Crisis in Ukraine – update for Heads of Internal Audit
Crisis in Ukraine – update for Heads of Internal Audit
During the last month, we have seen the rapid escalation of Russian hostilities in Ukraine. Part of the response of many countries around the world has been to increase sanctions against Russia and Belarus. The impact of this is wide-ranging for any organisations that have links to either of these countries, requiring them to urgently review their business relationships to comply with the precise legal requirements which have been changing almost daily. Reputationally, this is also critical. Organisations with ties to Russia and Belarus are being called out daily in the media to explain their position and the steps they are taking to cease operations in these countries.
The legal position
Sanctions have been in place against Russia since 2014, following the annexation of Crimea and Russian-backed separatist activity in the Donbas region of Ukraine. When the UK was a member of the European Union (EU), the sanctions regime was determined by the EU Sectoral Sanctions, imposing restrictions on lending and capital access for specified Russian banks and curtailing access to certain technologies that can be used for oil exploration and production.
The basis of the UK’s current legal position on sanctions in relation to Russia is set out in the Russia (Sanctions) (EU Exit) Regulations 2019 (SI 2019/855) (“Russia Regulations 2019”). This was the first legislative measure to impose sanctions on Russia introduced following the UK’s exit from the EU and came into force on 31 December 2020. In April 2021, the sanctions regime was extended under the Global Anti-Corruption Sanctions Regulations 2021, allowing the UK Government to impose restrictions on individuals and entities suspected to be directly or indirectly involved in serious corruption – specifically bribery and misappropriation of property. The regime extends beyond foreign public officials and comprises anyone suspected to be an “involved person”.
In recent months, as the current crisis in Ukraine has evolved, the UK Government has introduced further sanctions legislation. The Russia (Sanctions) (EU Exit) (Amendment) Regulations 2022 (SI 2022 No.123) amends the Russia regulations 2019 and expand the definition of an “involved person” to include an individual who “is or has been involved in…obtaining a benefit from or supporting the Government of Russia.” This came into force from February 2022 and includes individuals and entities:
- Carrying on business as an entity affiliated with the Government of Russia
- Carrying on business of economic significance to the Government of Russia
- Carrying on business in a sector of strategic significance to the Government of Russia (chemicals, construction, defence, electronics, energy, extractives, financial services, information, communications, digital technologies and transport)
- Owning or controlling, directly or indirectly, or working as a director (whether executive or non-executive), trustee, or equivalent, of any such business.
Additional sanctions were imposed during February and March 2022, beginning with sanctions on five Russian banks and three high net worth individuals, and followed up by the following measures:
- The Russia (Sanctions) (EU Exit) (Amendment) (No. 2) Regulations 2022 (SI 2022/194) extend existing restrictions on dealing with certain financial instruments, providing loans and credit, on correspondent banking relationships, and to the processing of sterling payments.
- The Russia (Sanctions) (EU Exit) (Amendment) (No. 3) Regulations 2022 (SI 2022/195) expand restrictions on the export, supply and delivery of military goods to include dual-use goods and critical-industry goods, including technology.
- The Russia (Sanctions) (EU Exit) (Amendment) (No.4) Regulations 2022 (SI 2022/203) prohibit Russian ships, ships owned, controlled or operated by a designated person and other specified ships from accessing or entering UK ports.
- The Russia (Sanctions) (EU Exit) (Amendment) (No. 5) Regulations 2022 (SI 2022/205) prohibit a UK individual or entity from providing financial services for the purpose of foreign exchange reserve and asset management to the Central Bank of the Russian Federation, the National Wealth Fund of the Russian Federation, the Ministry of Finance of the Russian Federation, a person owned or controlled directly or indirectly by any of the persons above, or anyone acting on behalf of or at the direction of any of the persons above.
- The Russia (Sanctions) (EU Exit) (Amendment) (No. 6) Regulations 2022 (SI 2022/205) introduce new and amended prohibitions on aviation, shipping and trade.
Specific restrictions and asset freezes have similarly been imposed through notices issued by the UK Office of Financial Sanctions Implementation against Russian banks, its Sovereign wealth fund, aircraft-related businesses and named individuals. In addition to this, detailed guidance has been issued by the UK Government Department for Internal Trade (DIT) and the Department for Transport (DfT).
The Republic of Belarus is also subject to UK sanctions. The Republic of Belarus (Sanctions) (EU Exit) Regulations 2019, Sanctions (EU exit) (Miscellaneous Amendments) (No.2) Regulations 2020, Sanctions (EU exit) (Miscellaneous Amendments) (No.4) Regulations 2020, the Republic of Belarus (Sanctions) (EU Exit) (Amendment) (No.2) Regulations 2021 specify the legislation relevant to restrictions imposed on Belarus. The sanctions were initially imposed to encourage a change in behaviour and policy of the Belarusian State, which were considered contrary to UK security policy and interests. Recent extensions to the sanctions regime are linked to the Belarus State’s support of the Russian invasion of Ukraine.
In addition to the UK sanctions regime, the European Union, United States, and many other countries have their own sanctions regimes. Businesses that are trading globally or have overseas subsidiaries and interests need to ensure they are fully aware of this complex web of legislation. This is a fast-moving situation and further restrictions are likely to be imposed. With the risk of significant fines or custodial sentences of between 7-10 years for breaches of the UK sanctions regime, organisations need to strengthen their controls to identify and comply with the sanctions that may apply to their activities.
What this means for Heads of Internal Audit
The crisis in Ukraine will be top of the agenda for many Audit Committees, and Heads of Internal Audit will be expected to provide assurance that their organisation is responding appropriately. This will include legal, reputational and operational impacts. The crisis will affect each organisation differently - depending upon the closeness of any ties to Ukraine or the sanctioned countries.
Where the organisation has employees in Ukraine, the priority will be their welfare and steps will need to be taken to channel support to them. Ukraine is a major global supplier of raw materials and agricultural products to UK businesses. These supplies are being disrupted significantly, causing shortages and rising prices that need to be managed for those organisations with a high dependence on Ukraine supply chains.
Organisations owned or controlled by sanctioned individuals or entities are having their assets ‘frozen’ and their activities severely restricted. Directors are being disqualified. Businesses with investments in Russia or Belarus are looking to terminate agreements in these countries. Losses could be considerable.
Many groups have operations in Russia or Belarus. Action will need to be taken to bring these to an end. In some cases, this will have a significant impact on the resilience of the business model that will need to be carefully managed. As these organisations look to terminate their operations, they will also wish to support their employees in these countries. Their ability to do so will be increasingly limited as sanctions begin to bite and they can no longer transfer funds into the sanctioned countries.
Even more organisations have customers or suppliers with links to Russia or Belarus. Recent reports suggest that numerous councils, schools and NHS trusts obtain their energy supplies from Gazprom. Gazprom also supplied more than 177,000 commercial customer sites in 2020 - indicating that the private sector impact will be significant as steps are taken to terminate supplier contracts.
A structured and carefully managed approach needs to be adopted and Heads of Internal Audit can provide useful assurance that this is the case. As a starting point, organisations need to undertake a full inventory of their links to Ukraine and related sanctioned countries. This must include all customers and suppliers so that the organisation has a complete understanding of the potential impact of the crisis and can take appropriate steps to address legal, reputational, and operational issues.
This is a complex matter - terminating contracts and ceasing operations is not straightforward. For example, in some cases such as complex franchise agreements, termination is difficult to enforce. Crisis management strategies need to be established, involving members of senior management, communications advisors, legal and operational experts. External advisors may need to be consulted as part of this process. Given the increase in cyber attacks linked to the crisis, organisations should also reassess their defences and ability to respond to a ransomware/malware incident.
The sanctions landscape is changing daily as new restrictions are introduced. Mechanisms need to be established to keep track of these and their impact. Due diligence over relationships with customers and suppliers also needs to be enhanced to ensure any new business contacts do not have links to the sanctioned countries.
Where an organisation is closely linked to Ukraine, Russia or Belarus, the impact is likely to be significant. This may bring the resilience of the business model into question, requiring scenario planning to be undertaken to determine the short- and long-term impacts, together with the action required to enable the business to survive.
References:
ICAEW- CCAB sanctions guide – March 2022
UK Government- Belarus sanctions guidance - March 2022
Linklaters- Sanctions update – March 2022
Linklaters- UK adopts bespoke sanctions regime - May 2021
Law Gazette – wind down of operations in Russia
Shell, BP, Exxon Mobil withdrawal from Russia
Daily Telegraph - Councils cutting contracts with Gazprom- March 2022