A few days ago, the New York Times printed a photo of an U.S. registered Bombardier Challenger private jet at the Tehran airport that turned out to be registered to the Bank of Utah, a small community bank in Ogden, Utah, that apparently holds the trust certificates for many aircraft.  Later, it was reported that the plane may be owned by Engineers & Planners Company Ltd., a Ghanaian mining services company whose CEO is the brother of the Ghanaian President.  More recently, the reports say the plane was used by Ghanaian officials to travel to Iran.

The story highlights risks under the Foreign Corrupt Practices Act.  Some stories suggest an unnamed U.S. mining company has a long-term charter on the aircraft.  If so, it appears the U.S. mining company is obtaining services from a company controlled by the Ghanaian President.  This situation highlights at least three parts of an effective compliance program: due diligence on third-party vendors, internal investigations and training.

A long-term charter of a private jet from a company controlled by the relative of a government official obviously presents risks under the Foreign Corrupt Practices Act, the UK Bribery Act and other anti-corruption laws.  Recent guidance from the DOJ and SEC in the U.S. and the Serious Fraud Office (SFO) in the UK make clear that due diligence is particularly important in these circumstances.  For example, determining the ownership, assessing the business rationale of chartering the jet from this particular company, and evaluating the terms of the transaction are critical to protecting the company from potential criminal charges.

When a company becomes aware of a potential issue, it’s important to promptly conduct an internal investigation to determine the facts.  As the DOJ and SEC recently suggested in their published FCPA resource guide, “companies should have in place an efficient, reliable, and properly funded process for investigating the allegation and documenting the company’s response, including any disciplinary or remediation measures taken.”

Once an investigation is concluded, it’s important to consider lessons learned.  Were policies followed?  Was the policy clear?  Were employees trained?  What remedial measures do we need to take?  The company also should consider whether to self-report to the DOJ.  By swiftly investigating to determine whether there was an issue, taking appropriate internal action, and self-reporting to the DOJ, SFO or other government agencies, the company may avoid prosecution or mitigate penalties.