Compliance, Van Halen and Brown M&M’s

You may have heard the story about Van Halen’s banning of brown M&M’s from its dressing room. I chalked it up to the pampered life of rock stars. (Especially, when compared to the more mundane life of a chief compliance officer.)

I just listened to the latest episode of  This American Life which revealed that the provision was not about pampering. It was about compliance.  Host Ira Glass talked with John Flansburgh (from the band They Might Be Giants) and he explained why the M&M clause was actually an ingenious business strategy. They recounted an except from David Lee Roth’s autobiography, Crazy from the Heat:

Van Halen was the first band to take huge productions into tertiary, third-level markets. We’d pull up with nine eighteen-wheeler trucks, full of gear, where the standard was three trucks, max. And there were many, many technical errors — whether it was the girders couldn’t support the weight, or the flooring would sink in, or the doors weren’t big enough to move the gear through.The contract rider read like a version of the Chinese Yellow Pages because there was so much equipment, and so many human beings to make it function. So just as a little test, in the technical aspect of the rider, it would say “Article 148: There will be fifteen amperage voltage sockets at twenty-foot spaces, evenly, providing nineteen amperes . . .” This kind of thing. And article number 126, in the middle of nowhere, was: “There will be no brown M&M’s in the backstage area, upon pain of forfeiture of the show, with full compensation.”

So, when I would walk backstage, if I saw a brown M&M in that bowl . . . well, line-check the entire production. Guaranteed you’re going to arrive at a technical error. They didn’t read the contract. Guaranteed you’d run into a problem. Sometimes it would threaten to just destroy the whole show. Something like, literally, life-threatening.

Van Halen used the candy as a warning flag for an indication that something may be wrong. I see some lessons to be learned.

Update:

Diamond Dave talking about Brown M&Ms.

Brown M&Ms from Van Halen on Vimeo.

(via NPR Music’s The Record: The Truth About Van Halen And Those Brown M&Ms by Jacob Ganz

References:

To Lead, Create a Shared Vision

Harvard business review january 2009

In the January 2009 issue of the Harvard Business Review is a short Forethought piece on the importance of leaders creating vision: To Lead, Create a Shared Vision.

James M. Kouzes and Barry Z. Posner emphasize the important of leaders creating vision for their organization and develop a forward-looking capacity. But rather than leaders thinking that they themselves need to be the visionary, the authors think it is more important to get input from the people in your organization to develop the vision.

Too many leaders act as “emissaries from the future, delivering the news of how their markets and organizations will be transformed.” Instead, “constituents want visions of the future that reflect their own aspirations. They want to hear how their dreams will come true and their hopes will be fulfilled.” The best way to lead people into the future is to connect with them in the present.

What does this mean for compliance?

When putting together and maintaining your compliance program, you need to seek input from as many people as possible. It is too late to get buy-in after the policy is already drafted. Send early drafts to a wide population of the organization for review and comment. They may surprise you by pointing out weaknesses and ambiguity in the policy draft.

By sending drafts, you also emphasize the importance of the policy and its existence.  Many studies have shown that people need to be exposed to a policy several times before they can even remember that it exists. Circulating drafts can accomplish some of that information awareness.

CCOutreach

sec-seal

The SEC formed the CCOutreach (yes, that is how they spell it) to promote open communications and coordination among securities regulators and the industry on mutual fund, investment adviser, and broker-dealer compliance issues. In addition to the national seminar in November of each year, they host regional seminars to enable Chief Compliance Officers to interact with the staff from their local SEC office. I attended the Boston Regional CCOutreach seminar. These are my notes:

To start off, there was the usual SEC disclaimer: The Securities and Exchange Commission, as a matter of policy, disclaims responsibility for any private publication or statement by any of its staff. The views expressed by the staff in these written materials are those of the staff and do not necessarily reflect the views of the Commission or of other Commission staff.

The presentations started off with some interesting statistics (as of 12/31/2008):

  • 11,292 Registered Investment Advisers
  • 1,521 exams of investment advisers in 2008
    • 64% resulted in deficiency letters
    • 4% resulted in enforcement referral
  • 1,082 Registered Investment Companies
  • 219 exams of investment companies in 2008
    • 67% resulted in a deficiency letter
    • 5% resulted in enforcement referral

Rulemaking

The presentation continued by highlighting some of the current rulemakings in process: the amendments to Form N-1A, the principal trading rule, and amendments to Part 2 of Form ADV. They also noted two rulemakings that should be popping up soon. First is a proposed regulation on money market funds. This is largely in reaction to the issues with those types of funds last fall.The second is a likely rule making on pay to play issues.

Enforcement

The presentation moved on to three types of current enforcement actions, with recent enforcement cases as examples.

The first type is prominent fraud cases, using the SEC v. Robert Brown case as an example. This was a classic Ponzi scheme. The promoter promised astronomical returns, but really used the money to pay off early investors and to pamper himself. When confronted by investors, he claimed the delay in returning the money was due to the Patriot Act.

The second type is compliance failure cases, using the SEC v. Locke Capital case as an example. In this case, the adviser had less than $175 million, but claimed to have over $1 billion under management in order to gain credibility and attract legitimate investors.

The third type is prominent fund failure cases, using the Evergreen case as an example. Evergreen had a fund experiencing some gyrations due to its mortgage-backed securities holdings. The company put together some talking points for investors who called to complain or called with questions. That resulted in selective disclosure of a material piece of information. There were also issues related to failures in their valuation methods.

Fiduciary Duty

The presentation turned to fiduciary issues. A particular issue was how clients got out of positions. This is a reverse of  IPO investigations by the SEC. With IPOs, the SEC investigated whether some clients got preferred access to IPOs and how allocations of IPO shares were made to clients. With the all of the illiquidity in the market, the SEC is now focused on who was able to get out of those illiquid positions and whether some clients got preferred access to the exit.

There was some discussion of the Hennessee case where the SEC brought action for an investment adviser failing to conduct diligence. There seemed to be some split on the panel. Some saw the case as a failure of fiduciary duty. Others thought it was merely a failure to do what the firm advertised it did (subject investments to a vigorous due diligence review).

The presentation moved to what the SEC is looking at during a review. They emphasized that the first step is reviewing the marketing materials and disclosure documents. The SEC wants to understand the company’s business model before the review. They don’t do a cookie cutter review, but a customized review tailored to the company’s business model. The next step is looking at the deficiency letters, their recommendations and what the company has done in response. (You have a target on your back if you have a deficiency and have not done anything in response.)

The panel turned to companies with dual registrations. If you are wearing two hats, you have a heightened level of disclosure. The SEC does not want to regulate the business model, but they do want to make sure you are fair and equitable. Dual registration is commonplace and clients are comfortable with it. But conflicts seem unavoidable, so there is a heightened need for compliance and disclosure.

The focus shifted to proxy voting and the issues associated with it. The panel highlighted the Intech case where the company was subject to a proceeding for failing to sufficiently describe its proxy voting policies and procedures and failing to address a material potential conflict of interest. Intech decided to vote in accordance with AFL-CIO-based proxy voting recommendations for all clients’ securities at a time it was currying favor with the union for more investment business. The panel had a general consensus that it was not wrong to follow a voting model as long as it is fully disclosed.  The panel was split on whether Intech could have disclosed their way out the problem. Some panelists thought the conflict was too much.

Deficiencies

Things turned to problems and how a problem can morph from a disclosure to a deficiency to an enforcement. One of the panelists rattled off a list of factors:

  • Were there deficiency letters?
  • Did you fix the deficiency?
  • Did people raise issues and you ignore them?
  • How long was the problem going on?
  • Were clients harmed?
  • Was it intentional or inadvertent?
  • How far off was the disclosure?
  • Did the firm profit from the problem?

“There is a difference between candid disclosure and clever disclosure.”

Portfolio Management

In the area of portfolio management the SEC found found these to be the most common deficient practices:

  • Failure to adopt or maintain policies and procedures relating to its investment decision-making
  • Failure to maintain required books and records to corroborate investment decisions
  • Failure to disclose all conflicts of interest

In the current market turmoil “drift” is a hot topic. The panel focused on inadvertent drift versus intentional drift. Intentional drift is bad, putting clients into investments that do match up with their investment needs. The panelists acknowledged that this is a tough area. The key is to focus on the goal at the time of purchase of the investment. Then there needs to be a periodic review. Drift review is also difficult. You need to document specific requests by the client and update the investment objectives of the client.

Service Providers

Compliance officers need to review service providers since they are a risk factor according to the panel. In particular, you need to be attentive  to the existence of kickbacks or soft dollars. They panel went so far as to recommend running searches against email traffic for the possibility of communications about kickbacks. Another red flag for the SEC is frequently changing service providers.

Safeguarding Client Assets

The centerpiece for this part of the discussion was the new custody rule that has been published for comment: SEC Releases Proposed Custody Rules for Investment Advisers. The SEC plans to go directly to clients, custodian, counter-parties, and other third parties without notifying the investment adviser. They are expecting a custodian review to be a lengthy, time-consuming process. The surprise review must a surprise and must be a review of 100% of the assets. Sampling will not be permitted. The auditor must also be truly independent. They are going to look towards Regulation S-X for the definition of “independent.”

Performance Claims

It sounds like the SEC is going to look closely at performance claims, both for fraud in the claim itself and for the claim as an indication of underlying fraud. (Like Madoff‘s performance claims.)

The panel indicated an intent to look closely at how the performance numbers are calculated. A particular hot button is how illiquid and hard-to-value assets are included in the performance calculations. The SEC plans to run some forensics to see if there was some smoothing in the performance and whether the performance was too consistent or too good given the underlying assets in the portfolio.

In addition to the performance numbers themselves, the SEC is going to look closely at the disclosure wrapped around the performance claims. They want to make sure the disclosure and qualifications are consistent.

They are also going expect records to be kept to back up the performance claims. If you are claiming 20 years worth of results, you need to keep 20 years worth of records.

They emphasized the need to separate the valuation team from the portfolio management and marketing teams to get as much independence as possible. Using a third party custodian to value assets is probably acceptable, assuming there is no fraud or improper influences on the custodian.

Post-Mortem

The program was good and worth your time if you are a compliance officer for an Investment Adviser or Investment Company. I attended because I thought it best to meet and talk with people when you are in the position to offer them some help instead of needing them to help you. It seems that Congress wants the SEC to regulate private investment funds.

In the interest of full disclosure, the SEC gave out an inexpensive pen and a magnet with with SEC seal to attendees. I don’t think these “gifts” have influenced my decision-making about the SEC.

Materials:

Principles of Federal Prosecution of Business Organizations

doj

At last week’s Compliance Week Conference, I saw a paradigm shift in thinking about the factors to be included in a compliance program. Most compliance programs have placed a lot of emphasis on the federal sentencing guidelines. After all, those guidelines give credit for having an effective compliance program. So you want to have an effective compliance program.

But by definition, the sentencing guidelines are only useful once the organization has been indicted and convicted with a crime. We are better off preventing the organization from being indicted in the first place. So, perhaps we are better off looking at the Principles of Federal Prosecution of Business Organizations (.pdf) from the Department of Justice.

The Principles are more nuanced than the Sentencing Guidelines. They take into account the issues of prosecutorial discretion. In contrast, the Sentencing Guidelines are a compromise between prosecutors, the defense bar and the judicial bench.

Wrap Up of Compliance Week Conference

compliance-week-conference

It was a great few days in Washington D.C. at my first Compliance Week Conference.  The conference was packed with great presentations and discussions over its three days. In particular, it was great to spend time with Bruce Carton, Francine McKenna, Scott Cohen, Matty Kelly and Alex Howard.

Below are links to some stories from the conference:

For Compliance Week subscribers:

Fighting a cold during the conference, I was the guy generating the cacophony of coughs.  But I did manage to keep notes during the sessions I attended:

I am looking forward to Compliance Week 2010.

UPDATED with new links

Conversation with Harvey Pitt

compliance-week-red

This was another “dark session” with about 30 compliance professionals sitting down for an informal discussion with former SEC Chairman Harvey Pitt. I am not going to share detailed notes, just some general issues that were discussed, with no attribution to any individual.

Compliance is really about non-compliance. The only reason compliance is relevant is because someone was non-compliant. The government usually comes in and looks at your compliance program at the opposite end that the organization looks at compliance.

It is better to build a relationship with the SEC before you need something. If you show when you have a problem, you waited too long. The SEC has learned not to tell you that something is not a problem.

It is important to see what is being said about your company, even a “blog written by an imbecile,” to see what is out there. If something is harmful, you need to decide whether to react. The SEC has people who troll the internet looking for information. They certainly will troll for information once they open an investigation.

There was concern about how an already understaffed SEC will be able to regulate an additional 8,000+ companies if hedge funds are going to be regulated by the SEC.

Your Compliance Program and Enforcement

compliance-week-dark-blue

This session at Compliance Week Conference 2009 was another “dark session” so I am not sharing detailed notes, merely a perspective on some issues that were presented. John Roth, an Assistant U.S. Attorney in the Fraud and Corruption Section shared his insights and Bruce Carton did his best Phil Donahue impression by eliciting questions from the audience.

There was a big turnout for this session. The organizers were only expecting 20-30 and ended up with over 100. Anything said by Mr. Roth was his opinion alone and not necessarily those of his office or the Attorney General.

One item was the difference between the Principles of Prosecution in the U.S. Attorney General’s Handbook and the Federal Sentencing Guidelines. The Guidelines only come into play once the organization has been indicted and convicted. The Principles of Prosecution help the Attorney General’s Office decide whether to prosecute in the first place. The Guidelines are a product of compromise between the Attorney General, the defense bar and federal judges. At this point they have also been made discretionary instead of mandatory. It seems that compliance programs should be more focused on the Principles of Prosecution instead of the Federal Sentencing Guidelines.

There was much discussion that it is much easier to identify a bad compliance program (or no compliance program) than a good compliance program. Much of the learning comes from failures of compliance programs instead of the successes.

Prosecution success causes more prosecution in those areas. FCPA prosecutions are increasing because they are being successful. We can expect to see more. The were rumors that the FBI has formed a squad to focus on FCPA criminal investigations.

Compliance Week Keynote from David Ogden

compliance-week-sepia
My notes, live, from the keynote address by David Ogden, the Deputy Attorney General.

As we confront the current financial crisis and try to restore trust and accountability, we have a shared responsibility to make sure justice is done. Responsible corporate behavior must be encouraged and rewarded. There will continue to enforcement action on financial crimes.

The FBI has doubled the number of investigators looking into mortgage fraud. There is also going to be an emphasis on healthcare fraud. They are looking to get better access to financial records and information in the healthcare industry.

With the $4 trillion of TALF funds, there is a potential for fraud in procurement and the use of those funds. (It sounds like there will be a lot of investigations into the recovery efforts.)

The DOJ needs to be relentless in its enforcement activity. They need to ensure the integrity of the financial markets and preserve the public fisc.

He pointed out an emphasis on training the department attorneys on discovery and electronic records.

The new principles that are part of the DOJ handbook emphasizes the importance of the attorney-client privilege. Cooperation is based on sharing information. No longer is waiver of the privilege a requirement to get cooperation credit. Prosecutors may not request that a company deny advancement of attorney fees or hiring attorneys to defend individuals involved in wrong-doing.

(These notes are taken live, so I apologize if I left out anything or misquoted someone. Please forgive any typos or grammatical errors.)

Structuring Internal Investigations

compliance-week-dark-blue

My notes, live, from the presentation by Neal Stephens and Bill Freeman of Cooley Godward Kronish on the top ten problems and how to avoid them. The focus of the session was to help companies who must conduct an internal investigation avoid pitfalls that add expense, embarrassment and exposure.

There are many problems that come from internal investigation failures. Cost is a big item. Expenses can get out of control. You could end up with a loss of credibility with the public and the government. You want to avoid re-opening the investigation in response to shareholder attacks.

Failing to Establish the Right Investigative Body

You want to make the investigator is sufficiently independent and has the necessary powers. If it is serious, you will want an impartial committee from the board of directors. For an independent investigation, you may need to pick a new law firm. If the law firm has represented other board members or been involved in the subject transaction, you should not use them.

Failing to Preserve Evidence

You have to immediately notify record custodians. Often the document destruction ends up being a greater offense the original transgression. It is important to document the entire preservation and collection process. The SEC will typically send you a preservation notice before they send a subpoena.

Don’t forget about home computers and mobile devices. If people are doing business on their home computer, you need to preserve the information on them.

Failing to Get Buy-In from the Government and Outside Auditors

You want to make sure the people with the handcuffs agree to the scope, methods, timing and the sharing of information.  You want to make sure you do not have to go back and cover the same information again. That increases costs.

Failing to Supervise Vendors

You want to train your document reviewers. You have to educate the investigators about legal means of obtaining information. Vendors need to be educate on what to reveal to who. Messing up document review is embarrassing and can taint the case as a whole.

Treating Witnesses Differently

Consistency is very important. You can’t treat one group with kid gloves and another with rubber hoses. The way to protect the company is letting the evidence to take you where it goes rather than presuming innocence of a party.

Jumping to Conclusions

You have to follow the evidence. You need to understand the company policies and practices at issue. Consider placing employee on leave during the investigation, instead of termination. The DOJ typically does not care that much. They want you to find the facts and properly punish the offender. You do not have to give the government a head on the platter to appease them. Just do the investigation right.

Mishandling Privilege Issues

You need to advise witnesses of their legal rights. Make sure they realize that the attorney represents the company and may turn the information over to the government. You need to anticipate third party challenges to information shared with the government or auditors.

Give the corporate Miranda. Employees typically still talk to investigators. But you don’t want them to think that the attorney represents the employee.

Mishandling the Flow of Information

Always update the board committee first. Get their approval before revealing information to the government, auditors or senior management.

Failing to Anticipate the Mid-Investigation “Show Stopper”

Something else always pops up or evidence of a cover up appears. At some point a witness realizes they are in trouble and will withhold information. You are also likely to see witness intimidation or collusion.

Failing to Communicate Carefully to Outsiders

Statements in 8K’s will be attacked. Statements to opposing counsel must be considered “on the record.” Statements to the government must be complete and accurate.

Much of the conversation was couched in how these two had just defended Kent Roberts, the former general counsel of McAfee in a stock back-dating case. It was a useful combination of practical advice, war stories, and theory.

(These notes are taken live, so I apologize if I left out anything or misquoted someone. Please forgive any typos or grammatical errors.)

Third Party Risks

compliance-week-red

My notes, live, from Third Party Risks with Matt Tanzer of Tyco International and Chris Nowak of Wyndham Worldwide.

For Tyco they have 110,000 employees around the world, most outside the United States.  Their first step was to identify all of the third parties. This was a big task. They went to their master vendor lists and master customer lists. The the broke them into groups based on risks.

Then they conducted a preliminary risk assessment using a few factors, such as geography, types of payments and payment structure.  With all of that information they took the next step of rationalization and consolidation of the third parties. In higher risk areas, they want to reduce the number of third parties they work with. They will conduct enhanced due diligence on high risk third parties.

They have imposed stricter payment procedures. They require a valid tax invoice, wire transfers (no cash), and only to the actual service provider. It is key to look at the underlying contract to verify the payment amount and type of service.

They have a new program for new vendors:

  • Business Sponsor
  • Business Justification
  • FCPA Certification
  • Questionnaire
  • Risk Assessment/DD
  • Written Agreements
  • Training

Not all elements are required for all third parties. If it is a low-risk type of vendor in a low risk country, they will not require all. High risk parties in high risk parties get an enhanced look.

Chris took over to give his perspective. His company is dealing with land owners, hotel owners, time share owners and employees around the world.

Know your third party:

  • Screen the parties against the OFAC’s SDN list
  • Conduct reviews of their financial statements
  • Learn their reputation
  • Investigate litigation
  • Check for current licenses
  • Understand their Culture

Chris offered some mitigation techniques:

  • SAS 70 Certifications
  • Code of Conduct – The are putting together a code specifically for vendors
  • Other Policies – You want to make sure you understand local law
  • Good Behavior Certification – Failure to certify is a warning sign.
  • Training – You need face to face training to get attention, especially as you move up in corporate seniority
  • Contract language
  • Insurance
  • Stay Involved!!! You need to keep emphasizing the importance of good behavior.

Make sure that the questions you ask are questions that you are also willing to answer. Simply things to make sure you could certify if someone asked you.

(These notes are taken live, so I apologize if I left out anything or misquoted someone. Please forgive any typos or grammatical errors.)