The Rule
Section 922 of the Dodd-Frank Act of 2010 requires that the Securities and Exchange Commission adopt rules that encourage persons, through financial incentives, to report possible federal securities law violations to the SEC. After much back and forth with the business community, the plaintiff’s bar, the media and internally, the SEC adopted final rules on May 25th.
The SEC’s 300+ page adopting release goes into great detail regarding the many nuances of the rule. For example, the release defines “whistleblower,” “voluntarily,” “original information” and “action.” It describes what is meant by information leading to a successful enforcement action, what kind of awards are included in the $1 million calculation and the persons excluded from eligibility to receive an award, such as compliance personnel, attorneys and outside accountants. The release also describes the enhanced employee anti-retaliation protections and rights contained in the final rules.
A particularly contentious issue during the rulemaking process was the extent to which the new rules would discourage employees from utilizing a company’s existing internal reporting procedures. Companies are understandably concerned that their employees will ignore internal reporting processes and go directly to the SEC with exaggerated claims or imagined wrongdoing in hopes of tapping the whistleblower award vein. Most companies believe, and we agree, that utilizing an effective internal reporting process enables the company to minimize frivolous claims and discretely address claims with actual substance.
The SEC rejected calls to require that whistleblowers first use the internal process before reporting to the SEC. However, the rules attempt to mitigate this concern by stating that the amount of any award would be increased or decreased (within the 10% to 30% parameters) in the SEC’s discretion depending on whether the whistleblower first participated in the company’s internal reporting system and assisted with any internal investigation.
The Response
So, what should you do in response to the new rules? A natural first reaction would be to ignore the rules and hope that the whole thing blows over. After all, unlike many of the Dodd-Frank provisions and related rulemaking, these rules do not require affirmative action by public companies. Why not just take a low key approach and assume that your employees either will not hear about the rules or, if they do, will be overwhelmed by their complexity or simply forget about them over time? Didn’t the Internal Revenue Service implement a whistleblower reward program back in 2006 that initially got a lot of press but, in fact, has almost never been utilized?
Unfortunately, that is exactly the wrong approach. The reality is that employees will be constantly reminded of the award opportunities by plaintiffs lawyers who will specialize in earning fees by recruiting or encouraging whistleblower clients. We have already seen television commercials, other advertisements and websites from plaintiffs lawyers touting their ability to navigate the SEC’s reporting process and obtain large awards. Less sophisticated employees may be see this as the equivalent of a lottery—the odds may be long, but the potential payoff is huge, so why not take a shot, particularly since there is anti-retaliation protection? In fact, the SEC, which expects to receive 30,000 tips per year, has formed an Office of the Whistleblower to handle the anticipated deluge of reports.
1. Proactive Communication. Companies should instead be proactive. You will be better served to get out in front of this development and manage the tone and content of information that your employees receive. This is also a perfect opportunity to reinforce your compliance culture from top to bottom. Communicate with your employees soon to encourage the use of your internal reporting process. Rather than sending a boring memo that no one reads, be creative in how you communicate. Use newsletters, regular employee meetings, workplace posters or other techniques and communication channels that already exist and are proven to be effective.
Some companies may choose to include in their communication a reference to the new whistleblower rules and specific reasons why it is more advantageous to the employee to utilize internal reporting. This type of communication could be the most effective way to make your case for internal reporting and protect against the concerns described above. However, we believe that this level of communication, particularly initially, is somewhat aggressive and best used by companies that are particularly concerned about the prospects of SEC whistleblowing, perhaps due to prior wrongdoings within the company, a history of frequent internal reporting or the nature of their industry.
2. Update the Internal Reporting Process. Next, be sure that your reporting process actually works the way you think it does. Is reporting easy and accessible? Companies should have multiple reporting methods because the circumstances under which a report may be made are so varied. For example, many employees are uncomfortable leaving a message on a hotline or directly contacting a designated Ethics Officer. Allow employees the option of reporting to a designated supervisor within their department or division. Consider adding an anonymous email or website as alternatives. If you have international operations, offer appropriate language alternatives and be cognizant of time zone differences. Foreign nationals are eligible to receive awards, and plaintiffs’ firms have already started targeting this audience. And review your Code of Conduct to be sure it correctly describes the process and conveys the desired tone.
3. Personnel Training. It is critical that managers be trained to be receptive to employee concerns, recognize an internal report and know how to react. Their initial reaction to the employee is critical to setting a positive tone and discouraging external reporting. Employees should not be made to feel that they are imposing on their superiors or being disloyal to the company by making a report. Managers also must understand not only the legal retaliation prohibitions, but also how to avoid even the hint of retaliatory conduct, and must be trained to promptly communicate the report up through proper channels.
4. Investigative Process. Once a report has been received and properly communicated within your company, you must be prepared to evaluate whether the report warrants an investigation and, if so, the nature and scope of the investigation. There are many sensitive questions to be addressed at this stage regarding who should conduct the investigation, attorney/client privileges, whether the Board of Directors should be informed, whether public disclosures are required, and the like. Be sure that you have an investigation plan or protocol in place to quickly evaluate these issues and conduct any investigation. The new rules state that if a whistleblower reports to the SEC no later than 120 days following his initial internal report to the company, then the date of his SEC report is deemed to be the date of that initial internal report. Therefore, it is critical to complete your investigation well within the 120-day period so that the employee is not compelled to report to the SEC to maintain “first in line” status.
5. Report Back to the Whistleblower. Finally, remember that employees should receive a final report regarding the process that was followed to consider their report, the decision that was made and the reasoning behind the course of action chosen. The report need not be formal or written, although you should document for your files the nature and content of the communication. Most employees just want to believe that they have been heard and taken seriously. Do not leave them in the dark wondering if their report disappeared into a corporate black hole.
Conclusion
This as an excellent opportunity to reinvigorate what has been a neglected area of compliance, communication and training for many companies. By carefully considering your circumstances and devising a proactive approach to employee communication, training and internal reporting processes, most companies should be minimally impacted by the SEC’s new whistleblower rules.
Additional Articles from the Summer 2011 Public Company Forum:
Introduction
Risky Business: Effective Compliance Programs
Dodd-Frank Act Progress Report: Summer 2011