Compliance due diligence

Compliance due diligence is defined as the process of conducting a thorough investigation, audit, or analysis of a company’s compliance with governmental and nongovernmental regulatory bodies. It seeks to establish whether a company is following the rules as it should be, to find areas of noncompliance, and identify past breaches. It also allows the acquirer to judge what remedial actions and improvements should be implemented to the compliance framework post-acquisition, estimate costs, and assess less quantifiable risks such as reputational issues.

The expectations of the U.S. Department of Justice and Securities and Exchange Commission regarding Foreign Corrupt Practices Act enforcement in the context of M&A include:

• Conduct good faith due diligence to uncover potential corruption and bribery pre-acquisition.

• Ensure a well-documented due diligence.

• Create a plan to address deficiencies or compliance gaps after the completion of the transaction.

• Implement a remediation plan.

• Report violations to demonstrate the company’s efforts to implement remedial measures.^[1]

However, there are challenges when performing compliance due diligence. Usually there are limited compliance resources, and due diligence is usually an additional task on top of all other routine compliance activities. In some cases, the acquisition involves organizations operating in high-risk jurisdictions; some organizations have an inadequate compliance program—or none at all. Furthermore, one of the most significant barriers is the different cultural and social norms between the two organizations.

Compliance risk assessment

Although an anti-corruption framework does not eliminate the risks of corruption, it does reduce those risks and demonstrates a clear message from executive management about fighting against corruption. Therefore, the potential acquirer should take a risk-based approach to compliance due diligence. The evaluation will begin with a general external screening of the target company from publicly available resources; it will then dive into an internally focused evaluation based on the initially identified specific risk areas.

A general and quick risk assessment should be performed based on external and environment analyses:

• The structure of the deal and size of the transaction

• The target’s location and territories in which it operates (based on Transparency International’s Corruption Perceptions Index)^[2]

• The target’s industry and sector

• The target’s public adverse media risk profile and compliance program

• Reputational issues (e.g., history of previous compliance issues, its anti-corruption and compliance systems)

The next step of the risk assessment should be based on internal information from the target company:

• Corporate, civil, and criminal documents; investigations; litigation; administrative proceedings; court filings; government authority decisions or orders

• Company structure, ownership (particularly ultimate beneficial owners), directors, management, and key persons

• Involvement of politically exposed persons, related political/governmental third parties

• Legislative compliance (e.g., anti-trust and competition law, General Data Protection Regulation)

• Robustness and effectiveness of the target company’s compliance program, including internal audit processes, policies, employee training, monitoring, controls, and disciplinary actions

• Third parties, contracts, and controls

The aim of this investigation is to reveal previously unknown issues or red flags, mitigate regulatory risk, understand regulatory obligations, confirm that business partners are legitimate, and evaluate potential business impact. Based on the results, the acquirer may need to adjust the risk approach or terminate the initiation of the deal. The outcome of the risk assessment is the first go/no-go decision. If considerable issues have been identified, the team can recommend terminating negotiations. However, in most cases, although numerous risks might be identified, they do not justify terminating the potential deal. The due diligence team should identify the high-risk topics or processes, begin an enhanced investigation, and set out a practical and operational methodology to properly assess the cost of any noncompliance.

Variance and trust

As mentioned above, in case of potential risks (yellow/red flags), companies should conduct in-depth compliance due diligence, including screening documents and informal discussions with the target company’s employees to provide requested information and explanations. Such discussions are crucial for understanding the target company’s compliance framework and commitment to solving variance issues.

Variance in compliance programs can be attributed to geographic origins, corporate culture, organizational structure, industry sector, etc. Therefore, although “compliance” and “compliance program” are widely used as generic terms, there is a vast difference in how compliance programs and their restrictions are defined and implemented in different organizations. Comprehensive compliance due diligence should assure alignment on territory legal requirements and compliance terms while openly discussing differences in definitions, standards, etc.

Variance in compliance originates from the fact that although the principles are identical, different interpretations lead to different compliance programs. Variance may be caused by different industries and regulations, different geographical regions and territories, suppliers and service providers, and cultures.

A few examples to explain variance:

• Cultural/religious gifts of minimal value to customers or even government officials are allowed in some territories, while in some other countries, they are regarded as a bribe and are prohibited.

• Comparing codes of conduct of different industry organizations reveals vast variance in the dos and don’ts defined by each industry sector.

• Fair market value considerations for payments differ between industry sectors in the same territory and between territories due to the strength of each economy.

Many gaps that can be regarded as risks or discrepancies may be the consequence of variance in the interpretation of compliance. Only open discussions between the due diligence team and the compliance function in the target company can solve these issues, assuming the target company can provide a defensible, consistent approach based on reliable market-specific information. Furthermore, these discussions can promote trust between the parties, making integration smoother once the deal is completed.

Deal closing

Another important responsibility of the due diligence team is to estimate the cost of remedial actions. As in most deals, some gaps or discrepancies will be found. These should not be disregarded, but they are not always deal-breakers. Estimating the cost of remedial action is essential for the acquirer looking to properly understand the costs involved in integrating the target company. These costs must be considered as part of the total cost of the acquisition, particularly since implementing a compliance framework can be expensive. The total cost of bringing the compliance framework up to standard can be evaluated by assessment of:

• The target’s regulatory environment

• The maturity of the target’s compliance framework

• The size of the business

• Any specific risk

• The financial penalties or fines with the regulatory authority

Therefore, standard compliance representations and warranties of the target company should be included in the agreement:

• Material compliance with all applicable rules and regulations

• Not convicted nor pleaded guilty in any legal or regulatory proceedings

• Not aware of any ongoing investigation or enforcement action

• Not excluded or debarred or had any license or approval revoked

• Had not received a notice of violation of any rules or regulations

• Has timely submitted to the applicable authorities all mandatory required reports, data, or information

Identified compliance risks can impact the deal structure. Risks may need to be cured as a closing condition, or the cost of remediation may need to be deducted from the cost of the deal.

Lastly, after all risks have been identified during the due diligence process and the deal is signed, an action plan should be prepared to integrate the acquired company’s compliance program with the acquirer’s compliance program (the “day after” integration phase).

Conclusion

Due diligence is a crucial part of the M&A process. Involving the compliance team from the beginning of the due diligence assures that they conduct a full risk-based assessment ahead of any transaction to properly understand the current risks, noncompliance, and cost of the transaction. Taking into consideration the built-in variance in compliance is essential to ensure the assessment does not provide false results, as many red flags can be mitigated once explained. Open discussions between the due diligence team and the target company will streamline solving these issues. This approach prevents incurring unexpected remediation expenses post-acquisition; it reduces the risk of a regulatory authority uncovering issues for the target company, which could incur fines that significantly impact the return on investment. Furthermore, when compliance risks and discrepancies have not been adequately addressed, significant cost and effort are required to repair the company’s reputation and regain the confidence of the different stakeholders of the company, such as investors, clients, employees, regulatory authorities, etc.

The opinions expressed in this article are the author’s personal views and do not necessarily represent his employer.

Takeaways

• Compliance’s role in the mergers and acquisitions due diligence process is crucial for the business in uncovering discrepancies, risks, and deal-breakers.

• Although “compliance” and “compliance program” are widely used generic terms, there is a vast difference in how compliance programs and their restrictions are defined and implemented.

• Most compliance issues and risks can be overcome, but corrective actions and remediation costs must be assessed.

• Compliance due diligence cannot be performed successfully without open discussions and cooperation between the compliance teams of both parties.

• Assessing the compliance framework of the target company gives the acquirer increased visibility into the costs involved and allows them to maximize the return on investment with a clearer view of the risks.