The India arm of a US technology company operated, like many in its industry in India, through a web of subcontractors, vendors, and resellers, several of whom dealt with government-owned customers. Nothing had gone wrong, and the parent wanted its anti-corruption exposure examined while the review was still voluntary.
“Transactions were sampled and tested against the policies that were supposed to govern them.”
The review, carried out during my tenure at a global investigations firm, moved in phases. First, the existing framework: code of conduct, whistleblower channel, policies, and how they actually operated in the Indian entity. Then a risk assessment focused where, in my observation, FCPA risk in India concentrates: the touchpoints between the business, its intermediaries, and government entities. Process owners and third parties were interviewed; transactions were sampled and tested against the policies that supposedly governed them.
The deliverable was a risk-assessment matrix and a written report with remediation recommendations: a document built so the company could fix what it found, and could later show a regulator what it had found and fixed. An optional further phase, reviewing the third-party network itself, was scoped for the client to trigger if the findings warranted it.
In my observation, a voluntary review costs far less than investigating the same facts after a whistleblower or an auditor raises them, and it is far easier to explain to a regulator.