To Disclose or Not to Disclose

How Thorough Was the Investigation?

Many organizations curtail investigation, particularly if leaning against self-reporting. This is a mistake. You cannot properly decide whether to report without
knowing the facts. The government, if it becomes aware of the allegations, will assess independence, competency, scope and quality of the investigation. The legal sanctions, as well as reputational and business implications, surely worsen if it appears that you have not thoroughly investigated, or have cast a blind eye toward allegations of misconduct.

Remedial Actions?

Remediation, while always important, is crucial if the organization elects not to self-report. If the misconduct becomes public, the organization ' to mitigate both legal and reputation risk ' must demonstrate that it has taken all necessary action to prevent recurrence. Efforts generally should include: 1) COSO (Committee of Sponsoring Organizations) analysis of break-down in controls; 2) Extended forensic audit procedures; 3) Restitution to victims and discipline of primary and secondary wrongdoers; and 4) Auditing of design and operating effectiveness of remediation program.

Professional Obligations?

There generally is no legal requirement to self-report. The misprision of felony statute technically makes it a Federal crime not to report the commission of a felony, but the courts have interpreted the law as requiring an affirmative act of concealment. 18 U.S.C. ' 4. Some regulations and professional framework, however, carry an affirmative duty to report. Federal Acquisition Regulations, for example, require government contractors and subcontractors to report, if they have credible evidence of a violation of federal criminal law involving fraud, conflict of interest, bribery, or gratuity. 18 U.S.C. ' 4. See M. Considine, Id. Likewise, professional standards require auditors to take action if they discover evidence of a crime during the course of an audit. See, e.g., Section 10A of the Securities Reform Act of 1934, 15 USC 78j-1), (b)(1) and AICPA Auditing Standards Board, Statement of Auditing Standards 54 (illegal acts by clients). The prudent approach thus is to consult with counsel and document that you have no legal duty to self-report.

Legal Incentives and Likely Sanctions?

Formal incentives exist for self-reporting certain types of misconduct. Federal law, for example, protects individuals and companies that self-report criminal violations of the Sherman Act to the Department of Justice's Antitrust Division from treble damages and joint-and-several liability in private lawsuits. Conversely, the government might offer informal incentives.

Predicting sanctions is trickier, and there are no guarantees. Experienced counsel can, however, forecast fines and other penalties based on the government's track record in similar cases and on U.S. Sentencing Guidelines criteria.

What Are the Financial and Reputational Implications?

Attention also needs to be given to the financial and reputational implications of self-reporting. How will clients and customers react? Consider, for example, the sudden outflow of deposits a few years back when mutual funds reported market timing and other misconduct. How will self-reporting impact employee morale, including retention of top talent and recruitment efforts? How much worse will the implications be if the company elects not to report and the misconduct is later detected?

What Are the Likely Sanctions if Government Discovers Misconduct on
Its Own?

The answer ' which is highly fact-dependent ' varies according to the magnitude of the misconduct. Who was involved? Who was harmed or victimized? For how long of a period did the misconduct occur? How much money was involved? Why did the controls fail to prevent or detect the misconduct? What remedial steps have been implemented?

Prosecutors tend to establish internal, non-binding, guidelines for the cases that they will prosecute. It may well be that the government would have no interest in prosecuting. These guidelines vary by jurisdiction, so it is important for counsel to be familiar with the jurisdictions at issue. The government will assess the quality of the investigation and the depth of the remediation. Counsel may be well positioned to defend the decision not to self-report, although some prosecutors might take a harsher stance to deter others from failing to self-report.

How Prepared Is the Organization if the Allegation Becomes Public?

Assuming that the organization elects not to self-report, it must prepare for the reaction of the media, government, investors, customers, business partners, employees and other key stakeholders, if the allegation nonetheless becomes public. Should the organization document contemporaneously the nature of the allegation, follow up investigation and remediation, and rationale for not self-reporting?

Jonny Frank, a partner at the StoneTurn Group, retired from PwC, where he founded and led the Investigations and Fraud Risks & Controls practices. Stanley A. Twardy, Jr., a member of this newsletter's Board of Editors, is a senior partner and leads the Government Investigations Group at Day Pitney LLP.

Whether to self-report serious misconduct is a complicated question that requires investigating the facts and assessing legal, business and reputation implications. Following are critical issues to consider with outside counsel and other professional advisers before making a decision.

What Is the Likelihood of the Conduct Otherwise Surfacing?

Gambling that the misconduct will never be discovered carries high risk in today's environment. SEC rules pay hefty rewards to whistleblowers, including auditors, compliance officers, officers, directors and other insiders. Social media sites provide an easy outlet for disgruntled employees and others. As a practical matter, assume and prepare for the allegations of misconduct eventually becoming public.

How Thorough Was the Investigation?

Many organizations curtail investigation, particularly if leaning against self-reporting. This is a mistake. You cannot properly decide whether to report without
knowing the facts. The government, if it becomes aware of the allegations, will assess independence, competency, scope and quality of the investigation. The legal sanctions, as well as reputational and business implications, surely worsen if it appears that you have not thoroughly investigated, or have cast a blind eye toward allegations of misconduct.

Remedial Actions?

Remediation, while always important, is crucial if the organization elects not to self-report. If the misconduct becomes public, the organization ' to mitigate both legal and reputation risk ' must demonstrate that it has taken all necessary action to prevent recurrence. Efforts generally should include: 1) COSO (Committee of Sponsoring Organizations) analysis of break-down in controls; 2) Extended forensic audit procedures; 3) Restitution to victims and discipline of primary and secondary wrongdoers; and 4) Auditing of design and operating effectiveness of remediation program.

Professional Obligations?

There generally is no legal requirement to self-report. The misprision of felony statute technically makes it a Federal crime not to report the commission of a felony, but the courts have interpreted the law as requiring an affirmative act of concealment. 18 U.S.C. ' 4. Some regulations and professional framework, however, carry an affirmative duty to report. Federal Acquisition Regulations, for example, require government contractors and subcontractors to report, if they have credible evidence of a violation of federal criminal law involving fraud, conflict of interest, bribery, or gratuity. 18 U.S.C. ' 4. See M. Considine, Id. Likewise, professional standards require auditors to take action if they discover evidence of a crime during the course of an audit. See, e.g., Section 10A of the Securities Reform Act of 1934, 15 USC 78j-1), (b)(1) and AICPA Auditing Standards Board, Statement of Auditing Standards 54 (illegal acts by clients). The prudent approach thus is to consult with counsel and document that you have no legal duty to self-report.

Legal Incentives and Likely Sanctions?

Formal incentives exist for self-reporting certain types of misconduct. Federal law, for example, protects individuals and companies that self-report criminal violations of the Sherman Act to the Department of Justice's Antitrust Division from treble damages and joint-and-several liability in private lawsuits. Conversely, the government might offer informal incentives.

Predicting sanctions is trickier, and there are no guarantees. Experienced counsel can, however, forecast fines and other penalties based on the government's track record in similar cases and on U.S. Sentencing Guidelines criteria.

What Are the Financial and Reputational Implications?

Attention also needs to be given to the financial and reputational implications of self-reporting. How will clients and customers react? Consider, for example, the sudden outflow of deposits a few years back when mutual funds reported market timing and other misconduct. How will self-reporting impact employee morale, including retention of top talent and recruitment efforts? How much worse will the implications be if the company elects not to report and the misconduct is later detected?

What Are the Likely Sanctions if Government Discovers Misconduct on
Its Own?

The answer ' which is highly fact-dependent ' varies according to the magnitude of the misconduct. Who was involved? Who was harmed or victimized? For how long of a period did the misconduct occur? How much money was involved? Why did the controls fail to prevent or detect the misconduct? What remedial steps have been implemented?

Prosecutors tend to establish internal, non-binding, guidelines for the cases that they will prosecute. It may well be that the government would have no interest in prosecuting. These guidelines vary by jurisdiction, so it is important for counsel to be familiar with the jurisdictions at issue. The government will assess the quality of the investigation and the depth of the remediation. Counsel may be well positioned to defend the decision not to self-report, although some prosecutors might take a harsher stance to deter others from failing to self-report.

How Prepared Is the Organization if the Allegation Becomes Public?

Assuming that the organization elects not to self-report, it must prepare for the reaction of the media, government, investors, customers, business partners, employees and other key stakeholders, if the allegation nonetheless becomes public. Should the organization document contemporaneously the nature of the allegation, follow up investigation and remediation, and rationale for not self-reporting?

Jonny Frank, a partner at the StoneTurn Group, retired from PwC, where he founded and led the Investigations and Fraud Risks & Controls practices. Stanley A. Twardy, Jr., a member of this newsletter's Board of Editors, is a senior partner and leads the Government Investigations Group at Day Pitney LLP.