The Sarbanes-Oxley Act requires all public companies to establish audit procedures for (1) the "receipt, retention and treatment" of employee complaints on internal accounting controls and auditing practices, and (2) the confidential, anonymous submission by employees of concerns regarding questionable accounting or auditing matters. [15 USC § 78j-1].
Whistleblower Programs
To comply with these requirements, public companies have established whistleblower programs in a variety of forms, depending upon the size and complexity of the company. As more whistleblower cases emerge and as employees increasingly allege whisteblower claims in response to legitimate disciplinary actions taken by employers, it is important to consider effective and lawful practices to provide for and respond to whistleblowing.
1. Reacting to Hotline Tips
When an employee submits a complaint through the company's whistleblower hotline, the company should:
- Immediately distribute the information according to the company's hotline plan, as described in more detail in Section 3 of this Article;
- Attempt to get complete and accurate information during the call or interview with the anonymous person;
- If the report is not anonymous or if the employee reveals his or her name, request that the employee put the complaint in writing so that there will be an exact record of the nature, scope and breadth of the accusation(s);
- Send any report of financial irregularities to the company's audit committee; and
- Consult with experienced outside counsel in connection with the investigation of the allegations.
In addition, companies should periodically review their personnel and employee handbooks to make certain they do not conflict with the whistleblower hotline process.
2. Develop an Effective Whistleblower Hotline Program
Recognizing the need for flexibility, the Securities and Exchange Commission ("SEC") did not adopt strict guidelines for whistleblower procedures. The SEC instead acknowledged that the procedures that will be most effective for a very small listed issuer with few employees may be very different from the procedures adopted by large, multi-national corporations. As a result, U.S. public companies are using a variety of approaches to establish their whistle-blower programs, depending upon the size and complexity of their organization.
One key to an effective hotline program is the ability to effectively receive, and quickly respond to, employee complaints. Enron whistleblower Sharon Watkins recently stated that Enron's lack of response to her concerns ultimately led her to seek help from the media.
Effective Hotline Program
Under Sarbanes-Oxley, a public company's audit committee is responsible for developing an effective hotline program, but not for receiving and handling each complaint. Small companies may implement a whistleblower system directing complaints to the attention of one designated person at the company.
That person can then promptly address the complaints and inform the audit committee of any material complaints. Often, corporate counsel is designated as the contact person in a small company.
If the audit committee of a small company designates corporate counsel to conduct internal investigations, corporate counsel may be able to claim the attorney-client privilege with respect to such investigations.
In addition, corporate counsel has the added advantage of handling the complaint with a view toward possible future litigation. The benefits of using corporate counsel for internal investigations, however, may be outweighed by the "up the ladder" reporting requirements under Section 205 of Sarbanes-Oxley.
If corporate counsel is designated to investigate whistleblower complaints, the reporting systems should have the capacity to maintain records of all messages submitted by whistleblowers, including the date and time the message was received. Such information could be critical in the event of future litigation.
A potential disadvantage to using corporate counsel is that in later litigation in which the adequacy of the company's investigation of a complaint is at issue, the company may be forced to waive the attorney-client privilege in order to introduce evidence that it timely and properly investigated the complaint.
Large and complex organizations often hire outside contractors to receive complaints. Outside contractors can help ease employee fears about anonymity and confidentiality, handle complaints 24 hours a day, 7 days a week, and offer a wide range of communication alternatives, including e-mail, web forms or telephone hotlines.
Disadvantages associated with the outside vendor hotline system include the risk that the attorney-client privilege will not apply to the investigation. Information sent to an outside vendor is discoverable and could be a "smoking gun." In addition, the company cannot control the behavior of the vendor in the event of a subpoena or government investigation, and the company may be liable in the event of errors by the outside vendor, which generally is less familiar with the company's business.
Smaller companies who are more prone to use an outside vendor may lack the bargaining leverage to obtain indemnity provisions in their contracts with the outside vendor. Even in the absence of such provisions, however, there may be grounds to bring claims against the outside vendor for mistakes that could lead to liability by the company.
The company should make note of and retain all marketing materials and representations by the outside vendor of its experience and skill in handling Sarbanes-Oxley hotline services.
Some companies instead elect to have direct reporting to the Board of Directors. General Electric, for example, directs all complaints to the presiding director and chairman of the audit committee. Other companies designate ombudsmen from the legal and finance departments to receive and investigate employee complaints. The downside to this approach is that usually very few complaints are serious enough to warrant the audit committee's attention.
No matter what hotline system a company chooses, the company should ensure that the information is communicated for a top-level review and that there is a system of checks and balances between the compliance officer and the appropriate company division involved in the complaint.
3. Ensure Anonymity and Confidentiality
Some companies, perhaps because of their experience in dealing with sexual harassment investigations, promise anonymity for a complainant only to the extent it is feasible or that it will not compromise the investigation of the complaint.
The Sarbanes-Oxley Act requires anonymous and confidential reporting for employees that is more stringent than other areas of employment law, which at times may necessitate that the subject of an investigation receive notice of the specifics of the allegations against him or her.
Employees and board members must be trained to understand the whistleblower hotline program and the protections given to employees under the Sarbanes-Oxley Act. For example, neither a public company nor its officers, employees, contractors, subcontractors or agents can discharge, demote, suspend, threaten, harass or in any way discriminate against an employee because the employee provided information or assisted in an investigation the employee reasonably believed to be in violation of any law relating to fraud against shareholders.
Whistleblowers are protected even if their report of wrongdoing is incorrect, so long as they reasonably believed that a violation had occurred.
In order to comply with the employee protection provisions of Sarbanes-Oxley, the company should include the whistleblower protections in its broader ethics policy and should define the role of each board member, officer or employee in the whistleblower investigation process. [Also see Dodd-Frank Act, Section 922]
The company should have training and refresher programs on a regular basis, and require that board members, officers and employees attend such training. The company should maintain a roster of training session attendees along with the training materials used or distributed at each training session.
In addition, each employee should sign an acknowledgement form confirming his or her attendance, and copies of those forms should be placed in each employee's personnel file. Training should be conducted in a language that the employees understand. The criminal penalties for violations provide a powerful incentive for employee attention during training.
4. Promote a Culture that Encourages Complaints
In order to ensure the effectiveness of a complaint reporting system and to prevent retaliation claims, companies should promote a corporate culture that encourages employees to make complaints. Managers should be counseled that employee complaints are opportunities for improvement.
As with other activity protected by law, such as discrimination, health, safety or environmental complaints, co-workers and supervisors must be trained that their initial and instinctive reaction to complaints must not be resentment or hostility. Instead, they should thank the complaining party, follow up in a non-threatening way, and be extra careful to refrain from doing anything that might be interpreted as retaliatory.
By maintaining such a culture, claims can be avoided and employees will be more comfortable in raising concerns informally and resolving matters within the company's management structure, lessening the need to resort to the whistleblowing protections of Sarbanes-Oxley.
If there are employees who are known to have made Sarbanes-Oxley complaints, an appropriate company representative should check back with them periodically, perhaps 60 or 90 days later, to make sure that they do not feel that they have been retaliated against and make a record of the follow-up check. If the employee reports retaliation, an appropriate follow-up investigation should be conducted by the company's general counsel.
The company should maintain a confidential recordkeeping system that will enable it to review the subsequent employment history of employees who have raised (non-anonymous) whistleblowing concerns so that it can document that it has treated those employees favorably.
Examples of continued employment, pay raises, training opportunities, promotions, and other favorable treatment of employees after they have engaged in whistleblowing can help defend against whistleblowing claims by others.
The company will be able to point to its favorable treatment of whistleblowers that should demonstrate that an adverse action against a claimant was not due to whistleblowing, but due to legitimate job performance or misconduct factors.
As in other areas of employment law, maintaining contemporaneous documentation of poor performance and misconduct is crucial to demonstrating that unlawful retaliation has not occurred.