On May 25th 2011, the U.S. Securities and Exchange Commission (SEC) took a much anticipated step and adopted rules for its new whistleblower program. In this briefing we summarize:
• What the rules are and what’s new about them
• How the SEC’s whistleblower program may impact your company and your ethics and compliance efforts
• What actions you should take, now and in the weeks and months ahead
The new rules and Their objecTives
The new SEC whistleblower program, implemented under Section 922 of the Dodd-Frank Act, authorizes the SEC to pay rewards to individuals who provide the Commission with original information that leads to successful enforcement actions. If the resulting penalties exceed $1 million, the SEC would pay the whistleblower a percentage of the money it recovers.
The objective of the new rules is to help surface information about violations of securities laws and to encourage whistleblowers who have original, high-quality information to come forward early with evidence to assist investigators.
The rules, which total over 300 pages, include specific details about what counts as eligible “original information” and how reports to the SEC must be made. The rules also specify who
is – and who is not – eligible for rewards. For example, people who have pre-existing legal or contractual obligations to report information to the Commission, foreign government officials, and, in most cases, compliance and internal audit personnel are barred from receiving awards.
The SEC’s rules will go into effect 60 days after they are submitted to Congress or published in the U.S. Federal Register.
What’s changed? What’s new?
The new whistleblower program greatly expands the availability of awards to individuals who provide the SEC with information. Prior to these changes, the SEC’s bounty program was limited to insider trading cases and the amount of an award was capped at 10 percent of the penalties collected. Now, the awards can go as high as 30 percent of the penalties and they apply to a wide range of securities violations.
W hitepa per : regul atory
The sec whistleblower Program and what You need to Know
Edited By:
Ed Petry
Last fall, when the program was originally announced, the rules were contested by several U.S. companies and organizations. They argued that whistleblowers should be required to first tell their companies about misconduct and give them a chance to correct problems before informing the SEC.
While the new rules do not fully meet the objections of these critics and do not require whistleblowers to report violations internally in order to qualify for an award, they do include additional incentives to encourage employees to first use their company’s internal compliance programs.
In particular, the rules:
• Preserve a whistleblower’s eligibility for an award if the whistleblower reports internally and the SEC is subsequently informed about the violations within 120 days. This enables employees to report their information internally first while preserving their “place in line” for a possible award from the SEC. • The SEC will consider a whistleblower’s use of their company’s internal reporting systems as a factor that
can increase the amount of an award; but, on the other hand, if a whistleblower interferes with internal compliance and reporting efforts that will be a factor that can decrease the amount of an award. • In addition, the SEC will credit whistleblowers whose companies pass their information to the
Commission, even if the whistleblowers themselves do not.
When announcing the new rules, SEC Chairman Mary Schapiro, acknowledged that internal compliance programs play “an extremely valuable role” and she sees the new rules as striking a balance between encouraging
whistleblowers to pursue internal compliance and giving them the option to go directly to the SEC. It should not go unnoticed that, while not going as far as critics may have wanted, the new rules do signal a recognition by the Commission of the importance and effectiveness of internal compliance programs.
recommended sTePs To TaKe now and in The fuTure
As noted above, much of the discussion over the last few months has been whether or not the SEC whistleblower program would undermine companies’ internal reporting processes by encouraging whistleblowers to go directly to the SEC. While the new rules address these concerns to an extent, it is still undoubtedly true that at some companies employees will bypass their internal reporting program and, in these cases, the impact to the company’s compliance program could be significant.
However, the new rules offer companies a way to minimize the likelihood of this scenario. The following steps can be taken to encourage employees to come to the company first while still cooperating with the SEC.
Step One: Review your whistleblower hotline and case management solution
In recent years we have seen increasing pressure on companies to self-report potential misconduct to regulators and enforcement agencies. The new SEC whistleblower program certainly does nothing to undo that pressure. In fact, certain elements of the program increase the need for companies to quickly assess and plan their response once a complaint is received. For example, under the SEC rules, if a whistleblower makes a Dodd-Frank eligible report using a company’s internal reporting channels, information must be provided to the SEC within 120 days, otherwise the whistleblower eligibility may be at risk. Since a savvy whistleblower will likely know this and since it
is always possible for the whistleblower themselves to escalate the case to the SEC, companies will want to move quickly and decide on a self-reporting strategy.
In order to do so and meet the 120-day obligation, companies need to have a call-intake and case management solution in place that immediately identifies, flags, and routes those reports that are eligible under the SEC program. From the moment the contact is received, the clock is ticking.
Flagging the calls will enable you to route the matter to appropriate internal resources, conduct
a preliminary investigation, and prepare a strategy for disclosure and remediation – important steps in minimizing the impact to the company:
Recommendations
• Review your current report categories and add a high priority category that captures Dodd-Frank
eligible reports.
• Update your call-intake, case management and investigation programs and processes to ensure
that Dodd-Frank eligible reports are routed properly and receive the appropriate attention. Be sure to include an escalation procedure that can help resolve internal issues that may be delaying an investigation.
• Review the mechanisms you have in place to communicate with the whistleblower – even with those
whistleblowers who prefer to remain anonymous. In all cases, you will want to reassure the whistleblower that their allegation has been received, that their report is being taken seriously and that action, if appropriate, will be taken.
• Include updates on Dodd-Frank eligible cases and information about subsequent investigation and
disclosures in your reports to senior leadership and in your whistleblower hotline metrics.
Step Two: Awareness and Training
While the new SEC rules are receiving a lot of attention from those of us in the ethics and compliance business, most employees know nothing about them or they may have misinformation. By being proactive, you can not only provide accurate information, but you can also take the opportunity to explain how the new rules allow – and even encourage – employees to use your reporting channels first.
In addition to providing general awareness and a full and accurate picture of the rules, companies will also need to train personnel to properly handle Dodd-Frank eligible reports and leaders should have access to resources so that they can answer employee questions and understand their key role in supporting your efforts.
Recommendations
• Consider publishing an announcement to all employees updating them on the new rules. If you choose this proactive step, take the opportunity to explain the provisions of the rules that allow them to use company reporting channels and still remain eligible. This would also be a good time to remind employees of why it’s important for them to speak up and what steps the company will take to protect them from retaliation.
• While most employees are aware of their company’s whistleblower hotline, few are clear about how
the process works: “Who answers the phone? What type of questions will they ask? Will I need to give my name? What
happens after the call?” Now is the time to use all the training and communications tools at your disposal to de-mystify the process and remove employee doubts. Doing so will encourage employees to come to you first.
• Prepare a briefing package for all personnel who may be in a position to receive questions or allegations from
employees. The key is to arm them with information so that they feel comfortable answering employee questions – or so
they can refer employees to the right internal resource.
• In responding to the new SEC whistleblower rules, senior leadership can be your biggest ally or worst obstacle. Skepticism and incomplete information can trickle down and negate all your best efforts. Leadership needs to hear from you about the new rules and the steps you are taking to respond to them. They also need to understand the critical role that they play in shaping employee opinion and the culture of the organization. Remind them of the advantages of encouraging employees to use your reporting channels first.
• Remember that potential whistleblowers are not limited to your employees. The SEC program may increase the likelihood that third parties including customers, business partners, employee family members and former employees will use your whistleblower hotline. Be sure that your call-intake and case management systems - and the personnel responsible for them - are prepared.
Step Three – Assess your risks and know your culture
The companies that have the most to fear from the new rules are those where employees don’t understand or don’t trust the company’s whistleblower hotline and the ethics and compliance program. Determining if you are an at-risk company requires that you regularly listen to employee opinions and that you identify factors that may be contributing to mistrust and fear of retaliation for reporting allegations of misconduct.
Staying on top of the changing risk profile of you company, and identifying the many cultures and subcultures that support – or undermine – your efforts requires regular and on-going effort:
Recommendations
• Use a variety of methods including surveys, focus groups and interviews to gather employee opinions on such topics as:
fear of retaliation, confidence in management’s willingness to follow through when they are aware of an issue, faith in the company reporting system, integrity of investigations and overall consistency and fairness.
• Engage subject matter experts and leadership to help identify employees who are at a high risk for exposure to SEC
violations and use that information to tailor communications and training for them – not only are they the most likely violators, they are also the employees most likely to have information on violations by others.
conclusion
The new SEC whistleblower program presents both a challenge and an opportunity. You can meet the challenge by being proactive. Update your whistleblower hotline call-intake and case management solution, provide information to employees that is accurate and complete, train ethics and compliance personnel and others so they can support your efforts, and identify risk factors in your culture and high-risk employees that need targeted attention. The new rules are also an opportunity; this is the time to re-double your efforts to improve understanding and support for your reporting process and your ethics and compliance program.
AbOuT The AuThOR
Edward S Petry, PhD
Vice President, Ethical Leadership Group™ The Advisory Services Practice of NAVEX Global™
Edward S. Petry, PhD, joined Ethical Leadership Group in 2005, after serving nine years as the Executive Director and a member of the Board of Directors of the Ethics and Compliance Officer Association (ECOA). He has been active in the business ethics field since 1986.
At ELG, Ed is responsible for assisting corporations in designing and improving ethics and compliance initiatives including conducting program and culture assessments, writing corporate codes of conduct and designing and delivering training.
Ed served for three years as a member of the U.S. Sentencing Commission’s Advisory Group and was a member of the Ethics Oversight Committee for the United States Olympic Committee. He is also a member of the Advisory Board of the Society for Corporate Compliance and Ethics (SCCE) and was Program Director for the Conference Board for seven years.
Dr. Petry has authored several major surveys including the U.S. Sentencing Commission’s National Survey of Ethics and Compliance in Organizations (1995), Sources and Consequences of Workplace Pressure (1997) and Technology and Ethics in the Workplace (1998). He has edited and/or co-authored six books on business ethics,
published dozens of articles, and been a featured speaker at numerous national and international forums including the Conference Board, the Chautauqua Institute and was the 2004 Ben Williams Distinguished Speaker at Baylor University’s Hankamer School of Business. He has been quoted or appeared in every major business publication and business media outlet.
Ed received his Ph.D. in philosophy from Pennsylvania State University and has also received degrees in philosophy from the University of Toronto and Trinity College. Prior to becoming the ECOA’s first full-time director, Dr. Petry was a tenured professor of philosophy at Bentley University.
AbOuT NAVeX GlObAl
NAVEX Global is the trusted ethics and compliance expert for more than 8,000 clients in over 200 countries – the largest ethics and compliance community in the world. A merger of industry leaders ELT, EthicsPoint, Global Compliance Services and PolicyTech, NAVEX Global provides a comprehensive suite of solutions to manage governance, risk and compliance (GRC), providing critical cross-program insights thorough unmatched expertise and actionable data.
