If you are reading this article, excitement likely awaits. Your company has decided to grow through a merger or acquisition. Wealth, fame, and happiness are just around the corner! Well, maybe not. Nothing is ever as rosy as it seems, and buyer’s remorse can certainly set in.
Your job as a compliance professional is to help minimize that buyer’s remorse by taking reasonable steps to ensure that your company does not “buy” into somebody else’s mistakes. This article will provide some practical steps and tips that can be taken to give your company stronger assurance that its new toy is at least non-toxic and safe to use.
Reasons for Ethics and Compliance Due Diligence
A buyer should take steps to know what it is buying through a process more commonly referred to in the mergers and acquisitions (M&A) world as “compliance due diligence.” Ignoring or minimizing this important process can certainly have disastrous consequences for the buyer in both the short and long-term.
The example of In the Matter of Goodyear Tire and Rubber Co. and the company’s failure to perform compliance due diligence (see footnote 2), along with many others, have led governments throughout the world to require compliance due diligence during mergers and acquisitions as part of an effective ethics and compliance program. For example, the U.S. Department of Justice (DOJ) issued insights in April 2019 specifically calling out mergers and acquisitions as an important consideration when evaluating the effectiveness of a company’s ethics and compliance program:
Due Diligence Process—Was the misconduct or the risk of misconduct identified during due diligence? Who conducted the risk review for the acquired/merged entities and how was it done? What has been the M&A due diligence process generally?
Integration in the M&A Process—How has the compliance function been integrated into the merger, acquisition, and integration process?
Process Connecting Due Diligence to Implementation—What has been the company’s process for tracking and remediating misconduct or misconduct risks identified during the due diligence process? What has been the company’s process for implementing compliance policies and procedures at new entities?
Brazil has also required similar actions as part of its anti-corruption law, which requires “due diligence in corporate and M&A transactions” as one of the elements of an effective compliance program.
It is clear from these recent developments that any company contemplating an M&A transaction now and in the future can no longer ignore its responsibility to conduct meaningful due diligence as a part of its overall efforts. Not only is it becoming a common enforcement consideration, but more importantly, it just makes good business sense!
The compliance and ethics professional serves as an invaluable partner in the organization to help bring the compliance due diligence process to life and to make it meaningful.
Prepping Your Internal Partners
Ideally, you will be notified in advance when your company has decided to go shopping. Many companies form specific M&A teams who do nothing but evaluate and execute potential deals. You need to know that team.
If, for some reason, you are not notified, do not worry. This article addresses how to conduct due diligence after the fact in the Post-Acquisition Integration section. Since due diligence after the fact mirrors pre-acquisition due diligence, however, you should definitely keep reading.
You also may not be invited to join the M&A team. Do not wait for an invite. Approach the M&A team and ask for a meeting. As will be explained, a business case exists for compliance due diligence.
Assuming that your company has an M&A team, schedule a brief training session with the M&A team before the deals start pouring in. Brief them on the need for compliance due diligence and the basic process for performing that due diligence. An easy way to do that is to consider leveraging the business case and talking points set forth in this article as a potential outline for your training.
Your company may not have a formal M&A team. There will likely, however, be a point person running the deal. There is also often a member of the legal department assigned to the deal. If there is no formal M&A team, approach those two individuals and ask for a meeting to explain your role in the process and how it will assist their efforts. I recommend using that opportunity to push for a formal M&A team to conduct due diligence. At the very least, the core employees running the deal should be treated as an M&A team for purposes of compliance due diligence. You may require assistance in building this team. I have found that both internal audit and legal departments can be great allies in this process.
Buy-in from the M&A team often requires exerting some influence and providing education on the objectives and overall benefits of compliance due diligence. Importantly, it may also include providing examples where compliance failures have arisen with other companies along with the impact that those failures had to the bottom line.
The following outline is a good example of some key topic areas and considerations to include in your training materials:
Objectives of Compliance Due Diligence
Define the target company’s compliance risk profile
Uncover red flags
Uncover past or ongoing violations in key areas, such as:
Data protection rules
Worker safety requirements
Determine the impact of any potential issues and either address the issue or recommend exiting the deal
Once consummated, integrate the new company into your company’s ethics and compliance program
Do not expect the M&A team to just roll over and do what you want. Corporate deal makers tend to be tough. You will likely get push back and difficult questions. Be tough right back. If you wilt, you will fail. Respect matters, and the M&A team will likely not respect you if you don’t stand firm for your right to be involved. You are not asking permission. You are telling the M&A team that you have a job to do, and here is how they will help you do it. Do not make this seem optional.
Typically, M&A teams have enough experience and aversion to risk that they quickly adopt the idea of ethics and compliance due diligence. If that does not happen, you may need to seek assistance from executive management or other ethics and compliance champions in your organization to influence the M&A team. If that fails as well, please see the Post-Acquisition Integration section of this article regarding due diligence after the deal closes. You also may want to check out the SCCE Compliance Job Board to see if there are any openings with a company that is more invested in ethics and compliance.
Once the M&A team better understands the objectives and benefits, the next step is to establish who on the M&A team will be assisting your team (the “E&C team”) with ethics and compliance due diligence efforts during the M&A process. Remember, you cannot quit your day job. Members of the M&A team are typically relieved from their regular duties to focus exclusively on M&A. You, however, will likely still be expected to carry out your normal day-to-day ethics and compliance role. Unless you have a large and heavily-resourced ethics and compliance department, your team cannot be the arms and legs of this endeavor. Instead, the E&C team’s role should be focused on oversight and analysis. The “grunt work” of ethics and compliance due diligence needs to be performed by others for this process to succeed. Identify contacts within the M&A team and other functional groups in the organization (HR, IT, etc.) who can partner and help to gather needed information, assist in serving as an interface with the target company when needed, and serve as a liaison between the M&A team and the E&C teams. These strategic partners are essential to the overall success of your efforts and should be leveraged throughout the process.
At this time, you should also partner with the member of the legal department assigned to the M&A team to address any legal issues that may arise throughout the ethics and compliance due diligence process. Companies engaged in M&A typically manage the process, including due diligence, under attorney-client privilege. Ensure you are partnering with counsel as appropriate to properly maintain privilege throughout your engagement. If for some reason, the M&A transaction is not being directed under privilege, you should discuss with your company’s general counsel for further guidance on your activities.
As potential legal issues become visible during the ethics and compliance due diligence process, the legal liaison should be immediately contacted to provide legal advice regarding that issue. Not only does that ensure that the company is protected from a legal perspective, it will also likely allow privilege to apply to those communications so that a proper discussion and analysis of the issue can occur without harming the company.
Bottom Line: Failure to conduct meaningful ethics and compliance due diligence could turn a profitable deal into a disaster for your company. Even if the issues found during the ethics and compliance due diligence process do not create legal concerns, there could be ethical, reputational, branding, or other concerns that might harm your company. It is far better to know before you buy than to suffer the consequences and be forced to pay for it later.