PE Firms: Considerations for Addressing Fraud at Portfolio Companies

Private equity (“PE”) firms managed to weather the storm of economic uncertainty in 2020—with a 6% increase in exit value across 952 exits.^[1] However, the pressure to deploy capital and create value continues to grow as firms face unprecedented challenges, including the potential liability for fraud at portfolio companies and the increasing threat of cyberattacks.

Liability for Fraud at Portfolio Companies

An ongoing lawsuit in Massachusetts provides another example of PE firms no longer being shielded from fraud committed at a portfolio company.^[2] In U.S. ex rel. Martino-Fleming v. S. Bay Mental Health Centers (D. Mass.)^[3], the PE firm defendant was denied a motion for summary judgment in a False Claims Act matter in which it was argued that a PE firm can be held responsible for fraud because it had sufficient awareness of regulatory non-compliance and permitted allegedly false claims to be submitted, despite being in a position to put to an end to the practice (since it had seats on the board).^[4]

Cyberattacks on the Rise

PE-owned companies continue to be a popular target for cybercriminals due to their deep pockets and strong aversion to bad publicity.^[5] Overall, we continue to see cybercrime on the rise; ransomware attacks increased by 171% in 2020, to more than $300k per attack, with experts expecting that trend to continue.^[6]

How PE Firms Can Respond

If a PE firm has a controlling interest in a portfolio company, there are several steps it can take to help prevent and more easily detect fraud:

• Perform periodic risk assessments (fraud, cyber, data privacy).
• Formalize the compliance program by defining roles and responsibilities as well as documenting policies, procedures and controls.
• Ensure that management’s tone frequently and consistently reinforces integrity and that employees are encouraged to speak up about pressures and performance goals.
• Implement and periodically test anti-fraud internal controls, addressing:
  • Use of authorizations, proper separation of duties.
  • Payments, with a focus on rules regarding multi-factor authentication and verbal confirmations.
  • Third-party risk management (vendor due diligence and ongoing monitoring, vendor add, periodic review of vendor master list).
  • Payroll (add, changes and periodic review).
  • New employee screening (background checks, education verification).
  • Incident reporting mechanisms (awareness, anonymity, independence, non-retaliation).
• Implement ongoing compliance monitoring and process evaluation to test program effectiveness.
• Implement ongoing monitoring of IT security, including periodic phishing simulations and dark web scanning.
• Perform periodic fraud and cyber awareness training (targeted audience, provide relevant examples).

By enhancing compliance programs to address fraud, cyber and other regulatory risks, PE firms can mitigate risk by making themselves less-attractive targets to bad actors. y enhancing compliance programs to address fraud, cyber and other regulatory risks, PE firms can mitigate risk by making themselves less-attractive targets to bad actors. 

[1] US Private Equity Activity Rebounded to Healthy Levels in 2020 Despite COVID-19 Headwinds | PitchBook

[2] Bloomberg: Private Equity Loses Its Shield as U.S. Cracks Down on Fraud – Private Equity Stakeholder Project (pestakeholder.org)

[3] Civil Action No. 15-cv-13065-PBS 05-19-2021

[4] Private Equity in the Crosshairs as Qui Tam Case Heads Toward Trial - False Claims Act Law Firm - Call | 215-320-6200 [falseclaimsact.com]

[5] Private Equity Is a Big Target for Ransomware Attacks - Bloomberg

[6] Highlights from the 2021 Unit 42 Ransomware Threat Report (paloaltonetworks.com)