What Every Multinational Company Needs to Know About…Implementing an International Compliance Program (Part III)
A Publication in Foley’s International Trade, Enforcement & Compliance series.
We have received several requests for a list of the compliance policies that make sense for every multinational company. So, as a follow-up to our earlier two posts providing “twelve steps to international compliance” (see here and here), we thought we would add Part III, covering the core compliance policies that we commonly see at multinational companies.
The suggestions here are just that: suggestions. As we have written in several posts, the guiding star for compliance is to identify the particular regulatory risks arising at the organization and to use the company’s scarce compliance resources to address those identified risks. Thus, the appropriate compliance policies at one multinational may differ appreciably from those at another company, depending on such factors as the products sold, the type of supply chain, the countries of operation and sales, the company’s industry and customer base, whether the goods are controlled, the company’s method of operating, and so forth. Because compliance is an exercise in identifying, managing, and mitigating risk, there really is no substitute for conducting a thorough risk assessment to determine the key compliance concerns, which in turn will dictate what types of compliance policies and supporting internal controls make sense for a given organization.
It is never satisfying to answer a question such as “which compliance policies should we have?” with the answer of “well, it depends.” It also is helpful when assessing risk to understand the most common areas where multinational companies, as a general matter, tend to find risk. In our experience, most multinational companies divide compliance controls into the following areas:
- A code of ethics, which provides the overall aspirational goals of the organization and its core compliance commitments.
- A vendor’s code of conduct, which provides the expectations and compliance expectations for suppliers to the company. Consistent with the focus of the U.S. government on supply chain integrity, companies that procure from offshore sources are increasingly making compliance with the vendor’s code of conduct a contractual requirement.
- A set of core compliance policies, in the range of 18–22 core policies, addressing in greater detail the higher-risk legal regimes and the company’s expectations and requirements to address these regulatory risks.
- A set of implementing internal controls or standard operating procedures, designed to implement and systematize the application of the core internal controls.
The following are common “core compliance policies” that multinational companies should at least consider implementing, after taking into account their regulatory risk profile:
Common Core Policies
- Accuracy in Accounting Records/Books and Records Integrity
- Antiretaliation
- Antiharassment
- Antiboycott (for companies with significant dealings in the Middle East)
- Anticorruption/Foreign Corrupt Practices Act
- Antitrust/Competition
- Conflict of Interest
- Copyright & Trademark Integrity
- Customs & Import Matters
- Cybersecurity and Data Protection
- Data Protection & Privacy/GDPR
- Document Retention/Litigation Holds
- Economic Sanctions/Export Controls, which may each merit their own policies if the company deals with controlled dual-use goods or defense articles or controlled technical data.
- Email/Social Media
- Equal Employment /Antidiscrimination
- Family and Medical Leave/Disability
- Forced Labor & Human Trafficking/Uyghur Forced Labor Prevention Act
- Health, Safety & Environmental Compliance
- Insider Trading
- Internal Investigation/Dealing with Government Investigators (Dawn Raids)
- Labeling/Truth-In-Advertising/Made-in-USA Requirements
- Misuse of Company Assets
- Political Contributions and Lobbying
- Record Retention/Record Information Management
Here are some additional policies that may make sense to implement, depending upon the organization’s method of doing business and risk profile:
Policies to Consider
- Accident Reporting
- Acceptable Use of Computers and Resources/Misuse of Company Assets
- Anti-money Laundering (a core policy for many financial institutions)
- Drug and Alcohol Free Workplace
- Distracted Driving
- Environmental Reporting
- Gifts & Business Entertainment (a core policy for companies that operate in higher-risk jurisdictions or that frequently have dealings with government officials)
- Intellectual Property (proprietary information/assign inventions)
- Integrity & Transparency
- Manufacturing and Supply Quality
- Personal and Company-provided Portable Communication Devices
- Product Safety/NHTSA
- Recall Procedures
- Recordkeeping
- Shipping of Toxic Substances (HAZMAT)
- Substance Abuse/Drug Testing
- Technical, Business and Financial Records
- Theft/Misuse of Proprietary Information
- Use of Communication and Computer Systems
- Wages and Hours
- Weapons in the Workplace
- Workplace Safety and Health/Workplace Violence
While the compliance policies that make sense for any particular multinational company vary based on company specific risks such as the industry, locations of operation, supply chain, use of third-party intermediaries, and types of goods sold, , the lists above provide a good starting point for consideration. The simple exercise of gathering all available compliance policies, internal controls, and standard operating procedures, and evaluating whether there are obvious gaps and unaddressed regulatory risks, is an exercise that can readily reveal regulatory risk management gaps.
If you would like to be added to see similar biweekly updates on “What Every Multinational Should Know” about operating in today’s complicated international trade world, as well as our biweekly recent developments updates, please sign up for our biweekly email list. Click Here To Register.