FCPA Compliance Monitors: Who Checks Whether the Fix Worked?

An FCPA compliance monitor independently tests whether a company’s controls can detect and prevent the misconduct behind its resolution. For a resolution under the Foreign Corrupt Practices Act, the agreement or order sets the work, reporting duties and conditions for completion. For someone inside the business, the useful question is whether the payment practices changed along with the policies. You may see the distributor invoices, approval exceptions or internal reports that tell a different story from the company’s account of its reforms.

The Securities and Exchange Commission’s order against Fresenius Medical Care shows why that question matters. The agency described alleged bribes that moved from consulting payments into a supplier’s fees, then into a distributor’s sales margin. The expense changed shape while the payments continued. A review confined to the old expense account could miss the new arrangement entirely.

Who Can Review the Company’s Reforms?

Fresenius’s civil SEC order required a monitor with anti-corruption expertise, experience reviewing compliance programs and enough independence to perform the assignment impartially. It also restricted professional relationships between the monitor and the company during the engagement and afterward.

The order made management’s commitment part of the monitor’s work. That matters when the people approving payments are also the people describing the reforms: a new manual tells the reviewer what should happen, while transactions and employee accounts show what does happen.

What a Monitor Tests Beyond the Compliance Manual

A monitor tests how controls operate through records, site visits, interviews and transactions. In its corrected March 2019 order, the SEC required the Fresenius monitor to examine accounting controls, recordkeeping, financial reporting and management’s commitment to compliance. The work plan called for observation at selected sites and interviews with employees and, where appropriate and feasible, outside vendors, agents and consultants.

Fresenius supplies dialysis products and services. The SEC alleged that the company used sham consulting agreements to pay public hospital executives in Gabon, then paid an outside supplier to pass money to those executives and other healthcare professionals. Later, the supplier became a purported distributor and received a large sales margin to fund the payments. Fresenius continued paying to deliver the products to customers, a fact the SEC identified among the warning signs about the distributor’s supposed role.

That is where industry knowledge earns its place in the review. Who delivered the dialysis kits, who invoiced the hospital and what the distributor actually did all bear on the payment. The fee disappeared. The money didn’t. The contracts, invoices and approval records connect the changed description to the underlying business.

A 2022 case study in the Journal of Forensic and Investigative Accounting follows the problem across Fresenius’s operations. It describes subsequent reforms involving global and local compliance officers, third-party principles, training and internal review. The study connects those reforms to the different ways payments had passed through the business: doctors’ arrangements, distributors, joint ventures and other intermediaries. A health care compliance review has to reach those commercial relationships.

The SEC order gave the monitor authority to use sampling and testing rather than review every transaction in every market. The company had to cooperate with requests for access within the monitor’s mandate. The order also distinguished understanding the past violations from conducting a new investigation of those historical events. The assignment was to assess ongoing controls and recommend improvements. An employee who knows which transactions fall outside the sample may therefore bring information that a polished compliance presentation leaves out.

Company Reporting and Monitor Reporting Are Separate Duties

A company can owe reports directly to the government while a monitor has a separate duty to report what it finds. Fresenius’s SEC order required the company to report credible evidence or allegations of corrupt payments, false records or inadequate accounting controls promptly to SEC staff. Telling the monitor did not discharge that company obligation.

The same order required the monitor to disclose credible evidence of corrupt or otherwise suspicious transactions and related false records to SEC staff. The monitor also had to assess the company’s response to improper activities. That reaches beyond whether someone logged the concern: the response itself becomes part of the review.

For an employee who already raised a concern, we assess the internal reporting history and its timing with them. We connect what the company heard and what it did with the evidence that may support the employee’s whistleblower award claim.

How Monitoring Ends or Becomes Company Reporting

Completion depends on the order’s requirements and the government’s decision about compliance. Fresenius’s SEC order provided for a monitor engagement of at least 24 months, subject to early termination or extension. It required an initial review and follow-up reviews that examined both the controls and implementation of the monitor’s recommendations.

For certification, the monitor had to assess whether the program could detect and prevent violations of the Foreign Corrupt Practices Act and other anti-corruption laws and was functioning effectively. The company separately had to certify implementation of the recommendations or accepted alternatives. SEC staff decided unresolved disputes over recommendations. Once SEC staff approved those certifications, the order allowed a transition to company self-reporting for the remaining term.

A replacement policy can be issued while the same intermediary continues receiving the same money under a different description. For an insider who knows that happened, the certification and the transaction records address the same question from opposite ends.

When the Report Loses the Problem

An internal report can reach the company without the underlying concern getting investigated. The SEC’s Walmart order alleged that an anonymous email identified improper permitting payments in India and a senior legal employee’s knowledge of the scheme. An executive requested an investigation, but Walmart did not conduct an inquiry at that time. The Justice Department’s September 2024 compliance evaluation asks whether a company tests its reporting process from beginning to end. That question reaches the gap the SEC described.

Walmart’s June 2019 filing reported more than $900 million over seven years for inquiries, investigations, global compliance and organizational enhancements. We see the absurdity: an internal warning went uninvestigated, and the company later described an enormous bill for investigating and fixing its compliance failures.

Och-Ziff shows a more direct intervention in the written record. In its civil administrative order, the SEC alleged that a review of a business partner’s expenses revealed payments benefiting government officials and prompted a call for investigation:

The concern disappeared from the report before anyone resolved it. Problem solved. On paper. A person who saw the earlier draft knows something a reviewer relying on the final version would miss. The SEC’s monitoring mandate for Och-Ziff reached management’s commitment and the effectiveness of its controls, bringing the company’s handling of such information into the oversight question.

Reporting failures can continue after an agreement. The factual basis for breach accompanying Ericsson’s 2023 criminal plea agreement identifies the company’s delayed disclosures affecting investigations in China and Djibouti and failures involving Iraq-related information. The documents withheld, the people who knew about them and the account eventually given to investigators are facts an insider can recognize. They connect a promise to cooperate with what the company actually disclosed.

Why the Insider’s Information Still Matters

Whistleblower incentives can affect company behavior beyond the work of a compliance department. The 2019 working paper Do Corporate Whistleblower Laws Deter Accounting Fraud?, hosted by MIT Sloan, studied companies exposed to state False Claims Acts through state pension fund ownership. It found a 5% to 9% reduction in the likelihood of accounting fraud after exposure to those laws.

Under the separate False Claims Act, a whistleblower case can pay 15% to 30% of what the government recovers. For an insider with foreign-bribery evidence, we assess SEC whistleblower award possibilities alongside what the information adds to the case. The company’s compliance report does not tell us everything its employees know.

When You Know What the Review Missed

If the compliance report says the problem is fixed and you still see the payments, speak with our whistleblower experts about the gap. We work with you to connect the transactions, the warnings and the decisions about what reached the government. We stay beside you through the whole journey and bring in FCPA whistleblower lawyers who understand corporate reporting failures to build your strongest case.