When Corporate Prevention Fails: Crisis Management in the Brazilian Anti-Corruption Context


Individual human creativity, when organised collectively, is and has always been a driving force for development. Companies, governments and institutions in general have become more complex over time, but even the most sophisticated organisations maintain their most basic element: action at the individual level.

Society has moved towards the creation of values, rules and behaviours, guided to assist individual actions to a common good, within a framework of what is deemed ethical, lawful and productive. In any social environment, however, individuals will still act outside such socially established framework. Seeking shortcuts or trying to avoid hurdles, the limits defined for individual behaviour are invariably exceeded by some, breaching the integrity of the system of rules in which they are inserted.

Companies do not differ from this social rule. At the same time that a framework is defined for their actions as corporations (the laws applicable to them), a framework of rules is also established to govern the actions of the individuals forming them: the internal rules and standards of the company.

Business entities also present an additional complexity: as they are themselves the sum of several and multiple individual actions, they need the commitment and compliance of individuals to ensure that the laws will be enforced and abided by. For a company to breach a rule and exceed the framework applicable to it, it is not necessary for all individuals using the rules to decide to take an illegal shortcut. Instead, it is enough that a single individual, acting as part of or on behalf of the company, commits an unlawful act.

It is in this crucial context that the compliance specialists are inserted: they create prevention and control tools that guide and seek to deter wrongdoings; they assist in the development of policies and training; and they investigate, identify and correct violations that have already been committed. In summary, they try to understand and anticipate human behaviour in order to prevent, detect and remedy breaches of individual integrity, so as to avoid any greater harm to the corporation.

No matter how integrated and organised a firm may be, corporate environments will witness different forms of violation from time to time. Violations of the company’s internal rules and legal standards may characterise a breach that may bring losses to the companies involved. This is why it is extremely important to properly prepare to respond to the challenges of any crisis. Creating a good prevention programme (‘hope for the best, prepare for the worst’) is key.

Experienced professionals know that structuring a robust and efficient compliance prevention programme depends on the humble acknowledgement that there may never be an absolute guarantee against any breach of integrity. After all, no matter how perfect the rules, culture and incentives may be, individuals and their unpredictability will still play a decisive role. According to Donald Cressey’s fraud theory, the company is unable to fully control the three elements that lead an individual to commit an act of fraud: pressure, opportunity and streamlining.

Corporate investigations are, therefore, a relevant part of this process. Once a problem is detected, they help decision-makers to understand whether there is actually a problem, what the problem is, its dimensions and sources and, further, what legal responses exist to handle it in the least traumatic way for the corporation.

Recently, different jurisdictions in the world have decided to increasingly punish companies for the actions of their agents. In this context, corporate investigations – which have always played an essential role in revealing internal acts of fraud affecting the companies and in assisting businesses to recover assets and prepare for litigation – have started to play a leading role.

Preventing and repressing corruption in Brazil

Among the several types of integrity breach, corruption is a problem that has always afflicted the most diverse institutions, whether public or private, in various sectors of society.

There is no need to reiterate the harm that corrupt practices bring to institutions, demoralising rules, deepening asymmetries, demolishing individuals’ confidence and causing an estimated global annual loss of about US$2 trillion.[1]

Throughout history, various statutes have addressed behaviours that damage public property. Improvements have also resulted from the fact that the population and the companies themselves have begun to notice that public corruption is not limited to the public treasury and to those who depend on it, but rather extends to the capitalist system as a whole, to the extent that those shortcuts represent trouble for the free market and impede meritocracy.

It is no wonder that in 1977, amid major corruption scandals (Watergate and Lockheed), the United States issued forefront rules to punish companies for acts of public corruption: the Foreign Corrupt Practices Act – FCPA.

Thus, the FCPA has marked a new stage in the fight against public corruption, sharing with companies the responsibility for preventing it. Although the FCPA has kept the state’s duty to supervise its agents and prevent them from engaging in corrupt practices, corporations have since taken on a new role: to control the individual action of each of their agents around the world in order to avoid illicit payments to public officials.

Despite its slow pace, the movement started by the USA with the FCPA has successfully spread around the world and influenced many international standards. Some examples along the same lines are the Inter-American Convention Against Corruption of the Organization of American States, signed in 1996, the Convention on Combating Bribery of Foreign Public Officials in International Business Transactions of the Organization for Economic Cooperation and Development, of 1997 and the United Nations Convention against Corruption of 2003, all ratified by Brazil.

The Brazilian chapter in this battle has its peculiarities, especially because Brazilians see corruption as the biggest problem in the country,[2] overriding important issues such as health, unemployment, education and violence.

Brazil has been punishing public corruption for a very long time, but mainly by means of criminal statutes that would only target the individuals (either those paying or receiving illicit advantages) involved. Throughout almost all Brazilian legislative history, the legal mechanisms to fight corruption have been the monopoly of punitive criminal rules, with an extremely reduced focus on the control, prevention and sharing of responsibilities between the state and civil society.

The status quo of combating corruption in Brazil has undergone a profound transformation in recent years. The 1988 Federal Constitution, the Brazilian Public Procurement Law,[3] the Fiscal Responsibility Law[4] and the Administrative Misconduct Law[5] have all marked the beginning of a period of strong legislative focus on preventing and repressing crimes that victimise the government, creating a consolidated legal framework for criminal, administrative and civil punishment of individuals and companies engaged in such acts.

Several new laws enhanced the controls on the government, seeking to stifle corruption. Law No. 12,527 of 2011, known as the Access to Information Law,[6] has taken a significant step towards a more modern system to prevent corruption in Brazil, stimulating social control and empowering citizens to oversee the actions of public officials. At the same time, the Clean Record Law[7] prevented convicted politicians from running for office and the Conflict of Interest Law[8] sought to regulate the migration of public officials to the private sector.

However, something was still missing in Brazil’s regulatory framework – a means of ensuring compliance with the international treaties mentioned earlier, in other words, a system of corporate responsibility for acts of corruption, targeting not only domestic but also international wrongdoings. Thus, that was the exact focus of Law No. 12,846 of 2013, the Brazilian Clean Company Act (BCCA), or the ‘Brazilian FCPA’, which aims at punishing companies doing business in Brazil for acts against the government committed in Brazil or abroad.

The BCCA innovates the Brazilian legal system at several points, imposing severe penalties to companies that get involved in illicit conduct. For example, this new statute:

  • has created a system of responsibility based on strict liability, under which proof of fault, willful misconduct or even knowledge by the management is not necessary for punishment;
  • has established the benefit of the company as the sole main trigger to the company’s liability, making it responsible even for acts committed by third parties on its behalf;
  • has provided for the joint responsibility of affiliates, subsidiaries, controlling or parent companies, or even members of consortia; and, as for the applicable penalties
  • has provided for fines of up to 20 per cent of the company’s annual gross revenues, along with other relevant penalties such as debarment or even, in extreme cases, the closing down of the legal entity.

These legislative innovations of the past 30 years have deeply changed the legal instruments to combat corruption in Brazil. However, on a practical level, they only gained far-reaching visibility in the more recent years, following an important increase in their actual enforcement.

This new trend may have started with the trial of the Mensalão case (a political bribery case decided by the Brazilian Supreme Court in the middle of 2012), which led to the arrest of many important politicians and of a few businessmen. New and stricter interpretations of the applicable rules by the Brazilian Supreme Court were adopted at that trial, including rules that would bring liability to individuals that were not directly involved in the illicit conduct, but had the power to ‘control’ or ‘ interrupt’ it.

The Mensalão case has set a new framework for corruption investigations, further supplemented by the enactment of additional legislation such as the Money Laundering Act[9] and, more importantly, the Criminal Organisations Act,[10] that completely reformed the rules for plea bargaining in Brazil, providing the grounds for the subsequent Operação Lava-Jato (Operation Car Wash), in which dozens of the most important and influential Brazilian politicians and businessmen have been arrested and forced to confess to various acts of corruption.

Surrounded by controversy involving the suppression of due process rights and the abuse of judicial power – obviously important issues that cannot be addressed here considering the limited scope of this article, but that would need to receive the most careful attention by both enforcers and commentators – Operation Car Wash has profoundly changed the Brazilian enforcement landscape.

Not only is it still active and shows new developments every week, but it has also given rise to several other investigations that stemmed from it, and that have thereafter taken their own course. In addition, it has put enormous focus on companies and business people.

Operation Car Wash has been also characterised by a novel and intense proximity between investigators and the press. In a new context of numerous leaks of restricted information, and extraordinary media attention to the daily legal developments of the case, reputational risks have been also increased to an unforeseen level, in a trend that is also being replicated by other investigations. For instance, it can be seen in Operation Zealots, which investigates the payment of bribes by companies to the administrative court of tax appeals. Companies involved in this investigation have also had their names widely reported by the press and, as a result, in many cases have suffered considerable losses in their market value.

The changes in the above-mentioned Brazilian enforcement and statutory landscape have modified the legal treatment and the risks for companies in cases of violations related to corruption, making the BCCA a symbol that the new Brazilian legal framework, in a context that demands companies and entrepreneurs to be prepared to prevent and respond to a situation of crisis.

As in every moment of transformation, this is a time for the public and private sectors of the Brazilian society to adapt. On the side of the state, excesses, violation of due process rights and media sensationalism have certainly caused unjust harm to many players, including business people, companies and, consequently, to the national economy as a whole. Hence, a balance between a history of impunity and a new exacerbated punitive appetite still needs to be sought. On the side of corporations, however, it is time to adjust, and to put in place sound integrity programmes that can protect businesses against a new plethora of legal and reputational risks.

Challenges and solutions for companies operating in Brazil

It is undeniable that this is a challenging time for Brazilian companies and for all those with businesses or investments in the country. The role of compliance professionals is to help them to easily and securely adapt, indicating not only the pitfalls to avoid, but also the opportunities to enjoy.

The natural preventive way is to establish integrity programmes. And the BCCA, although not exonerating the companies that establish such programmes from punishment, points to several benefits for those who demonstrate that they have effective compliance tools in place, focused on preventing corrupt practices at the time the offence occurred. The rules are very clear in the sense that such programmes must be designed for the specific risks and profile of each company.[11]

Decree No. 8,420 of 2015, which regulated the BCCA, provides – following the US Sentencing Commission Guidelines Manual (USSG) example – the basic elements of a compliance programme, the complete establishment of which takes time. Therefore, given that the BCCA has been in effect for a short time, even the most diligent Brazilian companies are still in the implementation phase.

In this context, multinational companies are ahead of the game, since for those headquartered or doing business in the USA, the concern is old, as the FCPA has been effective since 1977. However, this advantage does not mean that such companies do not need to continue making several and indispensable adaptations in their compliance programmes to conform with the legal requirements of Brazil’s legislation and corporate culture.

Although several of the 14 evaluation parameters of an integrity programme set out by Decree No. 8,420/2015 are related to the seven parameters established in the USSG,[12] we cannot deny that the Brazilian legislator chose a different approach to the issue and, therefore, established a need for adjustment so that a multinational compliance programme may meet and fulfill the requirements of both the FCPA and the BCCA.

Moreover, as stated earlier, every integrity programme has the difficult task of guiding and controlling individuals and their behaviour, detecting and preventing violations of internal regulations of companies or the laws and regulations applicable to them. Thus, the culture of such individuals, that is, their custom and social values, is an indispensable element when establishing their patterns of behaviour and, consequently, the risk matrix of the environment in which they are inserted.

For precisely this reason, understanding the culture of the country where the company operates and locally adjusting the compliance programme are key elements to ensure effectiveness. This adjustment must be technically oriented and have the power to conform to an internationally consolidated programme with the local legislation and culture, as well as to prevent the programme itself from creating unwanted legal risks to the company, since local laws may contain particular bans or liabilities that will also need to be addressed.

For example, there is the practice of requesting criminal records in employee hiring processes, or of laying off employees after learning about a previous criminal conviction. Such practice is common in some countries, but in Brazil, the Superior Labour Court has interpreted it as being abusive,[13] with companies having been ordered to pay heavy damages because of this practice.

This logic, applicable to the construction of mechanisms aiming at preventing breaches of integrity, has become important in the planning and implementation of response mechanisms, in which corporate investigations play a leading role.

Planning and responding to anti-corruption integrity breaches in Brazil

Preparing and responding to integrity breaches is a fundamental part of any successful compliance programme. In today’s business and regulatory environment, companies have been assigned the duty of being alert and diligent, not only by the law, but also by their employees and shareholders. Companies are increasingly expected to show a proactive response to the various types of integrity breaches that may occur.

In some jurisdictions, stablishing an internal investigation when a problem is detected may be a legal obligation, as in matters related to financial fraud faced by companies subject to the Sarbanes–Oxley Act of 2002; in others, it is a response strategy with clear legal benefits, and in this second category, integrity breaches related to corruption are generally found.

Both the USSG and Decree No. 8,420/2015 indicate that responding appropriately to complaints and possible violations constitutes an integral part of the quality assessment of a compliance programme. However, the benefits of corporate investigations much exceed this specific benefit, so that in both the USA[14] and Brazil[15] its satisfactory implementation may assist in the decision to apply for and negotiate leniency agreements that can radically reduce the sanction to companies that are experiencing integrity breaches.

In the USA, through FCPA practice, a corporate investigation conducted by a company under investigation by the Department of Justice and the Securities and Exchange Commission has been consistently considered as a reason to reduce the sanction imposed.[16] In Brazil, besides the possibility of cooperating with the authorities and the legal benefits this can bring, such investigations have helped companies to understand the exact extent of their faults and risks, and helped them to prepare their defences and properly respond to public opinion, thus reducing the reputational impact of their involvement in a situation of crisis, even when no leniency application is considered.

Whether to provide grounds for subsequent leniency applications, or to help companies to devise the best course of action and to build a solid defence, confidential internal investigations are always present in the planning of responses to crises in companies with established integrity programmes. Their efficient use helps to determine whether there has been a breach of integrity, those responsible and the specific context, and to plan the path to follow in order to deal with the past problems or prevent similar ones from occurring in the future.

Although it may often appear that this is a purely intuitive process, the investigation requires specific techniques and methodologies to ensure it is effective, useful and safe. For this reason, only qualified professionals may guarantee the use of established techniques of data analysis and interviews (saving hours of useless work), the preservation of evidence (which may otherwise permanently impair any search for redress or even the reality of the facts) and that the investigation will not create new legal risks to the company.

Corporate investigations can be carried out by the company directly involved or rely on the specialised advice of a law firm or a consulting firms. In any case, conducting investigations internally is only recommended in Brazil or abroad for those companies that have a staff of professionals who are trained and experienced in this practice. In this respect, it is important to stress the confidential nature of the work performed by law firms, given that the rules regarding attorneys’ privilege and legal confidentiality in Brazil are quite broad and comprehensive.

Given the long history of corporate investigations in the United States, American professionals are highly experienced in such matters. In large US law firms, it is not rare to find former investigators of the Department of Justice, the FBI, and other government agencies with established techniques in investigations regarding integrity breaches in the corporate world.

It is undeniable that the investigation methodologies and techniques developed in the United States represent the vanguard in the matter. Also, the US courts have entered many judgments on the subject, setting relevant and widely applicable principles, for example in Upjohn Warning v. United States,[17] used globally in corporate investigations. In Brazil too, with the current situation in the fight against corruption, corporate investigations have gained a wider scale and the use of foreign methodologies and professionals has been both frequent and positive. However, as already stated, such import should take into consideration the local legal and cultural issues, in order to guarantee a successful outcome and the legal certainty of such procedures.

Language and cultural differences play a role in this demand for adaptation, but the biggest trap lies in the legal differences between the countries where foreign investigators were trained and Brazil, which has a number of specific rules that not only jeopardise the admissibility of the evidences gathered during the investigation, but also bring new risks to the companies.

Brazilian labour laws are markedly different from foreign ones and have as their basic principle the ‘Protection Theory’, which gives much higher prerogatives to employees than to those found in other countries. This has a deep impact on the steps to be taken in corporate investigations in Brazil, to the extent that a practice regarded as lawful in the United States may be deemed a compensable illegal constraint in Brazil.

Employee consents have a different weight in Brazil, as it is common for Brazilian judges to assert that even when the employee waives a right, this right continues to protect him or her, punishing companies for allegedly violating it. The application of this concept is extremely relevant with respect to issues regarding confidentiality of information and documents that can be used in corporate investigations and interviews, and may result in the invalidation of the whole investigation or even in an obligation to pay compensation for pain and suffering to workers.

The failure to adapt to local laws raises a risk that, when responding to a possible breach of integrity, another breach may be caused, repeating in Brazil what happened in the Hewlett Packard case in 2006, in which the company had to pay US$14.5 million in settlements after its external advisors were deemed to violate (during a corporate investigation) the privacy laws of the State of California.

Obviously, legal differences do not imply that the involvement of foreign professionals or techniques is not possible or even not desirable in corporate investigations in Brazil, but rather than the knowledge being imported needs to be adjusted to the local reality and legal framework.


It is clear that corporations around the world are assuming a growing responsibility for preventing breaches of integrity caused by their professionals. Those involved in public corrupt practices have drawn much attention from legislators and authorities.

Brazil exists within this context, and is currently having a moment of deep transformation with regard to the way that companies are treated in cases of corruption. The BCCA is the greatest symbol of a new era in this field. And Operation Car Wash is the greatest example of a change in the way the authorities and the society in general are handling acts of corruption committed by companies.

Such factual and legal changes impose on Brazilian companies the urgent need to create and implement compliance mechanisms in order to prevent, detect and remedy breaches of integrity related to corruption. At the same time, multinational companies doing business in Brazil must adjust their existing integrity programmes to Brazilian local culture and laws.

However, breaches of integrity will always occur. Therefore, an effective integrity programme should always consider the possibility of transgression. In this context, a response plan to situations of crisis is an important element and, within it, corporate investigations play a leading role as they can assist companies in identifying problems and eliminating or minimising the negative consequences, both from a legal and a reputational standpoint.

Such investigations are a growing trend in Brazil, in view of the changes the country is facing. However, if they are conducted without proper techniques or without knowledge of the peculiarities of the Brazilian legislation, they may turn themselves into an additional risk.

Properly conducted, with adequate technique and expertise and due consideration of the local legal and cultural framework, such investigations are proving to be powerful tools to understand and address potential liabilities, assisting companies in making adequate and informed decisions on the best course of action to be taken, in a context of increasingly strict laws and progressively more rigorous enforcement in Brazil.


  1. IMF – Fiscal Affairs and Legal Departments, ‘Corruption: Costs and Mitigating Strategies.’ May 2016. Available at www.imf.org/external/pubs/ft/sdn/2016/sdn1605.pdf. Accessed on 28 July 2016.
  2. Ricardo Mendonca, ‘For the First Time, Corruption is Seen as a Major Problem in the Country, Says Datafolha.’ 29 November 2015. Available at www1.folha.uol.com.br/poder/2015/11/1712475-pela-1-vez-corrupcao-e-vista-como-maior-problema-do-pais.shtml. Accessed on 28 July 2016.
  3. Public Procurement Law No. 8,666 of 1993.
  4. Fiscal Responsibility Law – Complementary Law No. 101 of 2000.
  5. Administrative Misconduct Law No. 8,429 of 1992.
  6. Access to Information Law No. 12,527 of 2011.
  7. Clean Record Law – Complementary Law No. 135 of 2010.
  8. Conflict of Interest Law No. 12,813 of 2013.
  9. Money Laundering Law No. 12,683 of 2012.
  10. Criminal Organisation Law No. 12,850 of 2013.
  11. In this regard, see Article 41 of Decree No. 8,420/2015.
  12. In particular: 1. Establish policies, procedures and controls; 2. Exercise effective compliance and ethics oversight; 3. Exercise due diligence to avoid delegation of authority to unethical individuals; 4. Communicate and educate employees on compliance and ethics programs; 5. Monitor and audit compliance and ethics programs for effectiveness; 6. Ensure consistent enforcement and discipline of violations; and 7. Respond appropriately to incidents and take steps to prevent future incidents.
  13. Brazil – Superior Labor Court. Appellate decision of Interlocutory Appeal filed in the context of Review Appeal No. 140100-73.2012.5.13.0009. Reporting Judge: Aloysio Corrêa da Veiga. Published in the Electronic Labor Court Gazette on 6 December 2013.
  14. In this regard, see SEC Securities whistleblower incentives and protection: 15 USC Section 78u-6.
  15. In this regard, see Article 16 of Law No. 12,846/13, which describes the Leniency Agreement.
  16. As stated in the Seaboard Report: Report of Investigation Pursuant to Section 21(a) of the Securities Exchange Act of 1934 and Commission Statement on the Relationship of Cooperation to Agency Enforcement Decisions, Exchange Act Release No. 44969, 2001 SEC LEXIS 2210, at *1-2 (23 October 2001).
  17. Upjohn Co v. United States, 449 US 383, 394 (1981).

Unlock unlimited access to all Latin Lawyer content