This case involves a large computer software company accused of violating the Foreign Corrupt Practices Act (FCPA). It was alleged that the company in question restructured its cybersecurity systems to prevent the detection of questionable payments. A group of employees came forward about this alleged misconduct and were immediately terminated. An expert in cybersecurity and corporate risk management was sought to review the systems and determine whether or not the employees’ claims were true.
Question(s) For Expert Witness
1. Please describe your experience in corporate risk management, specifically with corporate incident reports for employees.
Expert Witness Response E-188551
I hold a Ph.D. in criminal justice and serve as a senior criminal justice faculty member at a university. I also serve as a director and manager for a cybersecurity lab. I am a trained mediator and serve as such for the human resources department at the university where I am employed. I have made risk-related recommendations to university administration. In the private sector, I owned and operated a private investigations firm that was hired by companies to assess risk and make recommendations to ownership and/or management. I also investigated complaints in the public and private sectors. In the past, companies hired me to investigate risk issues within their organizations. I have investigated employees for theft, embezzlement, and misconduct as defined by the policies and procedures for each company that retained me. I was consulted to determine if employees were causing or involved in risky situations and make recommendations for appropriate action to the company leaders. I also ran my own private investigations firm and had to be familiar with policies and procedures for dealing with risk issues as governed by a state private security act. Currently, I train police officers and correctional personnel in ethical-related decision making, and I have authored a textbook on ethics in the criminal justice system. In both the private and public sectors, I have dealt with staff violating policies and procedures, as well as state law, to investigate incidents of risk and make recommendations to the agency. The employer should thoroughly investigate the incident, document the findings, and be prepared to contact law enforcement. Should it be necessary, the company should also provide law enforcement with the results and documentation from their investigation. The report must contain thorough documentation of the facts, including from witnesses and additional parties as necessary, to determine whether the matter will be pursued further within the company or within the criminal justice system.
About the author
John Lomicky
John Lomicky is a J.D. candidate at FSU Law with a multidisciplinary background. He earned his Bachelor's degree in Neurobiology and Near Eastern Studies from Georgetown University and has graduate degrees in International Business and Eurasian Studies. John's professional experience includes working in private equity as an Associate at Kingfish Group and in legal business development and research roles at the Expert Institute. His expertise spans managing sales teams, company expansion, and providing consultative services to legal practices in various fields.
