The Complete Compliance and Ethics Manual

Mergers and Acquisitions (M&A)

• Due Diligence Process^[3] – Was the misconduct or the risk of misconduct identified during due diligence? Who conducted the risk review for the acquired/merged entities and how was it done? What has been the M&A due diligence process generally?

• Integration in the M&A Process – How has the compliance function been integrated into the merger, acquisition, and integration process?

• Process Connecting Due Diligence to Implementation – What has been the company’s process for tracking and remediating misconduct or misconduct risks identified during the due diligence process? What has been the company’s process for implementing compliance policies and procedures at new entities?”

Brazil has also required similar actions as part of its anti-corruption law, which requires “due diligence in corporate and M&A transactions” as one of the elements of an effective compliance program.^[4]

It is clear from these recent developments that any company contemplating an M&A transaction now and in the future can no longer ignore its responsibility to conduct meaningful due diligence as a part of its overall efforts. Not only is it becoming a common enforcement consideration, but more importantly, it just makes good business sense!

The compliance and ethics professional serves as an invaluable partner in the organization to help bring the compliance due diligence process to life and to make it meaningful.

Objectives of Compliance Due Diligence

• Define the target company’s compliance risk profile

• Uncover red flags

• Uncover past or ongoing violations in key areas, such as:

  • Anti-bribery laws

  • Antitrust regulations

  • Data protection rules

  • Trade regulations

  • Worker safety requirements

• Determine the impact of any potential issues and either address the issue or recommend exiting the deal

• Once consummated, integrate the new company into your company’s ethics and compliance program.

Do not expect the M&A team to just roll over and do what you want. Corporate deal makers tend to be tough. You will likely get push back and difficult questions. Be tough right back. If you wilt, you will fail. Respect matters, and the M&A team will likely not respect you if you don’t stand firm for your right to be involved. You are not asking permission. You are telling the M&A team that you have a job to do, and here is how they will help you do it. Do not make this seem optional.

Typically, M&A teams have enough experience and aversion to risk that they quickly adopt the idea of ethics and compliance due diligence. If that does not happen, you may need to seek assistance from executive management or other ethics and compliance champions in your organization to influence the M&A team. If that fails as well, please see the Post-Acquisition Integration section of this article regarding due diligence after the deal closes. You also may want to check out the SCCE Compliance Job Board to see if there are any openings with a company that is more invested in ethics and compliance.

Once the M&A team better understands the objectives and benefits, the next step is to establish who on the M&A team will be assisting your team (the “E&C team”) with ethics and compliance due diligence efforts during the M&A process. Remember, you cannot quit your day job. Members of the M&A team are typically relieved from their regular duties to focus exclusively on M&A. You, however, will likely still be expected to carry out your normal day-to-day ethics and compliance role. Unless you have a large and heavily-resourced ethics and compliance department, your team cannot be the arms and legs of this endeavor. Instead, the E&C team’s role should be focused on oversight and analysis. The “grunt work” of ethics and compliance due diligence needs to be performed by others for this process to succeed. Identify contacts within the M&A team and other functional groups in the organization (HR, IT, etc.) who can partner and help to gather needed information, assist in serving as an interface with the target company when needed, and serve as a liaison between the M&A team and the E&C team. These strategic partners are essential to the overall success of your efforts and should be leveraged throughout the process.

At this time, you should also partner with the member of the Legal department assigned to the M&A team to address any legal issues that may arise throughout the ethics and compliance due diligence process. Companies engaged in M&A typically manage the process, including due diligence, under attorney-client privilege. Ensure you are partnering with counsel as appropriate to properly maintain privilege throughout your engagement. If for some reason, the M&A transaction is not being directed under privilege, you should discuss with your company’s general counsel for further guidance on your activities.

As potential legal issues become visible during the ethics and compliance due diligence process, the Legal liaison should be immediately contacted to provide legal advice regarding that issue. Not only does that ensure that the company is protected from a legal perspective, it will also likely allow privilege to apply to those communications so that a proper discussion and analysis of the issue can occur without harming the company.

Bottom Line: Failure to conduct meaningful ethics and compliance due diligence could turn a profitable deal into a disaster for your company. Even if the issues found during the ethics and compliance due diligence process do not create legal concerns, there could be ethical, reputational, branding or other concerns that might harm your company. It is far better to know before you buy than to suffer the consequences and be forced to pay for it later.

Know the Deal

Once the deal has been identified, the E&C team should work with the M&A team, the Legal team, risk management and others (Internal Audit, HR, IT, etc.) within the company to determine the risk profile. Key factors typically considered to determine those risks include:

• Nature of Transaction

  • What is the end goal for your company in this deal?

  • Is your company paying in cash or stock?

  • Is your company assuming any particular liabilities?

  • What risks have been identified so far regarding this type of transaction?

• Industry

  • Is your company already in this industry, or is it a new area?

  • Is the industry highly-regulated?

  • Is the industry currently a target of government scrutiny?

• Target-specific

  • Is the target a competitor?

  • Has the target been known to have issues?

  • What is the target’s history?

These questions help determine what kinds of risks your company will assume. Your team needs to identify both known problems and potential sources for unknown problems. For example, purchasing stock typically means purchasing all the liabilities that existed before the target company was bought. Many deals specifically include/exclude certain liabilities. Those need to be known. If the target is known by your company (such as a competitor), that can also prove helpful in identifying known or potential risks.

Also, entering into a new industry can add greater risk to the organization. New industries present new risks that may not be evident when conducting due diligence. If this is the case, specialized help may be necessary to ensure that your team knows exactly what questions to ask and/or materials to review.

Once the risk profile has been established, the team that helped develop the risk profile should conduct a risk assessment. If possible, leverage an existing risk group/risk committee within your company to assist with this process. The purpose of this assessment is not to mitigate the risk. Instead, the assessment determines the probability and potential impact of the identified risks of the target company to the organization, prioritizing those risks, and including these considerations as part of the M&A transaction. This assessment may change based on information obtained from the target company through the use of due diligence checklists.

Due Diligence Checklists

Once the risk profile and risk assessment of the target company has been completed, the next step is to develop due diligence checklists from that risk assessment. These due diligence checklists allow the M&A team to gather the information the E&C team needs to assess the ethics and compliance risks associated with the merger or acquisition. A separate due diligence checklist will need to be prepared for each identified risk, along with general due diligence checklists to determine the nature and scope of the target company’s ethics and compliance program.

Simple is always preferred over complex. As stated earlier, the M&A team will be carrying the laboring oar during this part of the ethics and compliance due diligence process. Do not expect your M&A team to be compliance nerds. Due diligence checklists allow the M&A team to obtain information from the target company and return it to the E&C team in a format that allows for quick evaluation. Due diligence does not end at checklists, but they are a great place to start. Due diligence checklists also provide a uniform, repeatable and consistent format to gather information and spot potential ethics and compliance issues.

Each due diligence checklist needs to set forth its purpose and short instructions on how to use it. An example of checklist instructions might look like this:

SAMPLE

Instructions: M&A Transactions – Ethics and Compliance Due Diligence Checklists

PURPOSE: During the due diligence phase of a merger or acquisition, this checklist should be used to determine and identify specific ethics and compliance risks that should be investigated further for the categories indicated in the table of contents.

INSTRUCTIONS: For each category listed below, request responses and related materials from the potential merger or acquisition target (“target company”) for each of the questions and inquiries set forth in the checklist. When a specific response references and/or requires additional documentation to validate it, request those additional materials from the target company as applicable. After completing the checklist and obtaining any requested documentation, forward the materials to the chief compliance officer, or any appropriate designee, for review. The E&C team will review the checklist and follow up with the M&A team should any issues arise that require further review or information gathering.

Very few professionals are experts in every area. It is important to leverage expertise across your team and functional partners in the organization to ensure Checklist responses and materials provided are properly reviewed and evaluated. When outside expertise is needed, don’t be afraid to seek out and leverage this support. To help control costs, it is recommended that the E&C team prepare the initial draft Due Diligence Checklist for each risk area. Doing so will allow the E&C team to control the tone, structure and depth of the Due Diligence Checklists. Then, once the initial draft is complete, ask an outside expert for that specific risk area to review for gaps, omissions, and errors.

A sample Ethics and Compliance Due Diligence Checklist might look like this:

SAMPLE

E&C Due Diligence Checklist

As stated above, completing the due diligence checklist just starts the process. Once completed, someone from the E&C team should review the checklist responses and related documentation for each risk area and determine what follow-up activity is needed.

The M&A team is not likely to know the potential impact and likelihood of a given response. For example, not having an anti-corruption policy does not mean that the target company bribes foreign officials. It does mean, however, that the target company likely does not know whether such corruption occurs in its organization. Further investigation will likely be necessary to obtain an appropriate comfort level before pulling the trigger on the deal. The E&C team will need to lead those efforts and leverage the appropriate experts when needed.

Once all due diligence checklists are completed and evaluated for each risk area, the E&C team needs to conduct a review and assessment of the response. Further information and/or investigation may be required. Additionally, the Legal liaison should be involved in any response that implicates a potential legal concern, as discussed earlier. This will allow the E&C team to understand any potential legal risks while, in most cases, simultaneously protecting those discussions under the attorney-client privilege.

The E&C team should report all responses, findings, and considerations to the M&A team. This reporting should include final recommendations on options available, which typically include (a) close the deal; (b) require remediation before the deal closes; (c) close the deal with a mitigation plan ready to be enacted once the deal is complete; or (d) cancel the deal. The M&A team, in conjunction with the E&C team, should then present these findings and recommendations to the appropriate decision makers within the acquiring company.

It can certainly be difficult when the final recommendation is “no deal,” but sometimes there is no other option to ensure the company is protected. In many cases, however, appropriate mitigation and/or remediation of the identified risks may cure the related challenges and allow the deal to move forward. If mitigation and/or remediation is a viable and acceptable option, the E&C team needs to ensure that post-acquisition integration efforts include such activities as a priority.