As COVID-19 continues to spread worldwide, more and more governments are implementing heavy travel and work restrictions on individuals and companies. For many companies, these restrictions have severely disrupted or even halted business operations. Their priority is to implement alternative arrangements to ensure that the frontline business can operate as usual. However, another casualty of these travel and work restrictions has been to disrupt the very important activities of in-house regional and global compliance teams who are not able to provide direct oversight, training and risk assessments to their local business operations.
Our alert discusses several of the main compliance risks that may arise from the COVID-19 outbreak disruption and what practical steps companies can take to pre-empt these risks.
Business impact and compliance risks
The COVID-19 outbreak has caused significant financial stress and economic uncertainty for companies across all sectors. This stress and uncertainty – and the crisis mentality that comes with it – may result in increased non-compliant behavior. For example, when employees or third-party intermediaries:
- attempt to speed up processes that may be stalled due to short-staffing or closure of government offices, such as by providing improper payments to government officials;
- attempt to apply for government subsidies designed to support business entities sustaining adverse impact from the COVID-19 outbreak by submitting falsified supporting materials to meet the thresholds;
- seek to bypass product quality approval processes or testing/licensing requirements to meet increasing market demand; or
- falsify accounting entries of profits and losses to meet sales targets and investor expectations.
The COVID-19 outbreak has also caused significant restrictions on movement around the world, both at a local level, through mandatory remote working arrangements, and at an international level, through travel bans and quarantine policies. The implications of these restrictions on corporate compliance are varied – three key examples we are seeing on the ground are as follows:
- Where compliance issues have been identified, companies are no longer able to easily speak to involved employees, gather and examine physical evidence, and conduct site visits, thereby making it difficult to swiftly investigate and remediate the suspected misconduct.
- Companies are seeking to shift supply chains to alternative locations and suppliers less affected by the outbreak. However, changing manufacturing locations or suppliers quickly raises additional compliance risks, especially if time constraints prevent the company from properly screening and vetting new parties. Possible areas of liability that companies may be exposed to include: bribery/corruption, trade sanctions, and supplier abuses (such as forced or child labor).
- Many companies are making donations to hospitals, governmental organs and charity institutions as part of their corporate social responsibility practices and to assist with the current health crisis. Companies should remain vigilant to compliance risks associated with such donation activities and avoid any attempt to use these activities as a means of influencing the business decision of the receiving party with a view to securing business advantages or opportunities.
Actions to consider
We set out below some practical tips on how companies can maintain ongoing compliance during these challenging times.
1. Communication – Communicate to all employees and third parties that compliance continues to be a key priority for the business. To add weight, this message should come from middle/senior management directly. This communication should include the following content:
- the particular compliance challenges associated with the outbreak and how to deal with these challenges;
- the company’s continued commitment to a culture of ethics and compliance and that it has zero tolerance for any misconduct no matter the circumstances; and
- the importance of abiding by the company’s strict accounting controls and that long-term business sustainability and risk management take precedence over short-term profitability.
2. Oversight/Monitoring – Continue to exercise oversight over all employees and third parties and monitor adherence to the relevant compliance policies, standards and controls. Compliance personnel should be responsible for this oversight, in close coordination with internal audit, finance, and other business functions. Due to the travel restrictions in place, it is more important than ever to ensure that accessible and effective reporting hotlines are in place to encourage employees and third parties to report any knowledge or suspicion of misconduct to regional or global compliance functions.
3. Technology – Make use of technological alternatives, such as video conferencing and e-discovery/review software, to quickly and proactively respond to any compliance issues identified. It is particularly important for companies that have recently opened a new investigation or are conducting an ongoing investigation to avoid delays which can allow compliance breaches to worsen and give perpetrators time to destroy evidence.
4. Government announcements and rules – Closely follow-up on the latest legislative developments and new rules issued by local authorities related to the COVID-19 outbreak. Compliance personnel should be proactive in alerting business units of regulatory requirements including their application to targeted subsidiaries, resumption of work, employment establishment, employee termination and work condition protection.
5. Donations – In the event that the company decides to make donations to support the fight against the COVID-19 outbreak, it needs to pay special attention to the qualifications of the receiving parties. For instance, PRC law does not allow departments or individual employees of hospitals to accept any kind of donations. In addition, the company should be clear about the internal and external donation procedures and document the donation process. The company may also want to act in a supervisory role. It is entitled to request the receiving party to disclose the use of the donated funds as well as the relevant audit report.
6. Supply chain and third parties – If looking to move your supply chain, try to use previously-vetted and trusted suppliers that can meet production and sourcing needs. If this is not possible, companies should always ensure that procurement processes are followed and diligence is conducted on any new third parties before they are engaged. As it may be cost- and time-prohibitive to run comprehensive background checks, companies should take a risk-based approach and allocate resources to this task depending on the specific risks faced. For example, priority should be given to conducting diligence on a third party who frequently interacts with government entities and officials, on a supplier who is subject to additional customs and import/export regulations, or on a supplier based in a country in which slave or child labor are common. After these checks are completed, companies should incorporate corresponding compliance covenants into the relevant contracts, require the third party to sign a standalone compliance certification form and implement periodic monitoring processes.
Ultimately, a well-run corporate compliance program must not be sidelined by COVID-19. While business and health risks rightfully remain at the forefront of concerns, companies should ensure that any compliance risks that may arise are pre-empted and addressed in an appropriate and timely manner. This will not only give support to your employees and confidence to your customers in the short term, it will also enhance the long term reputation of the business once this crisis has passed.
