A little while back, I posted a couple of critical commentaries (here and here) about the efforts underway to develop an International Organization for Standardization (ISO) standard for corporate anti-bribery programs (ISO 37001), modeled on the already-existing UK standard developed by the British Standard Institute (BS 10500). (For those unfamiliar with these organizations or what they do, these standards are developed by a private consortium, and then private firms conduct–for a fee–audits of companies and provide a “certification” that the company is in compliance with the standard. These standards in the past have dealt with technical or quality control issues — the proposed anti-bribery standard is, to the best of my knowledge, the first ISO standard to deal with a legal issue of this type.) Without rehashing my earlier posts here, I raised questions both about how these certifications were supposed to work in practice, and about what they were for. I raised but dismissed the possibility that law enforcement might treat ISO/BS certification as an adequate indicator that a firm had a satisfactory compliance program (or that absence of ISO/BS certification as an indicator the compliance program was inadequate). I dismissed the possibility because lots of people (including those who work in the compliance certification business and those involved with the development of the ISO standard), assured me that such certification was not intended to have that kind of dispositive legal significance (even if it might be relevant to the law enforcement agency’s inquiry).
I would have left the matter there, and probably not written about it again, but for some remarks at last December’s World Bank International Corruption Hunters Alliance meeting. On a panel about “Fighting Transnational Bribery,” Detective Inspector Roger Cook, with the Operations area in the City of London Police’s Economic Crime Directorate, spoke with great enthusiasm about BS 10500, the model for the proposed ISO 37001. (This is perhaps unsurprising given that, as I just learned from his City of London police bio, he “contributed to the development and implementation of … BS 10500 and the developing ISO 37001.”) I don’t have a transcript or a video, nor am I a trained stenographer, but I tried to copy down Detective Inspector Cook’s remarks on this topic as close to verbatim as possible, and they went (according to my notes) more or less like this:
[If you’re a company, the BS 10500 standard] is going to give you a lot of comfort. Simply by getting accredited, then you have those adequate procedures that the UK Bribery Act requires companies to have [(that is, to satisfy the affirmative defense to the strict liability offense of failure to prevent foreign bribery)]. If the company has BS 10500 [certification], we’re not going to look much further, as long as they’re applying it properly. And an ISO standard [ISO 37001] is also in the works, about 18 months away. Think how good that would be, if every company going for a public contract were accredited. [We should] make that [certification] a condition for public contracts.
Now, Detective Inspector Cook was speaking in his personal capacity, not on behalf of the City of London Police or the British government. And he is not affiliated with the Serious Fraud Office (SFO), which has principal responsibility for bringing enforcement actions under the UK Bribery Act. But I nonetheless found these remarks quite troubling, so perhaps it’s worth restating the reasons why private anti-bribery certification or accreditation, according to something like the proposed ISO standard, should not be considered necessary or sufficient to establish the compliance defense under the UK Bribery Act, and should not be considered necessary or sufficient to engage in government contracting.
To a certain extent I’m repeating what I said in my earlier posts, but I think it bears repeating here.
Most importantly, there is no “one-size-fits-all” approach to an effective and appropriate anti-bribery compliance program. This is not a terribly controversial proposition; it is shared by just about every sensible person I’ve heard address this general topic (including the very thoughtful people who work in the anti-bribery certification industry, and who I very much respect even though we may have a few disagreements about the appropriate role of such certifications). Although there are some core elements that should be part of any effective compliance program, the details of such programs will (and should) vary considerably depending on the size and business of the firm, the countries in which it’s doing business, and a host of other factors. I’ll simply restate here what I said before:
[I]f [law enforcement agencies started] treating a private firm’s certification [under the ISO standard] as [establishing, for law enforcement purposes, that the firm had an adequate compliance program in place], that might cause more problems than it solves…. [I]n practice, if governments … started treating private anti-bribery certifications as important indicators of the existence of an effective program, I fear the result could be … reduc[ed program] quality and wast[ed] resources. This would occur if certifications ended up being relatively superficial evaluations of whether a company had an adequate formal program in place (particularly if the evaluation was based largely on the company’s self-reporting), without as much attention to intangible factors (such as the elusive but important “tone from the top”) and more rigorous internal testing. What we might get, in that case, are resources wasted on essentially duplicative external evaluations of things that companies themselves can and do evaluate internally — just to get the “gold star” of certification — while at the same time reducing the actual quality of programs, if the certification is perceived as obviating the need to do more extensive and expensive internal or external evaluations.
Or as I put this (a bit more succinctly) in a subsequent post:
If [law enforcement treats the ISO certifications as significant,] things might be even worse [than if they were ignored]: The ISO certification process might demand too little of firms (making it possible to get the ISO gold star with only a “paper program”) or it might demand too much (with rigid outside auditors insisting on features that the company does not need, given its risk profile). And why do we need this? Why not do what we have been doing — use a combination of the threat of legal liability and the promotion of ethical business norms to encourage a better compliance culture, without trying to reduce everything to a single international standard?
The larger point here is that I’m deeply troubled by the idea that law enforcement agencies (or government procurement officers) might outsource the evaluation of a firm’s anti-bribery compliance program to a private organization. And perhaps it bears emphasis that the auditing bodies performing these evaluations do so for a fee, and may not have the requisite expertise to make the fine-grained, risk-based, case-by-case assessments that law enforcement agencies (including the US Department of Justice and the UK Ministry of Justice), as well as the more competent and reputable private certification firms, routinely emphasize as necessary.
I want to emphasize that I am not here saying that private certifications of anti-bribery compliance do not perform a useful role, nor that the decision to develop the ISO 37001 standard is misguided. Admittedly, I have in the past at least hinted at the former, and have openly argued the latter. But neither of those stronger positions is necessary for the point that I want to make here. Even if private certification, or a uniform international standard of some kind, might play a useful role, such a standard should not be used by governments–and especially not by law enforcement–to determine whether a company’s anti-bribery program is in fact appropriate. To do so would be of great benefit to the organizations that provide the standards and the firms that do the certifications, but to nobody else.