Fraud Tip Friday! Lessons Learned from the John Deere Case

The recent John Deere FCPA violation case offers a valuable lesson in the risks of weak internal controls, inadequate compliance integration, and a lack of board oversight. Between 2017 and 2020, John Deere’s subsidiary, Wirtgen Thailand, engaged in a series of bribery schemes to secure contracts with the Thai government.

The company disguised these improper payments as legitimate business expenses, violating the Foreign Corrupt Practices Act (FCPA). Meanwhile, the DOJ’s 2024 Evaluation of Corporate Compliance Programs (ECCP) provides a framework for how companies can avoid such pitfalls by focusing on internal controls, a strong compliance culture, and effective governance.

This writing delves into critical lessons from the John Deere case, offering actionable insights on how companies can strengthen their compliance programs, prevent misconduct, and enhance board oversight.

Internal Control Failures: The Crux of John Deere’s FCPA Violations

Ineffective internal controls at Wirtgen Thailand were at the heart of John Deere’s failure. Internal controls are essential to any organization because they provide the checks and balances necessary to ensure that a company’s financial reporting is accurate, its operations are efficient, and it complies with laws and regulations.

In John Deere’s case, several control weaknesses stood out:

1. Falsified Expense Reports: Wirtgen Thailand executives regularly submitted expense reports that disguised bribes as legitimate business activities such as entertainment and travel. These reports lacked the necessary documentation to prove their legitimacy. Strong internal controls should have flagged these expenses, especially in high-risk regions like Thailand. This misconduct might have been detected earlier if the company had policies requiring more detailed justifications for expenses.

2. Lack of Segregation of Duties: One of the core principles of internal control is ensuring that no single individual has control over all aspects of a financial transaction. In this case, senior managers at Wirtgen Thailand could approve, process, and record transactions without oversight. This breakdown in control made it easier for managers to falsify reports and authorize improper payments without scrutiny. Had John Deere enforced stricter segregation of duties, this concentration of power could have been prevented and the risk of fraud reduced.

3. Post-Acquisition Integration Failures: When John Deere acquired Wirtgen Group in 2017, it failed to conduct a comprehensive post-acquisition audit to assess the compliance risks of its new subsidiary. Effective internal controls require that the new entity be integrated into the parent company’s compliance framework after an acquisition. This involves conducting risk assessments, training employees, and implementing consistent policies and procedures. John Deere’s lack of action in this area allowed Wirtgen Thailand to operate under inadequate controls, leading to repeated violations of the FCPA.

In this context, my definition of internal control is especially relevant. I describe internal control as “a process of interlocking activities that use properly designed policies and procedures” to achieve organizational objectives. These interlocking activities ensure that risks—like those posed by Wirtgen Thailand’s operations—are mitigated through preventive, detective, and corrective actions.

Strengthening Internal Controls: Key Steps

Given the breakdown in John Deere’s internal controls, several lessons can be learned for other organizations to strengthen their systems.

Before any remediation conduct a root cause analysis! Root Cause Analysis is NOT a best practice; it is expected that companies will do so when they remediate in the aftermath of violations.

1. Implement Rigorous Financial Controls: Strong financial controls are critical for preventing fraud and misconduct. Every transaction, especially in high-risk regions or industries, should be subject to scrutiny. For example, dual-approval systems—where a manager and a compliance officer review significant financial transactions—could have prevented Wirtgen Thailand’s fraudulent expense approvals. This practice helps ensure that no individual has unchecked authority, reducing the risk of fraud.

2. Enforce Segregation of Duties: Segregating duties is essential in preventing fraud. This means that no single person should be responsible for approving, processing, and recording financial transactions. At Wirtgen Thailand, the absence of this control allowed managers to bypass oversight. Effective companies ensure that separate individuals or departments handle different stages of a financial transaction, creating a system of checks and balances that minimizes fraud risk.

3. Conduct Post-Acquisition Audits: A thorough compliance audit should be one of the first steps when acquiring a new entity. This includes reviewing the target company’s financial practices, compliance history, and overall risk profile. By conducting a post-acquisition audit, companies can identify any areas of weakness and ensure the newly acquired entity is aligned with the parent company’s compliance protocols.

4. Strengthen Expense Monitoring: Organizations must enforce strict rules around expense reporting, particularly for travel, entertainment, and gifts. These types of expenses are often used to conceal bribes, as seen in the John Deere case. Expense reports should require detailed documentation, such as receipts, explanations of business purpose, and, where applicable, written approval from higher management. Automated expense-tracking tools can also help flag suspicious transactions for further review.

These steps are critical for preventing fraud and creating a transparent financial environment that promotes accountability and ethical behavior.

Building a Strong Organizational Culture of Compliance

While internal controls are vital, they are only as effective as the organizational culture that supports them. In the John Deere case, the culture at Wirtgen Thailand was one where unethical behavior was tolerated or ignored. This allowed bribery to become normalized, resulting in repeated FCPA violations. Building a strong culture of compliance starts with ethical leadership and permeates throughout the entire organization.

1. Promote Ethical Leadership: Leadership is the cornerstone of any compliance program. When senior leaders are committed to ethical behavior, they set the tone for the rest of the organization. In companies with robust compliance cultures, leaders regularly communicate the importance of integrity and compliance, ensuring these values are embedded in daily operations. John Deere’s failure to embed these values at Wirtgen Thailand allowed misconduct to thrive.

2. Encourage Open Communication: Employees must feel empowered to report unethical behavior without fear of retaliation. In many organizations, fear of reprisal prevents employees from speaking up. To counter this, companies must implement whistleblower protections and provide employees with multiple avenues to report concerns, such as anonymous hotlines or reporting portals. In the John Deere case, employees might have reported the misconduct sooner if such mechanisms were in place and actively promoted.

3. Continuous Training and Communication: Regular compliance and ethical behavior training is essential, especially for employees operating in high-risk regions or industries. Training should go beyond legal requirements and focus on practical scenarios employees may encounter. By educating employees on the red flags of bribery, conflicts of interest, and other forms of misconduct, companies create a more informed and vigilant workforce.

A compliance culture doesn’t just happen—it’s actively cultivated. Organizations that invest in training, open communication, and ethical leadership are better equipped to detect and prevent misconduct.

Incorporating the DOJ’s 2024 Compliance Guidance

The DOJ’s 2024 Evaluation of Corporate Compliance Programs (ECCP) introduces several critical updates that companies must adopt to improve the effectiveness of their compliance programs. These updates emphasize leveraging technology, encouraging whistleblowers, and maintaining a proactive approach to compliance monitoring. In light of the John Deere case, these elements are particularly relevant for companies that operate in high-risk environments.

1. Leveraging Data Analytics and Technology: The DOJ’s 2024 guidance strongly encourages using data analytics and AI tools to enhance compliance monitoring. Companies today generate vast amounts of data, from transaction records to communications between employees and third parties. Advanced data analytics can help compliance teams sift through this data to identify patterns of suspicious activity, such as repeated large expense claims, frequent payments to the same vendors, or transactions that lack clear documentation. By using these tools, organizations can detect potential misconduct early and prevent it from escalating. For John Deere, a more robust data-monitoring system might have flagged Wirtgen Thailand’s fraudulent expenses long before they resulted in FCPA violations.

2. Whistleblower Protection: Protecting whistleblowers is not just a best practice; it is essential for detecting misconduct early. The DOJ’s guidance stresses the importance of providing employees with safe, anonymous channels to report unethical behavior without fear of retaliation. Companies should promote these channels through training, internal communications, and leadership messages. In the John Deere case, a firm whistleblower policy might have prompted employees at Wirtgen Thailand to report the bribery schemes before they became a more significant problem. Furthermore, companies must ensure that all complaints are investigated promptly and thoroughly.

3. Continuous Improvement and Risk Assessment: The DOJ also emphasizes the importance of continuously updating compliance programs based on lessons learned from past misconduct, industry developments, and now root cause analysis. Compliance is not static; it should evolve as the business environment changes. Companies should regularly review their compliance frameworks, adjusting policies and controls to address new risks. For example, emerging technologies, geopolitical risks, and regulatory changes may all necessitate updates to compliance procedures. In the case of John Deere, a proactive approach to continuously evaluating the compliance landscape might have identified the risks associated with Wirtgen Thailand’s operations much earlier.

By integrating these elements into their compliance programs, companies can create a more dynamic and responsive approach to risk management, helping them stay ahead of potential issues.

Fraud Risk Assessment: Identifying and Mitigating Risks

A fraud risk assessment is a structured approach to identifying potential vulnerabilities in a company’s financial and operational processes that could lead to fraud or misconduct. In the John Deere case, the absence of regular and comprehensive fraud risk assessments allowed Wirtgen Thailand’s bribery schemes to continue unchecked for several years. Conducting these assessments regularly is crucial for mitigating risks, particularly in regions or industries that present heightened exposure to corruption.

1. Identify High-Risk Areas: Organizations must assess which business areas are most vulnerable to fraud. This could be based on geographic location, industry, the nature of the transactions involved, or the level of interaction with government officials. For John Deere, the fact that Wirtgen Thailand operated in a country with a known history of corruption should have been an immediate red flag. A targeted fraud risk assessment could have identified the need for enhanced controls and monitoring of financial transactions involving Thai government officials.

2. Tailor Controls to Identified Risks: Once high-risk areas have been identified, companies must tailor their internal controls to address those specific risks. For example, suppose the fraud risk assessment identifies expense reporting as a potential weakness. In that case, more robust controls should be implemented, such as requiring additional levels of approval for expenses in high-risk countries or flagging certain types of transactions for closer review. In Wirtgen Thailand’s case, stricter controls around gifts, travel, and entertainment expenses could have prevented the abuse of these categories for bribery.

3. Continuous Monitoring and Review: Fraud risk assessments should not be one-time exercises. They must be conducted regularly and adjusted based on the evolving business environment. Organizations must continuously update their fraud risk assessments and adjust controls accordingly as risks change—whether due to new business lines, regulatory changes, or external factors. Regular fraud risk assessments help identify emerging threats before they can lead to significant violations.

By conducting regular and thorough fraud risk assessments, companies can proactively address vulnerabilities, reduce the likelihood of misconduct, and protect themselves from legal and reputational damage.

Board of Directors: Oversight Responsibilities and Corporate Governance

The Board of Directors plays a pivotal role in ensuring that an organization’s compliance and risk management programs function effectively. However, their role must follow the “nose in, fingers out” model—meaning that the board should oversee and guide the company’s compliance strategy without getting involved in the day-to-day operations. In the John Deere case, the board failed to exercise this oversight effectively, missing key opportunities to hold senior leadership accountable and ensure the necessary controls were in place.

1. Hold Senior Leadership Accountable: The board’s primary responsibility is to ensure that senior leadership drives the compliance agenda and manages risks effectively. In the John Deere case, the board should have demanded regular updates from senior management on Wirtgen Thailand’s compliance integration status. Specifically, the board should have asked tough questions about how the subsidiary was being monitored, what risks had been identified, and what steps were being taken to address them. By holding senior management accountable, the board ensures that compliance is prioritized at the highest levels.

2. Support and Empower Internal Audit: The internal audit function independently assesses a company’s internal controls. However, internal audit can only be effective if it is empowered and adequately resourced. The board must ensure that internal audit has direct access to the audit committee and can report concerns without interference from management. In the John Deere case, the board should have required regular audit reports on Wirtgen Thailand’s financial transactions and compliance activities. These audits could have revealed the issues with expense reporting and bribery much earlier.

3. Ask the Right Questions: The board must proactively ask the right questions about risk and compliance. For example:

? What compliance risks are in high-risk regions like Thailand, and how are they mitigated?

? How is internal audit evaluating compliance at Wirtgen Thailand?

? What systems are in place to protect whistleblowers and ensure that reports of misconduct are investigated thoroughly?

These questions help the board identify potential problems and ensure that management is taking appropriate steps to mitigate risks.

By adopting a “nose in, fingers out” approach, the board can maintain an appropriate level of oversight without overstepping into operational management. This ensures compliance remains a priority for senior leadership while allowing internal teams to manage day-to-day risks.

Summary: Strengthening Corporate Governance and Compliance

The John Deere case demonstrates the serious consequences of weak internal controls, poor compliance integration, and ineffective board oversight. To avoid similar pitfalls, companies must focus on strengthening their internal controls, fostering a culture of compliance, and ensuring that the Board of Directors plays an active but non-intrusive role in overseeing the company’s compliance efforts.

Key actions include:

? Holding senior leadership accountable for managing compliance risks and ensuring post-acquisition entities are fully integrated into the company’s risk framework.

? Empowering internal audit to conduct regular, independent reviews of high-risk areas.

? Conducting regular fraud risk assessments to identify vulnerabilities and adjust controls accordingly.

? Leveraging data analytics to monitor questionable activities and detect potential compliance violations early.

By aligning their practices with the DOJ’s 2024 ECCP, organizations can enhance their compliance programs, mitigate risks, and operate with greater integrity.

Have a great weekend!

Jonathan Marks

#fraud #fcpa #sec #controls

Disclaimer: The companies, individuals, or entities mentioned in this post are referenced for educational and illustrative purposes only. The information provided is not intended to criticize or call out any parties, but rather to serve as a tool for learning and discussion. The content is based on a range of purposes, including providing general information and insights. It should not be considered professional advice. Readers must consult with a qualified professional before making any decisions based on the content of this writing or any of my writings.