GETTING THROUGH THE DEAL Risk & Compliance Management Risk & Compliance Management & Compliance Risk Contributing editor Daniel Lucien Bühr 2018 2018 © Law Business Research 2018 Risk & Compliance Management 2018 Contributing editor Daniel Lucien Bühr Lalive Reproduced with permission from Law Business Research Ltd This article was first published in June 2018 For further information please contact [email protected] Publisher Law The information provided in this publication is Tom Barnes general and may not apply in a specific situation. [email protected] Business Legal advice should always be sought before taking Research any legal action based on the information provided. Subscriptions This information is not intended to create, nor does James Spearing Published by receipt of it constitute, a lawyer–client relationship. [email protected] Law Business Research Ltd The publishers and authors accept no responsibility 87 Lancaster Road for any acts or omissions contained herein. The Senior business development managers London, W11 1QQ, UK information provided was verified between April Adam Sargent Tel: +44 20 3780 4147 and May 2018. Be advised that this is a developing [email protected] Fax: +44 20 7229 6910 area. Dan White © Law Business Research Ltd 2018 [email protected] No photocopying without a CLA licence. Printed and distributed by First published 2017 Encompass Print Solutions Second edition Tel: 0844 2480 112 ISBN 978-1-78915-067-4 © Law Business Research 2018 CONTENTS Global overview 5 Mexico 43 Daniel Lucien Bühr Reynaldo Vizcarra, Jonathan Edward Adams and Lorena Castillo Lalive Baker & McKenzie Abogados, SC Argentina 7 Nigeria 47 Pedro Serrano Espelta and Gustavo Morales Oliver Babajide Ogundipe, Olatunde Ogundipe and Olajumoke Omotade Marval, O’Farrell & Mairal Sofunde Osakwe Ogundipe & Belgore Brazil 12 Russia 51 Bruno De Luca Drago and Fabianna Vieira Barbosa Morselli Alexey Borodak and Sergey Avakyan Demarest Advogados Norton Rose Fulbright (Central Europe) LLP China 15 Spain 56 Gary Gao Helena Prieto González, Beatriz Bustamante Zorrilla, Zhong Lun Marta Sánchez Martín and Alejandro Ayala González Garrigues Germany 18 Barnim von den Steinen Switzerland 61 Rotthege | Wassermann Daniel Lucien Bühr and Marc Henzelin Lalive Greece 23 Vicky Athanassoglou Turkey 65 VAP Law Offices Ümit Hergüner and Zeynep Ahu Sazcı Uzun Hergüner Bilgen Özeke Attorney Partnership India 29 Junia Sebastian, Arindam Basu and Richika LRS United Kingdom 70 ALMT Legal Dan Lavender, Matt McCahearty and Malcolm Walton Macfarlanes LLP Italy 35 Andrea Fedi and Marco Penna United States 75 Legance – Avvocati Associati Keith M Korenchuk Arnold & Porter Japan 40 Hiroyuki Nezu, Masataka Hayakawa, Kumpei Ohashi, Do DOJ policy and the ISO compliance standard overlap? 79 Teruhisa Toyama and Tadashi Yuzawa Daniel Lucien Bühr Atsumi & Sakai Lalive 2 Getting the Deal Through – Risk & Compliance Management 2018 © Law Business Research 2018 PREFACE Preface Risk & Compliance Management 2018 Second edition Getting the Deal Through is delighted to publish the second edition of Risk & Compliance Management, which is available in print, as an e-book and online at www.gettingthedealthrough.com. Getting the Deal Through provides international expert analysis in key areas of law, practice and regulation for corporate counsel, cross- border legal practitioners, and company directors and officers. Throughout this edition, and following the unique Getting the Deal Through format, the same key questions are answered by leading practitioners in each of the jurisdictions featured. Our coverage this year includes new chapters on China, Greece, India, Nigeria and Turkey and an article, written by the editor, on the overlap between the US Department of Justice's assessment of corporate compliance programmes and the International Organization for Standardization's guidance for compliance management systems. Getting the Deal Through titles are published annually in print. Please ensure you are referring to the latest edition or to the online version at www.gettingthedealthrough.com. Every effort has been made to cover all matters of concern to readers. However, specific legal advice should always be sought from experienced local advisers. Getting the Deal Through gratefully acknowledges the efforts of all the contributors to this volume, who were chosen for their recognised expertise. We also extend special thanks to the contributing editor, Daniel Lucien Bühr of Lalive, for his continued assistance with this volume. London May 2018 www.gettingthedealthrough.com 3 © Law Business Research 2018 Lalive GLOBAL OVERVIEW Global overview Daniel Lucien Bühr Lalive This second edition of Risk & Compliance Management in the Getting the The first question (What are the generally accepted international Deal Through series reflects the continued globalisation of the economy standards and practices?) is quite easy. The only generally accepted and the legal world. international standards and quasi-standards for risk management are The global economy is services-driven and those services are ISO Standard 31000 – Risk management (according to the Organisation increasingly available over the internet and new electronic media. for Economic Cooperation and Development de facto the global stand- Services provided over the internet are by their very nature international ard for risk management) and the COSO3 Enterprise Risk Management and global. With regard to the industrial sector, the global economy Framework, a broadly accepted private risk framework. When it comes has essentially become a components marketplace where assemblers, to compliance management, the only generally accepted standards still often located in the ‘old’ world, source the most competitive com- are ISO Standard 19600 – Compliance management systems and ISO ponents from around the globe to build end-products under old, well- Standard 37001 – Anti-bribery management systems. Both standards established brands from another industrial era. Today’s economy is are recent and modern in their approach and reflect internationally also driven by electronic distribution channels for services and new accepted best practice. payment procedures. The common denominator in today’s economy is No international standard currently exists for operational legal therefore the global nature and vitality of its trade. management; however, there is some guidance available on the princi- The worldwide economic model inevitably leads to the globalisa- ples of good governance of the legal function4 and, of course, legal man- tion of legal risks and opportunities.1 Multinational companies, whether agement should meet the requirements of ISO Standard 9001 – Quality large or small, struggle with the diversity of jurisdictions, laws and reg- management systems, namely, adhere to quality management princi- ulatory bodies. Not surprisingly, they face significantly more complex ples, including a strong focus on internal clients (the ‘customer’), the and material legal risks today than 10 years ago. Yet, if senior managers motivation and involvement of top management, the process approach and general counsel are asked how they have adapted to these changes, and continual improvement. they often reply that their work processes and tools have barely changed. Finally, internal audit – the ‘super’ control function that moni- Legal and compliance budgets are still small despite ever-increasing tors whether legal, risk and compliance management and the internal duties and risks. Additionally, risk management often remains opaque (financial) control system are effective and achieve the goals set by and is not founded on generally accepted standards,2 while compliance top management – should follow the well-recognised ISO Standard management is typically shaped by the evolution of the organisation’s 19011 - Guidelines for auditing management systems. These guidelines historic compliance management rather than by modern best practices include the principles of auditing, the key aspects of managing an audit and a coherent and modern management system design. programme and conducting management system audits (pre-audit, on- To put it simply, nowadays global business opportunities and risks site audit, post-audit). They also address evaluating the competence of go hand in hand with global legal opportunities and risks. To capture the individuals involved in the audit process, including the person man- the business opportunities and avoid or limit the business risks, legal aging the audit programme, auditors and audit teams. risk management must be as good, professional and well-funded as the The answer to the second question (Does the implementation of core business activities. The board of any company should ask top man- the standards and practices lead to effective legal risk management agement whether the legal, risk management, compliance and internal by companies in the globalised economy?) is yes. Applying, maintain- audit functions are as sophisticated as its business management. ing and continually improving generally accepted risk and compliance If a company’s finance department applies US generally accepted management standards and practices will normally enable any organi- accounting principles (GAAP) accounting standards, the overall sation to manage its legal risks effectively. Of course, this cannot protect management of the company is certified under ‘ISO Standard