5 steps to protect against whistleblowers

GCs must improve internal policies and processes to encourage internal reports

In August 2011, the controversial Dodd-Frank whistleblower rules took effect, raising concerns that the number of employees reporting corporate wrongdoing to the government, already growing as a result of the incentives under the False Claims Act and other statutes, would mushroom out of control.

While the Sarbanes-Oxley Act (SOX) encouraged whistleblowers to come forward by creating both civil and criminal retaliation enforcement regimes to protect those who report corporate fraud, the Dodd-Frank Wall Street Reform and Consumer Protection Act added a powerful incentive, offering whistleblowers between 10 percent and 30 percent of any recovery of more than $1 million in penalties.

It’s too early to assess the impact. During the first seven weeks the Dodd-Frank rules were in effect, whistleblowers filed 334 reports of alleged securities law and Foreign Corrupt Practices Act (FCPA) violations, according to the Securities and Exchange Commission’s (SEC) 2011 annual whistleblower report. Some experts warn that once the SEC starts issuing awards to whistleblowers, publicity about the amount of money at play will accelerate the filing of claims. But the true scope won’t be known until the SEC releases its 2012 whistleblower report in November.

An intense campaign by the Association of Corporate Counsel (ACC) and other business groups to have the rules require employees to report wrongdoing internally before going to the SEC failed. Instead, the rules say that one factor that weighs in favor of a higher award is whether the whistleblower used internal compliance processes. Conversely, a whistleblower who interfered with such processes may receive a lower award. No one thinks those provisions will have much impact, so general counsel are looking for ways to improve internal policies and processes to encourage internal reports.

“The company has a clear self-interest in disincentivizing a whistleblower from going public, so it has to incentivize him to make an internal complaint instead of running to the government and cashing out,” says Jerry Bernstein, a partner at Blank Rome.

For many companies, that involves putting a new emphasis on ideals that have languished in long-forgotten codes of conduct and revising internal investigation and training programs. On the following pages, outside counsel offer specific suggestions for discouraging whistleblowing.

1. Communicate, Communicate 

Recent studies indicate that employees have a pretty low opinion of their employers when it comes to the issues involved in whistleblower complaints. According to the National Business Ethics Survey, which the Ethics Resource Center released in January, 13 percent of employees surveyed felt pressure to compromise standards, while 22 percent of those who reported misconduct said they were retaliated against. Thirty-four percent said their managers do not display ethical behavior.

So while a culture of compliance may seem like a cliché, it is clearly missing in many workplaces. Employees who don’t believe management is committed to compliance, and those who fear retaliation for bringing issues to light, are less likely to help the company solve its problems and more likely to take their complaints to Uncle Sam.

To protect against that, “make the culture of compliance a strategic priority,” advises Gregory Keating, a Littler Mendelson shareholder. While many companies give lip service to that concept, the board of directors and senior management need to take concrete steps to make sure ethics and compliance is a top priority. An employee survey by an outside consultant assessing employees’ trust in management and the likelihood they will turn against it can provide the ammunition for convincing the board that a compliance campaign is needed, Keating adds.

To demonstrate the company means what it says, John West, a partner at Troutman Sanders, recommends periodic independent compliance audits of programs or divisions. “That will demonstrate to employees that the company takes compliance seriously enough to open up its activities to an independent party who will provide an objective report on compliance within the area being examined,” he says. “By saying to employees, ‘Here is what we identified, here is what we fixed,’ they see the commitment to compliance is more than saying good words.”

Companies must continuously reinforce the compliance culture, and can spread the word through a revised code of conduct, clearly emphasizing the commitment to compliance, Keating says. Steven Pearlman, a partner at Seyfarth Shaw, suggests that in addition to the code, every employee have at his desk a one-page whistleblower protection policy with contact information for lodging a complaint internally. Adherence to ethical and compliance standards should become a key element in performance reviews, Keating adds.

Other tactics to keep the compliance message front and center include a video from the CEO and articles in employee newsletters, blogs and intranets.

“It has to be a constant subject of communication, that we encourage people to bring forward their concerns, and we do not allow retaliation against people who raise concerns in good faith,” says Daniel Westman, a partner at Morrison Foerster.

2. Appoint an Ombudsman 

How an employee report of misconduct is handled internally can shape whether the employee takes the next step to complain externally. SOX mandated anonymous reporting systems, so employee complaint hotlines have been in place for years. But studies show employees report the vast majority of complaints directly to frontline managers and supervisors, who may react defensively, turning off the employee or even creating retaliation liability.

“Often a supervisor will be quick to defend existing practices and come off too defensively,” West says. “That can shut down the employee’s willingness to participate” in an internal investigation.

To circumvent that possibility, some experts recommend creating an Office of the Ombudsman to receive employee reports of wrongdoing. That office should be separate from the human resources department, which typically monitors hot line reports.

“Have someone other than HR, because employees may not trust HR,” Westman says. “Create a channel outside the chain of command, hopefully occupied by someone who looks trustworthy and has the experience and track record to support trustworthiness, to help employees resolve issues without them maturing into a retaliation complaint.”

Lisa Noller, a partner at Foley & Lardner, takes the concept a step further, pointing out the pros and cons of using an independent third party to act as the ombudsman who receives complaints. While this could spur reporting by employees who don’t trust their employer, a truly independent third party conceivably could take the information to the government itself. “I think it would work, but there is a danger,” she says.

Regardless of who gets the complaint, it is important that the employee believes he has gotten a fair hearing. “If the employee feels the report has been heard and received well, that creates an incentive for them to keep the matter within the company,” West says.

That employee may influence co-workers to use the internal reporting system as well. “You can shape the perception of the employee and influence the conversation that occurs when the employee goes back to his desk and a co-worker says, ‘How did it go?’” Westman says.

It’s also important to let the employee know the results of the investigation into his complaint. “Some level of reporting back needs to occur so they don’t feel the report went into a black hole,” West adds.

3. Give Supervisors a Script 

Even the most robust plan for receiving and dealing with whistleblower complaints won’t stand up unless supervisors and managers are trained on the fine points of how to recognize protected activity and respond to a complaint. Experts recommend specific whistleblower training, in addition to any retaliation training the company may already have in place—“retaliation training on steroids,” as Pearlman dubs it.

That includes training for supervisors on the appropriate words to use when an employee approaches them with a complaint.

“There are things they should say and things they should not say,” says Pearlman. “They should say ‘thank you.’ It sounds basic, but they should welcome the response.”

They also should emphasize that the employee will not suffer retaliation, that the company will take the complaint very seriously and thoroughly investigate it, and that “we will get back to you to the extent practicable,” Pearlman says.

The things not to say include anything that could be interpreted as hostile or indicating the supervisor intends to blow off the complaint. “Some managers treat the whistleblower like Benedict Arnold, and that’s the worst thing you can do,” Pearlman says.

On the other hand, the supervisor shouldn’t try to placate the whistleblower by agreeing there is a problem before the facts have been investigated. “That’s creating liability where none should exist,” Pearlman says.

Daniel Shea, a partner at Hogan Lovells, adds that HR should be trained in how to handle exit interviews with potential whistleblowers and to identify people during the annual review process who aren’t happy with the company and may become whistleblowers.

Noller points out that training must extend to all global operations. Of the initial 334 whistleblower reports received under the Dodd-Frank program, 32, or nearly 10 percent, originated from foreign countries, she notes. The fact that the SEC now has a branch dedicated to investigating FCPA complaints suggests that FCPA whistleblower complaints from overseas operations will accelerate, she adds.

“Don’t forget about your foreign subsidiaries [when planning compliance communication and training programs],” she says. “And do compliance training in the language of the people you are training.”

4. Consider Rewards 

If the government is using the carrot of money to attract whistleblowers, should companies fight fire with fire? 

The idea of monetary rewards for whistleblowers gets a mixed response from the experts.

Bernstein is an outspoken proponent. “You need to incentivize the person financially [to report wrongdoing internally],” he says. “If you don’t, no matter how friendly the climate the company creates, no matter how good a system they put into place, at the end of the day, money [offered by the government] will talk the loudest.”

Bernstein acknowledges that companies can’t compete with the potentially huge awards whistleblowers could get from the SEC. But he believes a “meaningful” financial reward may be sufficient to keep the employee from calling a plaintiffs lawyer. He notes that even if the reward is less than the government would offer, the employee will get the money much sooner, will not have to go through litigation and will not face the trauma of turning against his employer and co-workers.

Of course, the reward system will only work if employees know about it, so Bernstein says companies have to make sure they spread the word among the workforce. “It’s not something to keep secret,” he says.

Noller suggests a more limited reward—for example, a gift card for making an internal report, coupled with a promise to consider the employee’s decision to come forward during the annual salary review process. “If you just say, ‘We won’t be mean to you,’ people will be cynical about it,” she says. “Studies show that the two things that motivate people are loyalty and money. They can be put together in an incentive-based program that will hopefully appeal to people’s instinct to do the right thing.”

On the other hand, many companies don’t think they should incentivize employees to do what they should do anyway, says Shea. It also isn’t practical to try to compete with the SEC rewards because of their potential size, he adds.

Nonmonetary rewards are less controversial. Shea cites a company that holds an annual employee ethics award dinner, hosted by the CEO. Pearlman agrees that recognition can be an incentive for employees, demonstrating that the company acknowledges that they have helped the company by reporting misconduct internally. A bonus tied to their annual review also might be appropriate, he adds.

5. Proceed with Caution 

Once the whistleblower files a complaint with the SEC, a company often has to fight a two-front war, defending against the SEC charge as well as a potential retaliation claim from the whistleblower. 

Jonathan Tuttle, a partner at Debevoise & Plimpton, advises companies not to become distracted by trying to identify an anonymous whistleblower, or discrediting one who has been identified.

“I’ve seen companies get distracted and obsessed with who would do this to them,” Tuttle says. “They feel personally attacked, but part of counsel’s job is to keep the company focused on the SEC issue in front of it. The SEC really values whistleblowers and feels protective of them. So to the extent they think your company is only trying to discredit a whistleblower, you’ve got a big issue with the SEC.”

Pearlman notes that while dealing with the compliance issues is critical, there also is a fundamental employment aspect to whistleblower cases. As a result, an effective response necessitates breaking down the walls between departments and creating an integrated response involving compliance, legal and HR, he says. The company should assure that any supervisors who are implicated in the whistleblower’s charge are not involved in evaluating the employee.

West advises companies to act cautiously, avoiding discussions with the employee or taking any actions until a strategy is in place. “Once action has been taken, often the damage has been done,” he says.

Westman agrees, noting that a whistleblower claim may generate an angry response. “In many instances, the best advice is ‘don’t act in anger,’” he says. “Most managers are strong personalities and want to act and be done with it, but often that is not the right course.”

The situation becomes more complicated when the whistleblower is accused of unrelated misconduct. Tuttle points out that the final Dodd-Frank whistleblower rules’ retaliation provision is so broad that it is not clear if you can even fire someone who violates company rules. Until the courts clarify the point, he advises following traditional employment law, including making sure the reason given for the employment action is not a pretext and building a file to demonstrate the need for the action.

George Voegele Jr., a member at Cozen O’Connor, advises appointing a neutral party to investigate the whistleblower’s misconduct, preferably someone who doesn’t know about the whistleblower claim. Voegele notes that the 5th Circuit upheld summary judgment for the employer in its June 2011 decision in Hemphill v. Celanese Corp. (see “Employers’ SOX Whistleblower Defenses Strengthened”). The case involved an internal audit manager terminated for yelling at his secretary after complaining about alleged violations of laws and internal policies. The court dismissed the retaliation claim in part because the independent investigator from HR who looked into the incident and recommended termination based on harassment and creating a hostile work environment had no knowledge of the whistleblower case. 

Join the Conversation

Advertisement. Closing in 15 seconds.