The Subsidiary That Kept Selling
A European industrial group discovers during an internal audit that its Turkish subsidiary sold €3.4m of machinery components over 18 months to a customer that was added to a sanctions list eight months into that period. The subsidiary's local manager says he was unaware of the listing, that the components are 'general purpose', and that the parent's screening tool was not deployed in Turkey because the subsidiary used a local system with no consolidated-list feed. The parent's group sanctions policy states that all subsidiaries must apply the group standard. No one at group level reviewed the subsidiary's screening configuration after a 2021 acquisition. Two shipments occurred after the listing date. The group's audit committee wants to know exposure and remediation.
1. Assess the group's exposure and identify the root-cause control failures.
Read the worked answer
Exposure: the two post-listing shipments are the clearest breaches - making goods available to a designated person. The pre-listing shipments are not breaches but may be relevant to intent and to any 'knowledge' assessment. The parent's exposure arises because its own policy applied group-wide and it failed to enforce it; 'the subsidiary didn't know' is undermined by the parent's documented standard.
Root-cause failures:
- M&A integration gap - no sanctions control review of the acquired subsidiary's screening tooling in 2021.
- Tooling failure - local system lacked a consolidated-list feed, so screening was structurally incapable of catching the listing.
- No group oversight - no periodic assurance over subsidiary screening configuration.
- Training/knowledge - local manager unaware of a listing affecting an active customer; no alerting process.
- Escalation - no mechanism for the subsidiary to surface customer changes to group compliance.
2. What immediate and structural remediation should the group undertake, and what should it consider disclosing?
Read the worked answer
Immediate:
- Stop all shipments to the customer and freeze the relationship pending review.
- Preserve records and conduct a scoped investigation of all subsidiary transactions with the customer.
- Assess whether any goods are restricted and whether any exemption/licence could apply (generally none for post-listing supply to a designated person).
Structural:
- Deploy the group screening tool (with consolidated-list feeds) across all subsidiaries; retire or integrate the local system.
- Add sanctions control review to the M&A integration checklist.
- Introduce group-level assurance/testing of subsidiary screening configurations.
- Mandatory training and a customer-status alerting process.
Disclosure: consider a voluntary self-disclosure to the relevant competent authority, supported by the investigation findings and remediation plan. Voluntary disclosure and prompt remediation are typically mitigating factors; concealment is aggravating.