Other than this website (see here, here, here, here, here, here, here and here), there seems to be little focus on the SEC’s inconsistent approach to enforcing the FCPA’s books and records and internal controls provisions.
Which is too bad because consistency is a basic rule of law principle. In other words, the same legal violation ought to be sanctioned in the same way. When the same legal violation is sanctioned in materially different ways, trust and confidence in law enforcement is diminished.
As highlighted in the numerous prior posts as well as the latest example described below, there sure does seem to be a lack of consistency between how the SEC resolves Foreign Corrupt Practices Act books and records and internal controls violations.
As most readers no doubt know, the FCPA has always been a law much broader than its name suggests. The anti-bribery provisions are just one prong of the FCPA.
Indeed, most FCPA enforcement actions do not involve allegations of foreign bribery, but rather violations of the FCPA’s generic books and records and internal controls provisions. These provisions generally require that issuers shall: (i) maintain books and records which, in reasonable detail, accurately and fairly reflect issuer transactions and disposition of assets (the books and records provisions); and (ii) devise and maintain a system of internal accounting controls sufficient to provide reasonable assurances that transactions are properly authorized, recorded, and accounted for (the internal controls provisions).
For lack of a better term, let’s call such actions “non-FCPA FCPA enforcement actions.” Such actions are not dissected in the FCPA space and do not appear on the DOJ or SEC’s FCPA websites (here and here). Yet such actions are deserving of analysis because they highlight a troubling aspect of FCPA enforcement: that being how the same alleged legal violations are sanctioned in materially different ways.
Earlier this week, the SEC announced an enforcement action against American Renal Associates Holdings, Inc. (ARA), a provider of dialysis services through clinics across the country, and two of its former chief financial officers and former controller for engaging in a revenue manipulation scheme that resulted in the restatement of several years of financial reporting.
The SEC’s complaint alleges in summary fashion:
“This is an accounting fraud case arising from a multimillion dollar scheme by three former ARA finance executives … to improperly manipulate certain revenue adjustments to make it appear that ARA’s financial performance was better than it actually was.
The fraudulent scheme lasted from approximately January 1, 2017 through at least November 9, 2018 (the “relevant period”). The scheme entailed entering a series of revenue adjustments to make it appear that ARA had beat, met, or come close to meeting various predetermined financial metrics, when in fact its financial performance was materially worse. [The former executives] intentionally, recklessly, and negligently engaged in acts, practices, and courses of conduct related to those revenue adjustments that caused ARA to overstate its revenue, net income, and other financial metrics throughout this period.”
In short, the SEC alleged that ARA based on the conduct of several high level executives (most traditional FCPA enforcement actions do not involve high-level executive conduct at the parent company) engaged in a revenue manipulation scheme that resulted in the restatement of several years of financial reporting (an occurrence that is rare in traditional FCPA enforcement actions).
Based on the above, the SEC found that ARA violated, among other things, the FCPA’s books and records and internal controls provisions. Without admitting or denying the SEC’s findings, ARA agreed to pay a $2 million civil penalty.
Compare this paltry civil penalty for high level executives engaging in a revenue manipulation scheme that resulted in restatement of several years of financial reporting with – for instance – the BHP Billiton enforcement action (see prior posts here, here and here) in which the SEC assessed a $25 million civil penalty for – better sit down for this one – the company’s “failure to devise and maintain sufficient internal controls over a global hospitality program that the company hosted in connection with its sponsorship of the 2008 Beijing Summer Olympic Games.” Or the SEC’s enforcement action against Telefonica Brasil (see prior posts here and here) in which the SEC assessed a $4.1 million civil penalty for – hopefully you are still sitting down – “a hospitality program that the company hosted in connection with the 2014 World Cup and 2013 Confederations Cup.”
As the ARA enforcement action once again demonstrates, the SEC has some explaining to do and owes the legal and compliance community an explanation for why FCPA books and records and internal controls violations are not sanctioned in similar ways.
