Deploying Countermeasures to the SEC's Dodd-Frank Whistleblower Awards

Separately, proposed amendments to the Sentencing Guidelines that will take effect on Nov. 2, 2010, absent Congressional action, provide the opportunity for a reduction in organizational sentences when the organization has an effective compliance and ethics program incorporating direct reporting obligations from the head of the compliance program to the board of directors or audit committee. A component of an effective program includes reporting “no less than annually on the implementation and effectiveness of the compliance and ethics program.”

The Guidelines amendments create a substantial incentive for organizations to alter, where necessary, the reporting lines for the head of their compliance and ethics program and formalize annual assessments of their compliance and ethics program (including its whistleblower system) with a report to the board or audit committee.

The combination of the Dodd-Frank Act and Guidelines amendments creates a strong incentive for organizations to drive performance of their whistleblower system as high as is feasible. Maximizing internal reporting could allow issues to be resolved at a lower cost and help avoid reputational harm, with the organization potentially gaining the benefit of self-reporting and possibly greater control and reduced disruption to business operations.

10 Actions

Our experience suggests that there are at least 10 actions many organizations could take to enhance their whistleblower systems and other methods of internally detecting wrongdoing.

One. Enhancing Other Detection Methods

Tips are the number-one way in which frauds are detected, according to the Association of Certified Fraud Examiners' (ACFE) 2010 Report to the Nations on Occupational Fraud and Abuse. In the entities the ACFE studied that had whistleblower hotlines, 47% of frauds were detected by tips. That still leaves 53% of all frauds being detected by other methods. One way to detect more potential securities law violations internally may be to enhance transaction testing and internal auditing focused on areas of greatest regulatory risk, such as FCPA violations, insider trading, revenue recognition manipulation and false disclosures.

Two. Carrots

Some people believe reporting wrongdoing is part of everyone's job and no reward should be given. Also, many well-known whistleblowers have clearly been motivated by principle, not money. One hotline provider, The Network, stated in its 2006 Corporate Governance and Compliance Hotline Benchmarking Report that only 35% of whistleblowers used anonymity when reporting corruption and fraud, compared with 54% overall, suggesting the willingness of fraud whistleblowers to stand up for what is right. Despite this volunteerism, audit committees and boards of directors may decide that the safer course, in light of the SEC's new awards, is to provide incentives for whistleblowers.

One strategy may be to reward specific types of tips that result in detection of wrongdoing. The granting of an award might be published in some circumstances to encourage future internal whistleblowing but remain private in others.

Three. Preventing Retaliation

Ill treatment of whistleblowers has been well documented. Organizations have to overcome this legacy if whistleblowers are to be persuaded to report internally. The Dodd-Frank Act's greater whistleblower protections compared with those in the Sarbanes-Oxley Act make it vital for organizations to “walk the talk” regarding non-retaliation. Are your personnel trained to avoid all forms of retaliation including harassment?

The risk of retaliation can be mitigated by designating a central function or person, such as the corporate compliance and ethics officer, to monitor whistleblowers' career progression, compensation, and proposed disciplinary actions, and to investigate whistleblowers' complaints of retaliation.

Four. Opening Wide

Only 49% of the tips in the ACFE's 2010 Report were identified as coming from employees. Another 38% came from customers, vendors, shareholders, competitors, and the perpetrators' acquaintances. The remaining 13% were anonymous. Encouraging external constituencies to use your whistleblower system could increase the volume and value of tips.

The Network reported in “Best Practices in Ethics Hotlines” in 2006 that almost 50% of its calls were received outside business hours. So if your hotline is not already operating 24/7, doing so could increase calls. Providing hotline support in callers' preferred languages can also encourage calls and enhance report quality.

Five. Giving your hotline an MRI

Looking at your whistleblower system from multiple angles may identify aspects that are not working as well as you thought. Used appropriately, anonymous employee surveys, data benchmarking, focus groups, exit interviews, user evaluations, interviews, and incident logs can provide insights into a whistleblower system's effectiveness. This can identify aspects of the system, or parts of the organization, in which the system can be improved.

Six. Adjusting the Threshold for Investigations

Some whistleblower reports contain broad, vague or incomplete allegations, making an investigation so difficult or so costly as to weigh against further action. If such cases relate to potential securities law violations, greater efforts might now be justified in soliciting further information from the whistleblower. Also, certain data analytic techniques could be used to screen a broad alleged area of activity and to identify anomalous aspects upon which a traditional investigation could focus.

An academic paper, “Effects of Anonymous Whistle-Blowing and Perceived Reputation Threats on Investigations of Whistle-Blowing Allegations by Audit Committee Members,” in the Journal of Management Studies online in February 2010, reported an experiment involving 83 experienced audit committee members. Researchers found that these directors attributed lower credibility and allocated fewer investigative resources to whistleblower reports that were received through an anonymous versus a non-anonymous channel. Corporate counsel may be able to enhance how anonymous whistleblower reports are addressed so that such whistleblowers will be less likely to turn to external reporting to get a fair hearing.

Seven. Enhancing Communications

A successful whistleblower system requires effective communication to sustain employees' awareness of the system, build willingness to use it, and develop employees' ability to identify potential wrongdoing. According to the Ethics Research Council's 2009 National Business Ethics Survey, 63% of employees surveyed said they had reported misconduct when they saw it. That leaves 37% of employees not doing so ' a performance improvement opportunity.

With many companies and employees still facing heightened financial pressure, more frequent ethics communications may be prudent. Communicating the entity's non-retaliation policy can help to allay fears. Communicating promptly that appropriate action has been taken in response to whistleblower reports is important, both for the whistleblower and to encourage reporting and deter wrongdoing by other employees. It may help to publish internally suitably anonymous examples of where a whistleblower report led to an investigation and appropriate disciplinary action.

Eight. Changing the Name

What's in a name? The terms “whistleblower” and “hotline” may have some negative connotations; “report line” or “help line” may be more effective. Help lines also provide guidance for employees who are concerned about an ethical, legal, or regulatory issue, enabling the issue to be resolved before potentially damaging action is taken. This can give employees experience using the system for day-to-day matters, building trust and making them more willing to use it for a serious matter.

Nine. Going Global

Certain countries, such as France, have restrictive laws that need to be considered in developing a hotline for organizations operating there. In some countries, whistleblowing is countercultural and hotlines may generate few calls. Preferred whistleblowing methods vary by country and culture. Offering multiple methods of reporting (such as phone, e-mail, Web form, fax, and letter) can help to generate more tips. Tailoring the examples in training materials and communications to address local compliance issues and culture can increase their effectiveness. This could include emphasizing actions that would be violations of the organization's policies, but which are considered perfectly normal and legal in some countries.

Ten. A Prepared and Diligent Response

The new “race to report” securities law violations to the SEC puts a premium on speedy investigation and resolution of potential wrongdoing. Preparing investigation response plans in advance, including identifying preferred investigation resources for different locations, can help companies respond more quickly and more effectively to whistleblowers, thereby encouraging internal reporting.

Toby J.F. Bishop ([email protected]), a member of this newsletter's Board of Editors, is director of the Deloitte Forensic Center, and Mohammed Ahmed ([email protected]) is a senior manager in the Forensic & Dispute Services practice, both for Deloitte Financial Advisory Services LLP. The views expressed in this article are those of the authors and may not be those of Deloitte Financial Advisory Services LLP.

Section 922 of the Dodd-Frank Wall Street Reform and Consumer Protection Act created awards of 10%-30% of monetary sanctions for whistleblowers who report to the SEC original information leading to securities law enforcement actions that recover more than $1 million. This could change the dynamics of whistleblowing and self-reporting for organizations. We discuss below 10 actions organizations might take to help mitigate the increased regulatory risk this change may create.

With the SEC settling securities cases for as much as hundreds of millions of dollars, the new awards could at times reach the $10 million-$150 million range. This raises two major questions:

1. How can organizations incentivize their employees to blow the whistle internally before, or instead of, going to the SEC?
2. How will this impact the effectiveness of compliance and ethics programs and the potential credit for self-reporting or qualifying for a reduction in sentence under the Federal Sentencing Guidelines?

These tough questions reflect the size of the rock that the Dodd-Frank Act has launched into the compliance and ethics pond.

Incentives for Organizations

Separately, proposed amendments to the Sentencing Guidelines that will take effect on Nov. 2, 2010, absent Congressional action, provide the opportunity for a reduction in organizational sentences when the organization has an effective compliance and ethics program incorporating direct reporting obligations from the head of the compliance program to the board of directors or audit committee. A component of an effective program includes reporting “no less than annually on the implementation and effectiveness of the compliance and ethics program.”

The Guidelines amendments create a substantial incentive for organizations to alter, where necessary, the reporting lines for the head of their compliance and ethics program and formalize annual assessments of their compliance and ethics program (including its whistleblower system) with a report to the board or audit committee.

The combination of the Dodd-Frank Act and Guidelines amendments creates a strong incentive for organizations to drive performance of their whistleblower system as high as is feasible. Maximizing internal reporting could allow issues to be resolved at a lower cost and help avoid reputational harm, with the organization potentially gaining the benefit of self-reporting and possibly greater control and reduced disruption to business operations.

10 Actions

Our experience suggests that there are at least 10 actions many organizations could take to enhance their whistleblower systems and other methods of internally detecting wrongdoing.

One. Enhancing Other Detection Methods

Tips are the number-one way in which frauds are detected, according to the Association of Certified Fraud Examiners' (ACFE) 2010 Report to the Nations on Occupational Fraud and Abuse. In the entities the ACFE studied that had whistleblower hotlines, 47% of frauds were detected by tips. That still leaves 53% of all frauds being detected by other methods. One way to detect more potential securities law violations internally may be to enhance transaction testing and internal auditing focused on areas of greatest regulatory risk, such as FCPA violations, insider trading, revenue recognition manipulation and false disclosures.

Two. Carrots

Some people believe reporting wrongdoing is part of everyone's job and no reward should be given. Also, many well-known whistleblowers have clearly been motivated by principle, not money. One hotline provider, The Network, stated in its 2006 Corporate Governance and Compliance Hotline Benchmarking Report that only 35% of whistleblowers used anonymity when reporting corruption and fraud, compared with 54% overall, suggesting the willingness of fraud whistleblowers to stand up for what is right. Despite this volunteerism, audit committees and boards of directors may decide that the safer course, in light of the SEC's new awards, is to provide incentives for whistleblowers.

One strategy may be to reward specific types of tips that result in detection of wrongdoing. The granting of an award might be published in some circumstances to encourage future internal whistleblowing but remain private in others.

Three. Preventing Retaliation

Ill treatment of whistleblowers has been well documented. Organizations have to overcome this legacy if whistleblowers are to be persuaded to report internally. The Dodd-Frank Act's greater whistleblower protections compared with those in the Sarbanes-Oxley Act make it vital for organizations to “walk the talk” regarding non-retaliation. Are your personnel trained to avoid all forms of retaliation including harassment?

The risk of retaliation can be mitigated by designating a central function or person, such as the corporate compliance and ethics officer, to monitor whistleblowers' career progression, compensation, and proposed disciplinary actions, and to investigate whistleblowers' complaints of retaliation.

Four. Opening Wide

Only 49% of the tips in the ACFE's 2010 Report were identified as coming from employees. Another 38% came from customers, vendors, shareholders, competitors, and the perpetrators' acquaintances. The remaining 13% were anonymous. Encouraging external constituencies to use your whistleblower system could increase the volume and value of tips.

The Network reported in “Best Practices in Ethics Hotlines” in 2006 that almost 50% of its calls were received outside business hours. So if your hotline is not already operating 24/7, doing so could increase calls. Providing hotline support in callers' preferred languages can also encourage calls and enhance report quality.

Five. Giving your hotline an MRI

Looking at your whistleblower system from multiple angles may identify aspects that are not working as well as you thought. Used appropriately, anonymous employee surveys, data benchmarking, focus groups, exit interviews, user evaluations, interviews, and incident logs can provide insights into a whistleblower system's effectiveness. This can identify aspects of the system, or parts of the organization, in which the system can be improved.

Six. Adjusting the Threshold for Investigations

Some whistleblower reports contain broad, vague or incomplete allegations, making an investigation so difficult or so costly as to weigh against further action. If such cases relate to potential securities law violations, greater efforts might now be justified in soliciting further information from the whistleblower. Also, certain data analytic techniques could be used to screen a broad alleged area of activity and to identify anomalous aspects upon which a traditional investigation could focus.

An academic paper, “Effects of Anonymous Whistle-Blowing and Perceived Reputation Threats on Investigations of Whistle-Blowing Allegations by Audit Committee Members,” in the Journal of Management Studies online in February 2010, reported an experiment involving 83 experienced audit committee members. Researchers found that these directors attributed lower credibility and allocated fewer investigative resources to whistleblower reports that were received through an anonymous versus a non-anonymous channel. Corporate counsel may be able to enhance how anonymous whistleblower reports are addressed so that such whistleblowers will be less likely to turn to external reporting to get a fair hearing.

Seven. Enhancing Communications

A successful whistleblower system requires effective communication to sustain employees' awareness of the system, build willingness to use it, and develop employees' ability to identify potential wrongdoing. According to the Ethics Research Council's 2009 National Business Ethics Survey, 63% of employees surveyed said they had reported misconduct when they saw it. That leaves 37% of employees not doing so ' a performance improvement opportunity.

With many companies and employees still facing heightened financial pressure, more frequent ethics communications may be prudent. Communicating the entity's non-retaliation policy can help to allay fears. Communicating promptly that appropriate action has been taken in response to whistleblower reports is important, both for the whistleblower and to encourage reporting and deter wrongdoing by other employees. It may help to publish internally suitably anonymous examples of where a whistleblower report led to an investigation and appropriate disciplinary action.

Eight. Changing the Name

What's in a name? The terms “whistleblower” and “hotline” may have some negative connotations; “report line” or “help line” may be more effective. Help lines also provide guidance for employees who are concerned about an ethical, legal, or regulatory issue, enabling the issue to be resolved before potentially damaging action is taken. This can give employees experience using the system for day-to-day matters, building trust and making them more willing to use it for a serious matter.

Nine. Going Global

Certain countries, such as France, have restrictive laws that need to be considered in developing a hotline for organizations operating there. In some countries, whistleblowing is countercultural and hotlines may generate few calls. Preferred whistleblowing methods vary by country and culture. Offering multiple methods of reporting (such as phone, e-mail, Web form, fax, and letter) can help to generate more tips. Tailoring the examples in training materials and communications to address local compliance issues and culture can increase their effectiveness. This could include emphasizing actions that would be violations of the organization's policies, but which are considered perfectly normal and legal in some countries.

Ten. A Prepared and Diligent Response

The new “race to report” securities law violations to the SEC puts a premium on speedy investigation and resolution of potential wrongdoing. Preparing investigation response plans in advance, including identifying preferred investigation resources for different locations, can help companies respond more quickly and more effectively to whistleblowers, thereby encouraging internal reporting.

Toby J.F. Bishop ([email protected]), a member of this newsletter's Board of Editors, is director of the Deloitte Forensic Center, and Mohammed Ahmed ([email protected]) is a senior manager in the Forensic & Dispute Services practice, both for Deloitte Financial Advisory Services LLP. The views expressed in this article are those of the authors and may not be those of Deloitte Financial Advisory Services LLP.