WPP Pays $19M on FCPA: An Analysis

Advertising giant WPP has agreed to pay $19 million to settle charges with the Securities and Exchange Commission that it had poor internal accounting controls in the 2010s, which led to bribery through third parties in India and several other emerging markets.

The SEC announced the settlement on Friday. It consisted of $11 million in disgorgement and interest, plus another $8 million in penalties — so right away we can see that the SEC was peeved with this misconduct, since 42 percent of the total went to penalties, which is a relatively high portion.

The misconduct itself involved local subsidiaries working with sketchy vendors in high-risk markets; we’ll get to those details presently. The bigger lesson for compliance officers, however, might be WPP’s overall approach to business growth and how it seemed to have corruption risks baked into the whole cake. We’ll get to that too.

First, about WPP itself. It’s the largest advertising firm in the world, with $15.4 billion in revenue in 2020 and more than 100,000 employees in 112 countries. The company grew rapidly over the last 15 years by acquiring smaller, founder-owned advertising agencies in emerging markets. That strategy, coupled with poor oversight, put WPP on the path that brought us here today.

For example, in 2011 WPP acquired Indian advertising firm Mindset, which is the primary focus of the SEC’s enforcement action. As outlined in the SEC settlement order, WPP left one of Mindset’s founders in charge of the subsidiary, and included an earn-out provision in his contract — essentially, a bonus if Mindset hit certain financial goals after acquisition. Earn-outs are common in the M&A world.

From 2015 through 2017, half of Mindset’s revenue came from two state governments in India, which had PR divisions responsible for hiring media companies to run advertising campaigns for various state programs. In that time, Mindset cooked up schemes with two different vendors to funnel bribes to those state PR agencies in exchange for state contracts.

Sham Vendor Deals, Ignored Complaints

The details of the schemes Mindset developed will probably sound familiar to most compliance officers. Or maybe your eyes will glaze over because we’ve heard this stuff so often before; I’m not sure. 

In one case, Mindset hired a vendor to do the actual purchasing of advertising space in local newspapers, and then reimbursed that vendor when the state government paid Mindset. But there was a differential between what the vendor paid to the newspapers and what Mindset received from the state, and Mindset executives kicked back a cut of that differential to the state officials. 

In another case, Mindset won a $1.5 million contract for a media campaign, and worked with another vendor to falsify documents that the vendor had executed said campaign for Mindset; in reality, the media campaign never happened. Instead, the vendor funneled $1 million from Mindset into yet another intermediary, which kicked back some of that money to the state officials.

The more alarming compliance failure in all this is that, according to the SEC, WPP received seven anonymous complaints about the bribery schemes from 2015 to 2017. The complaints included specific details about the scams and identified the CEO of Mindset and relevant Indian state government officials by name as participants. Still, WPP’s corporate leadership allowed the business relationships to continue for more than two years.

For example, when the first complaint about Mindset arrived in July 2015, WPP had its financial director for the India region investigate. That director hired an international auditing firm to look into the matter — which the audit firm did, but it only relied on information provided by the Mindset CEO, and gathered no other evidence. Ultimately the audit firm raised a few red flags to WPP’s finance team about the whole arrangement, and WPP did nothing.

Only in 2017, when the seventh complaint also named the corrupt state official, did WPP do a serious investigation. It hired a due diligence firm, which found all sorts of overlap between Mindset’s CEO and the state official. It also found email conversations between Mindset’s CEO and CFO (email that had been stored on WPP servers in the United States) that detailed what was going on and tracked off-the-books payments they were funneling through those sham vendors.

The SEC order details more of the same in other countries, too: a tax avoidance scheme in China, where an internal audit found several red flags that went unanswered; payments made in Brazil to fixers and intermediaries in violation of WPP policy, with books and records falsified to cover up the misconduct; a WPP subsidiary in Peru that in 2013 knowingly served as a conduit for bribes made by a Peruvian construction firm to the mayor of Lima, Peru’s capital city.

Multiple FCPA Shortcomings

First we have some tactical internal control failures to consider. For example, when WPP received complaints about Mindset’s misconduct, the company only engaged in investigation half-measures such as an audit firm that only solicited evidence from Mindset itself. Even when that audit firm noted several red flags and relayed them to WPP, the company allowed the third-party relationship to continue.

Or look at the Peru subsidiary. The CEO of that operating unit funneled the construction firm’s bribery payments through other WPP subsidiaries in Chile and Colombia — so those Chilean and Colombian subsidiaries were recording that they received money in return for services performed for a Peruvian construction company. Another red flag, which flapped in the breeze undisturbed until a separate criminal case brought things to light in 2019.

Why did all this happen? Perhaps the answer is in this sentence from the SEC order: “WPP had no compliance department during the relevant period, and it lacked meaningful coordination between its legal and internal audit departments and network management.” 

That is, WPP had anti-corruption policies (see Brazil misconduct, above); and sometimes found red flags itself (see the China misconduct, found by internal audit); and could even take real action when it wanted (see Mindset in India, when WPP’s legal team finally stepped in and hired a due diligence expert). But WPP had no dedicated compliance function with an independent, high-level compliance officer who could build strong internal controls and act on red flags immediately. 

Such a person might have, for example, investigated the Mindset misconduct immediately; or noticed that Chilean and Colombian subsidiaries processing payments for a Peruvian customer was weird. A strong compliance function could have built the strong system of internal controls that any large company should have known was necessary. This misconduct happened in the mid- to late 2010s, after all; FCPA risks were old news by then.

The other point that strikes me, however, is the corruption risk baked into WPP’s strategy of acquiring small, founder-led firms in high-risk markets, and then left unaddressed. 

Now, I understand that keeping a founder on the job after acquisition is common; and so are earn-outs, giving those founders incentive to hit financial targets and prove their subsidiary’s worth. Those elements of the strategy are fine. 

But when WPP applied that strategy to high-risk markets, it should have anticipated that the earn-out provisions would be incentive for those founders to commit fraud. And therefore WPP should have adjusted its corporate operations to account for that high corruption risk inherent in its strategy — by, say, implementing a rigorous compliance function at the corporate level. 

Really, this is yet another example of how companies can weave flawed incentives into their growth strategies; and not empower a compliance function to identify and intercept those risks. In that sense, WPP isn’t much different from enforcement actions against Kraft Heinz (accounting fraud to meet cost-cutting targets) and Wells Fargo (sales fraud to meet growth targets). 

In this case against WPP, attention to corruption risk within the corporate strategy was absent; and so were tactical responses to actual corruption that any multi-billion dollar business should have been competent enough to see. No wonder the SEC added a penalty onto WPP’s disgorgement and interest.