Answering the question of how much money a compliance and ethics program saves an organization when there’s been a violation is often a very difficult task, which presents a challenge in defending the investment in a program. We know a well-designed program can result in a reduction in fines and penalties. However, in large cases, there are often many other aggravating and mitigating factors that make isolating the effect of the program almost impossible.

Smaller, less complicated cases sometimes provide better examples, such as an Office of Foreign Assets Control (OFAC) sanctions case from August 16, 2023.^[1] In this case, a U.S. building materials company with a subsidiary based in the United Arab Emirates (UAE) violated OFAC sanctions on Iran. Two managers with the UAE subsidiary imported materials from the U.S. and then knowingly reexported them to Iran in violation of the company’s policies and sanctions regulations.

A third employee of the UAE subsidiary became suspicious and questioned the two managers about the transaction after inspecting some of the supporting documentation, at which he was dismissed by one of the two managers involved in the scheme.

The employee returned to the U.S. and reported their discovery to the headquarters office, which resulted in an internal review leading to termination of the Iran-related business activity and prompted a voluntary self-disclosure to OFAC.

Here’s where it gets interesting. OFAC determined that the maximum civil monetary penalty was $2.2 million, and the base civil monetary penalty would, therefore, be $1.1 million. The aggravating factors that would increase the penalty from the $1.1 million base were rather straightforward—that the violation was willfully committed by two members of senior management of the UAE subsidiary.

Mitigating factors were also pretty simple—mostly dealing with the company’s quick response and cooperation, but also that the company’s compliance program was “reasonably designed to comply with the restrictions in place.” While the fact that the company had appropriate policies and procedures in place that prohibit sanctions violations, let’s face it: the primary factor here was that (1) there was a reporting system in place that made the employee feel comfortable in escalating his concerns, and (2) the report was quickly followed up with an investigation and disciplinary action (both managers were terminated).

In the end, the amount the company was required to pay was $660,594. If the $1.1 million base penalty was first increased for the aggravating factors, I think it’s safe to say the proper functioning of the reporting system—including investigating and disciplinary action—resulted in savings of somewhere between $500,000 and $1 million. That seems like a very sound investment in compliance.