Overseas markets seem to grow by the minute, luring ever smaller and younger U.S. companies with the promise of booming economies and lower costs. But for these relatively inexperienced firms, the dream of international expansion soon collides with reality: many companies find themselves unprepared to deal with the challenges of running foreign operations.

At the same time, the Sarbanes-Oxley Act has fueled regulators’ enthusiasm for rooting out wrongdoing both at home and abroad, leaving CFOs personally liable for operations that may be thousands of miles away. “I’ve been doing business internationally since the start of my career, but what’s changed recently, what really magnifies the risk, is Sarbanes-Oxley,” says Jeff Babka, finance chief at NeuStar, a telecom services firm that has built its international operations mostly through acquisition.

“Between the rapid pace of globalization and the new focus on corruption and fraud, CFOs are facing a perfect storm today that they did not face 10 years ago,” says Frank Piantidosi, CEO of Deloitte Financial Advisory Services. Adds Don Devost, CFO of iWatt, a small semiconductor manufacturer with subsidiaries in Hong Kong and Japan: “The biggest difficulty is understanding the regulatory environment wherever you’re doing business, and the risk that noncompliance poses, not just locally but also here in the U.S.”

The risk isn’t confined to small companies like iWatt. At large U.S. multinationals it can be easy for a busy CFO to overlook a distant foreign operation until a problem pops up. And problems will almost certainly pop up: more than 43 percent of companies in PricewaterhouseCoopers’s 2007 Global Economic Crime Survey reported suffering one or more economic crimes, such as fraud, in the past two years. Just ask Dow Chemical, which paid a $325,000 civil penalty last year for improper payments made to a foreign official by a fifth-tier subsidiary in India.

The moral: Ordinary due diligence isn’t enough when it comes to foreign operations. Before setting up shop abroad, whether through acquisition or from scratch, CFOs need to take a particularly hard look at the backgrounds of the managers who will be running the shop, at the people those managers do business with, and at the laws and regulations that govern how they do business.

Grease Is the Word

A good place to start is with the Foreign Corrupt Practices Act (FCPA), which prohibits the bribing of foreign officials. Although the act was passed 30 years ago, the Department of Justice is becoming more serious about enforcing it. The DoJ is taking on more cases than ever, opening 73 new investigations in the past 5 years, and the fines are getting bigger, according to law firm Shearman & Sterling.

“You used to see a couple of [FCPA] enforcement actions a year. Now you sometimes see a couple a week,” says Alexandra Wrage, president of TRACE International, a nonprofit membership organization that helps companies in their antibribery efforts. “It’s not just more cases,” she adds. “It’s also bigger fines and more personal actions. They’re sending executives to prison.”

Last April, for example, oil giant Baker Hughes paid a record $44 million fine after a subsidiary pleaded guilty to charges that its employees bribed a government official in Kazakhstan. And last June, a long-serving deputy vice president at telecom company Alcatel pleaded guilty to bribing a Costa Rican official to win a contract. He could be sentenced to as many as 10 years in prison.

The spike in FCPA enforcement is linked closely to Sarbanes-Oxley. Almost all recent violations, including those at Dow and Baker Hughes, have been self-reported after companies found problems during their annual audits or as part of their Sarbox compliance. “The most conservative approach is to disclose [the findings] to the Department of Justice and hope that you leave with your head intact,” says Wrage.

At first glance, FCPA compliance seems simple: just tell employees not to pay bribes. But in many countries, doling out kickbacks is considered a normal part of doing business. “Bribes paid in foreign countries were tax-deductible in Germany until 1999,” points out Piantidosi. “The concept is so foreign to us, but so normal in some countries.” Indeed, five months after launching a bribe-reporting service last summer, TRACE International had received more than 1,500 accounts of bribe demands in 136 countries.

“If you combine low levels of transparency and high levels of cash, you can have a real problem,” says Wrage. Nigeria and Russia are notorious corruption hot spots, and in China stories of payments to municipal officials abound. Employees in countries around the world can be ingenious in their efforts to grease palms; Wrage cites examples of employees cashing in first-class plane tickets and flying coach in order to pay off customs officials with the difference.

Watch the Coffee Fund

One aspect of the FCPA that may surprise some executives is that companies can violate the law even if a bribe hasn’t been paid. The act’s “books and records” provision holds companies accountable if their accounting controls are so weak that off-the-books payments would be possible, says Wendy Schwartz, a partner with Reed Smith in New York. For example, if an employee is caught embezzling money for his personal use, the company could be found in violation of the act, since the employee was able to circumvent the company’s controls and could have paid a bribe.

“CFOs need to be aware that just because there is no evidence of an actual payment doesn’t mean they don’t have a potential voluntary reporting issue,” Schwartz says. Typically, the books-and-records provision is not enforced on its own, but rather as part of a larger DoJ investigation into kickback payments. However, Schwartz warns, it is an independent component of the law that the Securities and Exchange Commission could pursue separately if it wanted to.

For CFOs hoping to avoid a confrontation with the DoJ, it’s not enough to establish an FCPA compliance program; the program must be monitored as well. Regular on-site audits and controls testing are critical, particularly in high-risk regions or at companies whose business is heavily dependent on government approval or whose customer base includes government agencies. A familiarity with the subsidiary’s books is one commonsense safeguard against irregularities.

“If the coffee fund at your Nigerian sub jumps from $200 a month to $30,000 a month, you’d better know why,” says Wrage. The ability to demonstrate that controls are in place and regularly checked can help placate regulators should a bribery scheme be uncovered.

Local Knowledge

Many companies are rushing to gain a foothold in new markets via acquisitions. That strategy may be speedier and more effective than starting from the ground up, but it can lead to a world of trouble for the CFO. For one thing, a company becomes responsible for any FCPA violations committed by the acquired business. For another, the acquirer may be blindly entering into an expensive network of local relationships fraught with conflicts of interest.

“The most common problems I see relate to companies that are in some form of acquisition mode,” says Al Koch, managing director of AlixPartners, a global restructuring firm. One way to avoid FCPA violations and other infractions at newly acquired business units is to conduct extremely careful due diligence — far beyond what would be typical in a U.S.-based transaction — before venturing abroad.

For acquirers in a hurry, however, extensive due diligence isn’t a given. A study last spring by Deloitte Financial Advisory Services found that a third of companies fail to conduct background checks before entering into mergers, acquisitions, or equity investments outside of the United States. Small companies in particular may lack the resources or connections to do the kind of digging required.

“Most of the companies we work with are moving full speed ahead, and their finance staff is usually pretty lean,” says Larry Harding, president of High Street Partners, an Annapolis, Maryland-based consulting firm that supports companies in their back-office operations overseas and helps them navigate local regulatory environments.

Not only should acquirers research the backgrounds of executives at an overseas target, they should also look at their relationships with local regulators and check for any legal proceedings involving them, advises Deloitte’s Piantidosi. Probing the relationships between the company and its vendors and customers for potential conflicts of interest is also critical. “Is the vendor the general manager’s brother-in-law?” Harding asks. “Do you know who the landlords are?”

Identifying local experts who can answer such questions about landlords and vendors is a critical exercise for any CFO entering a new market, particularly if the region is a high-risk one like India or China. An Ernst & Young survey of more than 300 corporate-development officers and other finance professionals found that many companies that do frequent deals in emerging markets use forensic techniques, including hiring private investigators, to learn about local market dynamics and the people involved in a potential deal.

The Big Four, as well as some smaller, specialized firms like Harding’s, have developed networks of law enforcement officials, legal professionals, and accountants who know the local business community and can provide such intelligence-gathering services (see “Need Help?” at the end of this article). “They have the relationships and they have the Rolodex,” says Piantidosi. Harding suggests reaching out to trusted former colleagues, auditors, and lawyers to find out who has had previous experience in any given market. “You want to put in the time up front to find out whom you can call to get background checks, second opinions, and objective feedback,” he says.

If a newly hired manager suggests a local real-estate developer, for example, the CFO can tap into his or her network of contacts to find out if the developer is, in fact, better qualified than others or if there are other vendors worth meeting. To avoid offending the local manager by seeking alternatives, the CFO should make it clear that checking references or comparing multiple bids is standard procedure for the company. “You can say, ‘This is nothing personal, we’re just very control-oriented. We get multiple quotes in any vendor situation,'” says Harding. “A good CFO knows that part of the art of good management is getting what you want while communicating in a way that doesn’t offend or alarm.”

Doing such intensive due diligence takes longer than the month that might be dedicated to poring over the books of a U.S. company, and it often ends in a scuttled deal. Deloitte’s study found that 70 percent of respondents had walked away from a deal after conducting a thorough background investigation; 71 percent of the time, they abandoned the deal because of what they learned about the reputation of the principals. FCPA violations were uncovered nearly 20 percent of the time.

With so many pitfalls awaiting them, CFOs establishing or managing foreign subsidiaries should expect that things will go wrong. Harding suggests building in a buffer, budgeting 2 to 3 percent of international revenues to deal with potential regulatory hazards, accounting misjudgments, and other mishaps. If a problem does arise, an immediate, aggressive response is best. “You will probably use resources that are out of proportion to the size of the entity involved,” says Koch of AlixPartners. “You need to throw a lot of resources at these kinds of problems to wrestle them to the ground.”

Kate O’Sullivan is a senior writer at CFO.

A Window on Risk

The risks of operating foreign subsidiaries should be evaluated and managed just as other risks are, says Joel Kurtzman, a senior fellow at the Milken Institute. Companies first need to determine the level of risk in the locations where they choose to do business, and then make sure the reward justifies the risk incurred.

But how do you measure the risk? Kurtzman and Glenn Yago, director of capital studies at the Milken Institute, do so through an “opacity index.” They begin by assuming that the less transparency there is in a given economy, the greater the risk of doing business there. They then evaluate a country’s risk according to five areas of opacity: corruption, legal, enforcement, accounting, and regulatory. The result is a country’s “CLEAR” score.

An advantage of this approach is that it gives an appropriate weight to high-frequency, low-impact risks, says Kurtzman. “The old methods of looking at country risk were politically oriented. But for every high-impact, low-frequency event like a political coup, there are thousands of instances of corruption,” he says. “The high-frequency, low-impact risk can have a much greater effect on a business over the long term.”

According to Kurtzman and Yago’s index, a company making an investment in China should earn a premium of 6.5 percent over the U.S. rate of return for the same investment. By contrast, the same investment in the United Kingdom, which has a better CLEAR score than the United States, would need to earn about 1.7 percent less than the U.S. rate. Kurtzman and Yago’s approach is described in their recent book Global Edge: Using the Opacity Index to Manage the Risks of Cross-Border Business (Harvard Business School Press, 2007). — K.O’S.

Need Help?

If you’re new to the overseas game, you don’t have to go it alone.

Few companies have the resources or connections they need to conduct the due diligence on relationships that is recommended prior to completing an overseas acquisition. But there are several firms that have developed networks of contacts on the ground to provide these services.

• The BIG FOUR. Each of the largest accounting firms has a transaction advisory services practice that can conduct due diligence on overseas deals and advise on cross-border M&A.

• HIGH STREET PARTNERS. A small firm that relies on a network of carefully vetted local partners to provide back-office support to companies’ foreign subsidiaries.

• NAIR & CO. A boutique firm that provides general and administrative support to venture-backed and public companies establishing overseas operations.

• U.S. COMMERCIAL SERVICE. A division of the Department of Commerce that provides background and credit checks on international companies.

Additionally, many countries have reputable professional-services firms that specialize in helping U.S.-based companies get up and running overseas. — K.O’S.

Coming Clean

Transparency International, a global anticorruption organization, annually ranks 180 countries by their perceived levels of corruption, as determined by expert assessments and opinion surveys. For 2007, the United States ranked 20th (with the No. 1 rank going to the least corrupt country). China and India tied with Morocco, Mexico, Peru, and Suriname for 72nd place. Russia ranked a dismal 143rd. Here are the year’s best and worst: