For organizations falling within the reach of the U.S. Foreign Corrupt Practices Act, the worry is that there is no business necessity exception and no affirmative defense.
Nor, for the regulators, is there a materiality requirement: they will enforce the statute on big (they like big) as well as small infractions (in the tens of thousands of dollars).
There can be individual personal as well as corporate liability, civil as well as criminal penalties, and monetary as well as non-monetary damages (including potential jail time for the individuals involved).
You are responsible for not only the actions of your own organization and employees, but those of your agents and business partners (and those at the organizations that you may purchase).
Your organization may purchase Directors and Officers (D&O) Liability insurance, which may help with some of the defense costs (it depends) and potentially some nominal personal civil penalties.
But the reality is that no insurance company is going to go to jail for an offender, salvage the reputation of an individual or organization or pay multi-million (or billion) dollar criminal penalties.