The internal controls provisions of the Foreign Corrupt Practices Act require issuers to “devise and maintain a system of internal accounting controls sufficient to provide reasonable assurances that” the specific financial objectives of the statute are met.

Besides these vague objectives such as “transactions are executed in accordance with management’s general or specific authorization” or “access to assets is permitted only in accordance with management’s general or specific authorization” the FCPA does not specify what issuers are supposed to do. Nor does any implementing rule or regulation.

Rather, enforcement of the internal controls provisions often amounts to the government – with the perfect of hindsight – adopting a theory of enforcement that represents little more than ipse dixit (an unsupported statement that rests solely on the authority of the individual who makes it). In other words, the failure to do x, y or z is an internal controls violations merely because the government says it is.

Continue Reading