Manage Learn to apply best practices and optimize your operations.

Best practices to navigate the Dodd-Frank/SEC whistleblower program

The SEC whistleblower program provides monetary rewards for reporting Dodd-Frank violations. Here's how strong reporting processes can protect you.

One of the provisions under the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 is increased incentives for whistleblowers who report company wrongdoing. Under Section 922 of Dodd-Frank, the SEC whistleblower program provides monetary rewards to individuals who expose violations and provide significant, successful evidence to the U.S. Securities and Exchange Commission.

Whistleblowers, and the broader topic of how companies respond to internal reports of regulatory violations, have always been topics of concern, said R. Todd Cronan, partner at Boston-based law firm Goodwin Procter LLP. Additionally, the SEC whistleblower program has elicited even more upper-management attention.

We see it as a very good source for information; we see it as a very good source for pursuing investigations that may lead to an action.

David Bergers, New England regional director, SEC

"The more formal structure coming up through Dodd-Frank -- including the financial incentives that are now available to a whistleblower -- has completely changed the landscape and also given a direct line of communication more formally between a whistleblower and the SEC staff," Cronan said.

Cronan was part of a roundtable panel discussion about SEC enforcement and related corporate governance risk held last month in Boston. The roundtable, organized by The Directors Roundtable Institute, was designed to help boards of directors understand their role in internal corporate investigations, compliance and governance, as well as how companies should address these issues.

Since the SEC whistleblower program went into effect in August 2011, the SEC has received 2,870 tips about potential violations, said David Bergers, the New England regional director for the U.S. Securities and Exchange Commission. In August 2012, the SEC handed out its reward under the program, paying approximately $50,000 to an individual who assisted with an investment-fraud investigation.

"We see it as a very good source for information; we see it as a very good source for pursuing investigations that may lead to an action," Bergers said.

But since the SEC whistleblower program often calls upon employees to report on their current employers, the process can be fraught with conflicts of interest and process gaps.

When individuals are still employed by the company they are reporting, they have access to sales information, finance reports and company projections -- all of which are information they could potentially supply to the SEC during an investigation, Cronan said.

Whistleblowers might also bypass initial internal reporting and go directly to the SEC. To avoid this scenario, organizations should provide reporting avenues for whistleblowers early and often. "You need to make sure those complaints get up to the board of directors or audit-committee level as appropriate, and certainly get to senior management," Cronan said.

Roundtable presenters suggested establishing a complaint hotline that allows disclosure of potential violations before employees go to the SEC, and added that organizations should develop a reporting hierarchy within the organization that encourages initial reporting to upper management.

There are further issues to consider. More often than not, Cronan said, a whistleblower's attitude is, "Nothing is going to happen by reporting to senior management anyway, so why bother going to them ?" To quell this mindset, companies must be sincere when encouraging potential whistleblowers.

Goodwin Procter LLP partner Joseph Savage Jr. noted that if the potential SEC whistleblower is comfortable with the process, companies can also press the issue to try to determine if there is any other potentially nefarious activity going on.

"You've got to have the process in place saying, ' you for the information; we're going to follow up on the information; this information is important to us; we are serious about what you are saying,'" Savage said.

Company response to whistleblower complaints

In response to the whistleblower provisions of Dodd-Frank, roundtable presenters encouraged companies to perform the following:

  • Educate employees on compliance programs and encourage them to utilize internal reporting systems.
  • Develop policies outlining management's response to whistleblower reporting.
  • Move promptly when investigating whistleblower complaints.
  • Establish and enforce whistleblower antiretaliation policies.
  • Invest in training and build infrastructure needed to ensure Dodd-Frank Act compliance.

Responding to SEC whistleblower allegations

If a company is the subject of an SEC investigation or is conducting one itself as result of a whistleblower's allegations, the organization should already have clear guidance in place regarding how it will proceed and what it will do with the results (see sidebar). Questions that need to be answered include: what information will be investigated through general council, what will be investigated by an audit committee, and whether the company will pay to bring in a forensics accountant up front or wait until later in the process to save money.

The company also needs to determine its obligations during an investigation and consider the broader implications the investigation will bring.

"At what point do you make a disclosure to shareholders, and what are the consequences of that?" Cronan said. "Part of the discussion in these situations is an assessment of management integrity. That is one of the things that federal regulators look at."

If the whistleblower complaint does reach the SEC, Berger said it is important for the company to cooperate. The majority of the information the SEC requests during an investigation comes directly from the company it's examining, so the process is much easier for both sides when companies have a already in place to make that information readily available, he noted.

Of course, it doesn't end there. As with most of its processes, companies should conduct periodic evaluations of their whistleblower to ensure it works for both the SEC and the company itself. "You have to assess if it's working; you have to look back and review what has happened and if it's effective," Berger said.

Let us know what you think about the story; email Ben Cole, associate editor. For IT compliance news and updates throughout the week, follow us on Twitter @ITCompliance.

Dig Deeper on Regulatory compliance reporting

Join the conversation

1 comment

Send me notifications when other members comment.

Please create a username to comment.

Does your company have a process in place for employees to report potential regulatory violations to upper management?