Reference no: EM133459384

Case Study: SAP is a software company based in Hanover, Germany, that sells software licenses and related services to over 320,000 customers in 190 countries. It employs some 79,000 workers and works with more than 12,000 partner companies worldwide. In 2015, the company reported revenue of $23.2 billion. In order to generate and sustain such high levels of income, SAP, along with many other IT companies, employs a complex set of consultants, distributors, retailers, systems integrators, technology deployment consultancies, value-added resellers, and vendors to market and sell their products and services. The use of so many entities increases the possibility that someone in the distribution chain might engage in bribery, putting the company at risk. IT companies such as SAP are challenged to build a constantly vigilant monitoring program and must spend significant resources to guard against such illegal actions, including those that could be prosecuted under the Foreign Corrupt Practices Act (FCPA). In recent years, a number of IT companies have been the subject of FCPA enforcement actions including Cisco, Hewlett-Packard, IBM, and Oracle, just to name a few. Even though SAP is a German company, it is also subject to the FCPA because its shares are traded on the New York Stock Exchange. The former vice president of global and strategic accounts for SAP conspired with four members of the SAP distribution chain to pay bribes to Panamanian government officials to secure a major technology upgrade contract. The contract was for $14.5 million, including $2.1 million in software licenses for SAP. The Panamanian government subsequently awarded SAP's distribution partner further contracts that included SAP products worth an additional $1.2 million. The SAP executive paid $145,000 in bribes to one government official, and he himself took over $85,000 in kickbacks for arranging the bribes. The bribes were paid through bogus contracts and false invoices, with funds obtained by SAP selling the software to one of its distributors at a deep discount-over 80 percent in some cases. The software was then sold to the Panamanian government at a much higher price. The difference between the higher price paid by the Panamanian government and the discounted price paid by the distribution partner created a slush fund that the partner used to pay the bribes and kickbacks. The deep discounts were falsely reported as legitimate discounts on the books of SAP's Mexican subsidiary and were subsequently consolidated into SAP's financial statements. SAP's system of internal control required employees to submit requests within SAP to obtain approval of discounts to local partners. SAP employees, however, had wide latitude in seeking and approving such discounts. So although the deep discounts should have triggered additional scrutiny, they did not; the employees' explanations for the discounts were accepted without verification. The Securities and Exchange Commission (SEC) charged the SAP executive with violation of the Foreign Corrupt Practices Act (FCPA), and he was forced to pay $92,000, representing the amount of the kickback he received on the deal plus interest. He was also sentenced to 22 months in prison. According to the SEC, the illegal activity went undetected because SAP failed to devise and maintain a system of internal accounting controls adequate to provide reasonable assur[1]ances that these improper payments to government officials did not occur. The SEC fined SAP $3.9 million to settle charges that it violated the internal control provision and the books and records provision of the FCPA. This amount represented the $3.7 million in profits SAP earned on the contracts plus another $.2 million in interest. SAP agreed to pay the $3.9 million fine without admitting or denying the SEC's findings.

Critical Thinking Questions

1.Do you think that the penalty for violation of the internal control provision and the books and records provision of the FCPA is stiff enough to motivate companies to implement sys[1]tems capable of detecting bribes? Is it possible that some organizations tolerate lax internal control so managers have as much freedom as possible in running their business? What changes, if any, would you suggest to the FCPA?

2. When an organization implements a major accounting software package, it also inherits the system of internal control that is built into the software-good, bad, or indifferent. What can be done if it is discovered, months after the software has been purchased and installed, that the software is lacking in good internal control?

3. IT workers have a key role in designing and implementing the internal controls associated with systems that automate the processing of business transactions, such as the payment of suppliers, employees, and business partners and the receipt of payments from custo[1]mers. What can IT workers do to prepare themselves for this responsibility? Who should the IT workers collaborate with when evaluating or designing the automated internal con[1]trols of a computer-based information system?