The U.S. Securities and Exchange Commission (SEC) issued its 2014 Annual Report to Congress on the Dodd-Frank Whistleblower Program in November 2014. The report indicates last year was “historic” regarding the number of reports, resulting in a banner year for whistleblower awards. In 2014, the SEC’s Office of the Whistleblower received 3,620 tips, up from 3,001 in 2012 and 3,238 in 2013. Countries with the most reports include Australia, Canada, China, India, the U.K., and the U.S.
Internal auditors should pay attention to this report to help further corporate governance practices. Governance processes should not only promote reporting internally, but ensure strong follow-up with the reporters. Furthermore, if a report does reach the SEC whistleblower program, the organization should envelop the employee with support to protect against additional fines and penalties.
The SEC report notes that more than 40 percent of those who received monetary awards were either current or past employees of the organization they were reporting. Of this 40 percent, more than 80 percent had raised their concern via an internal reporting channel before reporting to the SEC.
Creating an ethical culture requires diligence around communication, training, and reinforcement. Compliance teams must not waste this training effort with slow or nonexistent follow-up on reports. The Office of the Whistleblower responds to questions within 24 hours. Organizational policies should mirror this practice.
Tracking the progress, timeliness, quality, and outcomes of reports must be part of any investigation. An open channel of communication with the whistleblower is key to a timely conclusion of the investigation.
A 2014 benchmark report prepared by NAVEX Global notes the median number of days to close an internal whistleblower case increased from 30 to 36 days. The longer the corporate investigation, the more likely it is there will be more reports.
Often, the investigator will pose additional inquiries regarding the situation. Increasing awareness of the need for the whistleblower to respond timely to follow-up questions is becoming apparent. Improving corporate training practices and awareness of the follow-up component is critical.
In June 2014, the SEC brought its first enforcement action against an employer who retaliated against a whistleblower. In this case, the whistleblower was demoted, and the person’s scope of authority was reduced; however, compensation was not affected. The SEC fine was in excess of US$2 million. Addressing employee anxiety, as well as training employees to recognize it, must be a priority. Recognizing acts of retaliation, such as sudden, clustered, or improperly documented disciplinary actions, is critical.
The SEC is making it clear that the company is not to interfere with an employee’s ability to report alleged wrongdoing. The chief of the Office of the Whistleblower has publicly said that the SEC is “looking for the first big case here.” Review of severance policies and agreements should be the first step in ensuring compliance with this enforcement practice. These agreements often have penalties for any negative comments by the terminated employee.
It takes courage to report potentially serious violations by an individual’s co-workers or senior management. Whistleblowing, at a minimum, can have an emotional impact on the reporter. At worst, it can lead to the whistleblower’s firing, suspension, or seclusion, as well as suspicion that creates factions within the organization. Regular, at least annual, mandatory training regarding the organization’s whistleblower and non-retaliation policy should be conducted. Awareness is critical.
It is time for internal audit to enhance corporate awareness efforts and practices:
- Ensure all staff clearly understand their duty to report and provide assurance of the no-retaliation policy.
- Reinforce that message through culture change driven by periodic policy reviews and informal discussions at team meetings. This may require tools and talking points to ensure consistency in message. The key is redundancy through repetitive messaging.
- Train leaders on how to receive even slight reports or rumors with assurance that whistleblowers are valued.
- Test the reporting process to ensure its efficacy. The test should ensure expediency of the investigation, that reporting metrics are well-defined and consistently reported, that retaliation is not tolerated, that training supports this pillar, and that all reporters are respected.
Whether the organization is small or large, local or multinational, public or private, the culture of governance is driven by each employee. Ensure your organization has the correct structure to enable whistleblowers to report wrongdoing.