What internal control weakness at Netflix allowed its former VP of IT operations to allegedly receive kickbacks from technology firms?

In November 24, 2014, Netflix filed a lawsuit against its former vice president of IT operations, Mike Kail, alleging fraud, breach of fiduciary duties, and other charges.  Here is an excerpt from the lawsuit filing in  Superior Court of the State of California, Santa Clara County:.

“…During his tenure at Netflix, including as Netflix’s Vice President of Information Technology Operations, Kail was a trusted senior-level Netflix employee.  Kail’s job responsibilities at Netflix included negotiating and executing contracts on behalf of Netflix to acquire IT-related products and services…approving invoices for payments that third parties would request related to IT products and services purchased by Netflix….after Kail approved such invoices, Netflix would pay the third parties for these approved invoices. Kail was a trusted, senior-level Netflix employee, with authority to enter into appropriate contracts and approve appropriate invoices.” (See entire legal document at http://www.scribd.com/doc/248259590/Netflix-v-Kail.)

Netflix is suing Mr. Kail for fraud, breach of fiduciary duties, and other actions.  Mr. Kail was in charge of entering into and authorizing contracts for Netflix’s tech vendors, which included two companies, Vistara IT and Netenrich (both founded/owned by Mr. Raju Chekuri.)  At the same time, Mr. Kail had his own company on the side called Unix Mercenary, which he did not disclose to Netflix.

Mr. Kail’s company Unix Mercenary received 12 – 15% commissions on all contract invoices paid by Netflix to Vistara IT and Netenrich.  Part of the evidence that Netflix outlines in its lawsuit are emails between Mr. Kail and employees of Netenrich which refer to “referral fees” from Netenrich to Unix.  Here is an excerpt from an email from Netenrich to Kail (from the above-mentioned lawsuit filing):

…”[We] discussed getting you paid and I just need to ensure the payments from Netflix are in Netenrich’s bank account…I suggest we employ the following process to ensure you receive your referral fees on a timely basis…”

Over a three year period, Netflix paid approximately $3.7 million to Vistara IT and Netenrich, which would translate into commission payments of between $440,000 – $550,000 to Unix Mercenary.  The lawsuit only mentions specific payments of $76,000 to Unix Mercenary.

Incidentally, Mike Kail left Netflix in August 2014 to become Yahoo’s Chief Information Officer (CIO).

Questions

1. What internal control principle(s) does it appear was (were) violated at Netflix?
2. How might Netflix have designed its internal processes differently to avoid the situation that arose with Mr. Kail?
3. Should Mr. Kail be held totally liable for this situation? Does Netflix have any degree of responsibility in this situation?