated to be at a factor of 3 to 6 times the final financial penalty. Under this prong, Arbogast brought up a point not discussed often enough which is that by preventing claims or unethical behaviors which lead to FCPA violations, a company can avoid disrupting normal business and implementation strategy.
In the area of Positive Contributions, Arbogast said that financial controls help to preserve accurate information which allows management to better run a business. Put conversely, if such financial controls are not in place, employees will only report up the chain the information that they want management to know, which will present a false picture of the organization. Having the financial controls in place will establish accountability within the management team of the company. Lastly, financial controls help to create a culture of continuous improvement because they allow for a more meaningful assessment and amelioration of risk.
I found Arbogast’s presentation very useful for the compliance practitioner. He directly addresses how financial controls can help your anti-corruption compliance program to do business more ethically and in compliance with the relevant legislation. Moreover, I found that his overarching thesis that financial controls are really about a culture of doing business ethically and in compliance equally applies to compliance programs in general. This is a strong message that compliance practitioners can take to management; that there is an economic rationale for having a best practices compliance program going forward.
This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.
© Thomas R. Fox, 2013
Filed under: Best Practices, compliance programs, Culture, Ethical Leadership, Ethics, FCPA, Financial Controls Tagged: best practices, compliance, compliance programs, ethical leadership, ethics, ethics and compliance, FCPA, GHBER 
