SAP pays multi-million fine for bribery

SAP is paying a total of over $220 million to settle investigations by the US Department of Justice and the US Securities and Exchange Commission (SEC) into violations of the Foreign Corrupt Practices Act (FCPA). This is according to a statement from the US Department of Justice. The German software company is alleged to have bribed officials in various countries in order to secure contracts from authorities and governments.

Corruption in seven countries

According to the US investigators, bribery practices were involved in South Africa, Malawi, Kenya, Tanzania, Ghana, Indonesia and Azerbaijan. From December 2014 to January 2022, SAP employed external intermediaries and consultants in these countries who paid bribes to government officials. The aim was to finalise deals with public sector customers, according to a statement from the SEC. 

As a result, the German software manufacturer recognised these bribes in its books as legitimate business expenses, although some of the third-party intermediaries were unable to prove that they had provided the contractually agreed services. According to the US authorities, SAP failed to establish and maintain sufficient internal accounting controls for the intermediaries and subsidiaries involved.

“Our order holds SAP accountable for misconduct that spanned seven jurisdictions and lasted several years,” said Charles E. Cain, Chief of the SEC Division of Enforcement’s FCPA Unit. The proceedings are a stark reminder that global companies need to be mindful of both the risks of their business and the need for adequate controls at the corporate level across all of their subsidiaries.

Not the first offence

SAP is considered a repeat offender by the US authorities. The SEC filed charges against SAP back in 2016, according to the supervisory authority. This involved breaches of accounting and internal accounting controls in connection with a bribery program in Panama.

Those responsible at SAP welcomed the settlement with the authorities and accepted the penalty. The company had already separated itself from all parties responsible for the relevant incidents more than five years ago and had since significantly improved its global compliance programme and the associated internal controls, the software provider said in a statement. The matters have been fully resolved.  

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts