Companies often unwittingly expose themselves to bribery and then do not have the controls, processes, or presence of mind to recognize the risks. This is often due to a mistaken belief that “it wouldn’t happen here.”

While far from exhaustive, the list below provides some examples of how companies expose themselves to bribery.

Keith Read is an award-winning thought leader and expert in compliance, ethics, culture and governance. He was formerly the Group Director of Compliance and Ethics for BT (British Telecom) in London and is a past winner of the Compliance Register's Best Compliance Officer award, when he also won the Best Compliance Company award.

News headlines are littered with examples of bribery allegations, often involving major, high-profile companies with good reputations and what was thought to be strong corporate governance.

The Office of Foreign Assets Control (OFAC) at the Treasury Department administers a variety of economic and trade sanctions programs intended to impose restrictions on trade by U.S. citizens with countries, organizations, or individuals that the U.S. government has determined pose foreign policy or national security concerns. While many of those programs see frequent changes, the U.S. embargo against Iran continues to be the most dynamic, and presents perhaps the greatest risk to U.S. exporters.

After several years of preparatory work, the ECRI made concrete changes in late 2013 to the U.S. export control system. On October 15, export control responsibility for numerous lower-level defense articles was transferred from the State Department to the Commerce Department. Historically, the Commerce Department was responsible only for regulating the export of dual-use articles (items with both commercial and military utility), while the State Department was responsible for regulating the export of defense articles. With the recent transfer of certain less sensitive defense articles to the Commerce Control List, the Commerce Department now has jurisdiction over both dual-use articles and certain lower-level defense articles.

Social media increasingly play a role in just about all stages of the employment process—and at each stage there are compliance risks.

Many companies, for example, regularly look up job applicants online as part of the hiring process. But according to a 2013 study by researchers at Carnegie Mellon University, many may also use what they find to discriminate. In an online experiment, the researchers tested responses of over 4,000 U.S. employers to a Muslim candidate relative to a Christian candidate, and to a gay candidate relative to a straight candidate. They found that “survey subjects with hiring experience are significantly less likely to say they would interview the Muslim candidate than the Christian candidate.” (However, researchers found no evidence of discrimination against the gay candidate relative to the straight candidate.)

Privacy is one critical concern, as a wide variety of social media and mobile applications enable companies or their third-party service providers to gather personally identifiable information (PII), location data, and other confidential customer information.

The world of social media moves quickly.

Importantly, the renewed focus on accounting and internal controls is accompanied by a new, aggressive policy that the SEC will seek admissions in some cases, rather than settling on a “no admit, no deny” basis. The “no admit, no deny” policy encouraged corporations to settle because it allowed a corporate defendant to forego time-consuming and expensive litigation while simultaneously avoiding the reputational harm and collateral consequences that would come from an admission of wrongdoing. In particular, the policy provided corporations alleged with wrongdoing protection from liability for these reasons: 1) If the corporation litigates and loses, issue preclusion could mean almost automatic additional liability in the inevitable subsequent suit by private plaintiffs. 2) Although an admission of wrongdoing in a settlement does not satisfy the requirements for issue preclusion, the admission nonetheless could provide substantial negative evidence in any future private suit. Chair White, however, has stated that the SEC increasingly will strive for admissions because of the added measure of public accountability. Adding to the sting of requiring an admission, the SEC Enforcement Staff will not consider the collateral consequences of an admission on the company. This means that an admission will have a ripple effect on a corporation and its shareholders. Importantly, Chair White also has stated that the agency will increasingly push for aggressive penalties because of the deterrent effect that can be accomplished by large settlements and penalties.

In tandem with a departure from the “no admit, no deny” policy is an increased willingness by the SEC to go to trial, or at least institute an administrative proceeding. Prior to the enactment of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank), penalties in administrative cease-and-desist proceedings could be levied only against regulated entities such as broker-dealers or investment advisors. Now, under Section 929P of Dodd-Frank, the SEC has the authority to seek a civil monetary penalty in an administrative proceeding against any individual or company. This change likely will incentivize the SEC to file administrative proceedings because of the numerous advantages such proceedings afford. For example, administrative proceedings are heard by an administrative law judge (ALJ) employed by the SEC. There is no right to a trial by jury in an administrative proceeding. Moreover, although a challenge to an ALJ decision is heard de novo, the appeal is made to the SEC Commission itself.

In recent years, the number of FCPA enforcement actions initiated by the DOJ (Department of Justice) and the SEC that include an internal controls charge has increased, and seems to signal a shift toward a broader application of the internal controls provision of the Act. Directors, in addition to executives, may be targets of enforcement actions because they have a duty to attempt, in good faith, to ensure the existence of an adequate corporate information and reporting system. Failure to do so under some circumstances may, in theory at least, render a director liable for losses caused by non-compliance with applicable legal standards related to internal controls.