Skip to main content
NFRisk Non-Financial Risk advisory Start a Conversation
NFR-0014 Evidence-controlled risk scenario

Siemens AG

When bribery became systematic, could the control environment still function?

Siemens AG and three subsidiaries pleaded guilty to FCPA-related offences in 2008; coordinated US and German resolutions exceeded $1.6 billion and included a four-year independent compliance monitor.

Financial Crime & Control Integrity Conduct & Governance Risk Data & Control Integrity Bribery & corruption Third-party risk Conduct & incentives Governance & escalation Data integrity Control assurance

Documented impact

$1.6bn Coordinated US and German resolutions exceeded this value
$450m Combined DOJ criminal fines
$350m SEC disgorgement
4 years Independent compliance monitor

Authoritative findings

The documented event

On 15 December 2008, Siemens AG and three subsidiaries pleaded guilty before US District Judge Richard J. Leon to FCPA violations and related charges. Siemens AG itself pleaded guilty to a two-count information charging criminal violations of the FCPA's internal-controls and books-and-records provisions. The coordinated DOJ, SEC and Munich resolutions exceeded $1.6 billion, including $450 million in combined DOJ criminal fines and $350 million in SEC disgorgement. The SEC alleged that, between 12 March 2001 and 30 September 2007, Siemens engaged in a systematic practice involving more than $1.4 billion in bribes across Asia, Africa, Europe, the Middle East and the Americas, using elaborate payment schemes, slush funds, off-books accounts, intermediaries and cash desks. The SEC attributed the conduct to inadequate internal controls and a tone at the top in which bribery was tolerated. Siemens agreed to retain an independent compliance monitor for four years.

Hypothetical institutional scenario

How might the same control pattern appear?

A global business uses intermediaries, cash-based mechanisms and informal approvals to win work in higher-risk markets. The formal compliance programme remains in place, but exceptions are normalised and the actual payment routes sit outside its reliable line of sight. Senior leaders receive fragments of the pattern without a consolidated view of how the mechanisms operate across countries and business units.

Stress-test questions

Questions for challenge and assurance

  1. Operations

    Can cash desks, intermediary payments or local exceptions move value outside the standard approval and monitoring path?

  2. Audit

    Can the organisation trace higher-risk third-party payments to their economic purpose, beneficial recipient, approval evidence and accounting treatment?

  3. Risk committee

    Does compliance have the information and authority to stop commercially successful conduct, including where senior business leaders support it?

  4. Board

    What evidence shows that tone at the top is reflected in payment decisions, disciplinary outcomes and control exceptions rather than only policy statements?

NFRisk practitioner interpretation

Control implication

A formal compliance programme cannot compensate for a control environment that does not govern how money actually moves. Assurance should follow payments through intermediaries, cash mechanisms, off-books structures and local exceptions; test whether books and records reflect economic purpose; and assess whether compliance has the authority, information and escalation route needed to interrupt commercially successful conduct.

Framework relevance

Explicitly labelled analytical mappings

NFRisk analytical mapping

COSO ERM lens: Governance & Culture

NFRisk maps the SEC's findings on tone at the top, tolerated conduct and inadequate internal controls to COSO's Governance & Culture component. This is a retrospective analytical mapping, not an SEC or COSO finding about Siemens.

Enterprise Risk Management - Integrating with Strategy and Performance · Committee of Sponsoring Organizations of the Treadway Commission (COSO)

Evidence register

Primary and supporting sources

  1. US Department of Justice

    Siemens AG and Three Subsidiaries Plead Guilty to Foreign Corrupt Practices Act Violations and Agree to Pay $450 Million in Combined Criminal Fines (opens in a new tab) 15 December 2008 · Authoritative primary source

  2. US Securities and Exchange Commission

    SEC Charges Siemens AG for Engaging in Worldwide Bribery (opens in a new tab) 15 December 2008 · Authoritative primary source

  3. US Securities and Exchange Commission

    Statement at News Conference Announcing Siemens AG Settlement (opens in a new tab) 15 December 2008 · Authoritative primary source

  4. COSO

    Enterprise Risk Management - Integrating with Strategy and Performance (opens in a new tab) 1 June 2017 · Authoritative primary source

Publication note

A documented external event—not an NFRisk client engagement.

The named organisations are included because authoritative sources document the event. Their inclusion does not imply that they are or were NFRisk clients, that they endorse this analysis, or that NFRisk participated in the event or response. Framework relevance and NFRisk practitioner interpretation are analytical layers applied after the event.

Return to the Risk Scenario Library

From scenario to mandate

Test the equivalent control assumption in your environment.

NFRisk can use this scenario as a starting point for a focused structural diagnostic, risk-architecture review or delivery-assurance discussion.

Start a conversation