Elements of an Effective Whistleblower Hotline

It has been reported that approximately two-thirds of companies in the U.S. are affected by fraud, losing an estimated 1.2% of revenue each year to such activity. [1] Indirect costs associated with fraud, such as reputational damage and costs associated with investigation and remediation of the fraudulent acts, may also be substantial. When and where implemented, an internal whistleblower hotline is a critical component of a company’s anti-fraud program, as tips are consistently the most common method of detecting fraud. [2] Consequently, it is essential that companies consider implementing, if they have not already done so, effective whistleblower hotlines. [3] To the extent hotlines are currently in place, companies need to evaluate them to ensure that the hotlines are operating as intended and are effective in preventing and identifying unethical or potentially unlawful activity, including corporate fraud, securities violations and employment discrimination or harassment. This evaluation should be a key element of every company’s assessment of its compliance and ethics program.

Benchmarking hotline data to that of its peers and industry should also be part of a company’s compliance and ethics program evaluation and may provide valuable insight into the effectiveness of a company’s whistleblower hotline. For example, a high volume of calls to a company’s hotline (as compared to peers and its industry) may indicate that the company is experiencing significant compliance issues and potentially has an ineffective compliance and ethics program. Conversely, a high volume of hotline calls may suggest that the hotline is working as planned, that the company’s compliance and ethics employee training program is effective, that there is greater awareness of the hotline and increased trust in the company’s compliance department, and that the board of directors and management are setting the proper tone in reinforcing internal reporting mechanisms, including the hotline, and ethical culture. On the other hand, silence or a low volume of calls (as compared to a company’s peers and its industry) may not necessarily imply that all is well at the company and unethical or unlawful conduct is not occurring but, to the contrary, may be indicative of an inadequate hotline and overall ineffective corporate compliance and ethics program.

It is more crucial than ever that companies have effective whistleblower hotlines as part of their corporate compliance programs so that employees (and other company stakeholders, such as vendors) are motivated to report suspected unethical or unlawful conduct internally and not incentivized to first turn to regulators. The Whistleblower Program established by the Securities and Exchange Commission (the “SEC”) pursuant to the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (“Dodd-Frank”), for example, like certain other federal government whistleblower programs, provides monetary incentives for individuals, including employees, to come forward and report possible violations of the federal securities laws to the SEC (the “SEC Whistleblower Program”). [4] Further, it is essential that companies implement an effective whistleblower hotline and incentivize employees to use such hotline, as the reporting of suspected wrongdoing internally first may provide a company with the opportunity to address and remedy the conduct or activity before it becomes unlawful or the company is required to report it to regulators. There is often a fine line between unethical and unlawful conduct in the current regulatory environment and the reporting of suspected wrongdoing by an employee (or the company) to regulators may trigger a government investigation or shareholder suit (either of which may require lengthy, costly and resource-intensive actions by the company to defend).

To provide context as to the successes and potential monetary incentives of certain government whistleblower programs, this post first discusses the current state of the SEC Whistleblower Program. This post then (1) examines why employees may choose to avoid internal whistleblower hotlines in favor of reporting to regulators, such as the SEC, and (2) identifies certain practices that boards of directors and company management may consider to help facilitate whistleblower reporting internally and help implement an effective whistleblower hotline and reporting program.

Current State of the SEC Whistleblower Program

Under the SEC Whistleblower Program, eligible whistleblowers can potentially recover a reward equal to 10%–30% of the amount of any monetary sanctions collected that exceed $1 million in actions brought by the SEC and related actions brought by other regulatory and law enforcement authorities. The SEC Whistleblower Program also prohibits retaliation by employers against employees who provide the SEC with information about possible securities violations, including accounting fraud, market manipulation, insider trading, misleading statements in public filings and misrepresentations in the sale of securities. Notably, the SEC Whistleblower Program does not require that employee whistleblowers report violations internally in order to qualify for an award. SEC rules do, however, add certain incentives intended to encourage employees to utilize their company’s internal compliance and reporting programs when appropriate to do so. [5]

The SEC has received a high volume of hotline calls since the SEC Whistleblower Program became effective in 2011, with 3,238 calls received in fiscal 2013 (up from 3,001 in fiscal 2012). The most common complaint categories reported by whistleblowers in those calls involved fraud in corporate disclosures and financials, offering fraud and stock price manipulation. [6] The SEC has also exercised its authority under Dodd-Frank and brought a number of actions based upon those whistleblower tips. In fiscal 2013, the SEC issued 118 enforcement judgments and orders, which generated award payments of nearly $15 million to whistleblowers. [7] More recently, in 2014, the SEC has awarded the following:

• in June, $875,000 to two individuals for “tips and assistance” relating to fraud in the securities market (which represented 30% of the nearly $3 million in sanctions the SEC collected in the enforcement action);
• in July, $400,000 to a whistleblower who reported fraud to the SEC after the employee’s company failed to address internally certain securities law violations;
• in August, $300,000 to a company employee who performed audit and compliance functions and reported wrongdoing to the SEC after the company failed to take action when the employee reported it internally first; and
• in September, more than $30 million (the SEC’s largest whistleblower award to date) to an employee living in a foreign country who provided information about “an ongoing fraud that would have been very difficult to detect” and which led to a successful SEC enforcement action. [8]

Based upon the volume and increasing number of whistleblower tips to the SEC and the sizeable awards granted under the SEC Whistleblower Program to certain of the individuals providing those tips, companies should evaluate and determine the effectiveness of their internal compliance program, with a particular focus on their whistleblower hotline, to ensure that employees are encouraged and motivated to report suspected unethical or unlawful conduct by way of the company’s hotline.

Reasons Why Employees May Choose to Avoid Internal Whistleblower Hotlines

Assessing the effectiveness of an internal whistleblower hotline (should such hotline exist) and addressing reasons why employees choose to avoid reporting tips by way of that hotline in favor of reporting to regulators should be an integral component of evaluating a company’s compliance and ethics program. There are a number of reasons employees may avoid hotlines, such as the fear of retaliation (including dismissal, constructive discharge and loss of career advancement opportunities) or being labeled a “snitch” or “rat” and the fact that some company hotlines may only provide for the ability to actually blow the whistle and do not serve any additional function. [9] Further, employees may perceive that they do not have shared values with the company or that the “tone at the top” among the board of directors and management is not one that promotes or rewards ethical behavior. Moreover, employees simply may not be aware of the hotline, how it works, the procedures involved, the ramifications of calling and making a report, or the various hotline-related protections provided to them, including the confidentiality of calls.

Considerations to Help Facilitate Whistleblower Reporting Internally and Implement an Effective Whistleblower Hotline and Reporting Program

To address reasons employees may be reluctant to use an internal whistleblower hotline and to help facilitate an effective whistleblower hotline and reporting program, boards of directors and management should consider the following:

• Hotline as an integral part of company’s corporate compliance and ethics program. A whistleblower hotline is often a key component of an effective corporate compliance and ethics program. Research reveals that internal employee hotlines facilitate the detection of unethical or unlawful conduct, as tips are the most common detection method for suspected wrongdoing in companies with or without hotlines. In companies with an internal hotline, tips account for over half of all fraud detection versus only one-third of detections in companies with no internal hotline. Notably, the rate of discovering fraud “by accident” more than doubles when a company fails to offer a hotline. [10] Therefore, companies should review their internal compliance and for prompt identification and redress of suspected unethical or unlawful acts and provides management with the necessary tools to resolve such acts internally.
• Anonymity and confidentiality. Employees should be able to make whistleblower tips anonymously or, at the very least, confidentially, as research indicates that employees are more comfortable reporting suspected wrongdoing when such options are available. In 2013, 60% of internal fraud tips were reported anonymously. [11] Anonymous and confidential reporting mechanisms help foster a climate whereby company employees are more likely to report or seek guidance regarding potential or actual wrongdoing without fear of retaliation.
• No retaliation. Companies must emphasize when publicizing hotline reporting procedures that they will not and are prohibited by law from retaliating against employees who make whistleblower reports. The fear of retribution is generally strong among potential whistleblowers and such fear may adversely affect the effectiveness of the internal reporting process. Trust in a company’s whistleblower processes, including making hotline reports without fear of retaliation, is essential to motivate employees to report suspected unethical or unlawful conduct internally. Further, in addition to the whistleblower anti-retaliation protections found in a number of federal statutes, most states also provide related protections that may apply.
• Whistleblower incentives. Companies should offer financial as well as non-financial reporting incentives, such as cash rewards or extra vacation days, for whistleblower reports that lead the company to identify suspected unethical or unlawful activity. Although the percentage of companies offering rewards for internal whistleblowers is estimated to be approximately 10%, external incentives (such as the SEC Whistleblower Program’s financial rewards) may motivate employees to first report outside the organization. [12] A company may minimize external incentives by offering its own reporting programs, including hotlines, as well as their internal investigation procedures, and consider initiatives (e.g., a training program that identifies the areas that pose the most risks to the company) that actively promote those programs (emphasizing confidentiality and non-retaliation), simplify reporting procedures and attempt to make related policies more accessible and easy to understand. A company’s hotline policy should be a clear, well-communicated written policy that allows reward/compensation system to internal whistleblowers for tips that identify unethical conduct, fraud and waste and those that save the company resources, for example, through workplace safety and process improvements.
• Positive “tone at the top.” SEC Chair Mary Jo White recently commented that it is up to company directors, along with senior management under the purview of the board, to set the “all-important ‘tone at the top’ for the entire company.” Setting the standard in the boardroom that good corporate governance and rigorous compliance are essential helps establish a strong corporate culture throughout a company. [13] Creating a culture in which internal reporting is valued and where tipsters are protected is essential to preventing and detecting suspected unethical or unlawful conduct. A positive tone from the top of a company may ease the stigma of utilizing a company hotline, making employees feel less intimidated when they decide whether to report to the internal hotline in the future. Also, a board’s or management’s effective and expeditious response to hotline calls will help facilitate communicating a proper message to employees so they do not lose faith in the board or management and feel as though their only option is to report suspected wrongdoing to regulators. Further, senior management should praise whistleblowers who first report suspected unethical or unlawful conduct internally (versus to regulators) to reinforce that such action is encouraged and supported.
• Educate, publicize and make hotline available. Companies should ensure that their compliance and ethics program includes regularly educating employees on and publicizing the who-what-when-where-why-how of reporting suspected unethical or unlawful activity via the company’s whistleblower hotline. A portion of the compliance department’s budget should be dedicated to educating (e.g., on what types of activities or observations are appropriate for reporting and those that are not) and promoting the company’s hotline. Certain compliance experts note that keeping a positive hotline message (for example, using words such as accountability, transparency, responsibility and citizenship as opposed to fraud, corruption, embezzlement, bribery and crime) may help alleviate psychological barriers that prevent or discourage tipsters from using the hotline. [14] Further, companies should make hotlines available 24 hours a day and 365 days a year. Employees may feel more comfortable reporting suspected wrongdoing outside of normal work hours to preserve anonymity.
• Multiple uses for hotline, including a helpline. Companies should expand the reasons an employee may contemplate calling the hotline, such as having the hotline also serve as a helpline, as this may alter the perception or negativity associated with hotlines and facilitate reducing the fear of calling and the associated stigma. For example, a company can encourage employees to use the hotline/helpline to receive interpretative guidance on provisions of the company’s code of ethics, make efficiency and process improvement suggestions (which could potentially save the company resources through innovative employee ideas) or report quality control or workplace safety concerns. Further, board and management actions that help change the perception of using the company hotline may reduce the barriers an employee feels before reporting his or her first tip and, after such tip, the employee may be more readily inclined to report future suspected wrongdoing. Research reveals that employees who are repeat tipsters to the company’s internal hotline have a higher rate of legitimate claims than first-time reporters. [15]
• Record and analyze statistics. Companies should use their hotlines as a tool for collecting and analyzing information on the company’s overall internal compliance, reporting and ethics program. Data a company receives in connection with its whistleblower hotline should be reviewed by management with board oversight to monitor, among other metrics, the rate of employee hotline use, the company’s record of following up on tips, whether claims are substantiated and the departments that are most frequently implicated in the reports.
• Benchmark. Companies should benchmark their compliance programs to internal (e.g., location, business units and departments) and external (e.g., peers and industry) data sources. Company data is often available by way of its internal or third-party hotline database, while peer and industry hotline data may be purchased from third-party providers. Hotline data benchmarking provides companies with comparative information to determine reporting patterns that are higher than, lower than or in line with peers and their industry, which information may suggest mistrust or misuse of the whistleblower hotline or be indicative of more serious company-wide compliance and ethics issues.
• Hotline managed by third-party provider. Whistleblower hotlines should be managed by independent third-party providers which, if so used by a company, should be well publicized to its employees. Employees tend to trust independently managed more than internally maintained hotlines. Further, third-party providers generally have more experience in managing whistleblower calls and may provide company boards and management with insightful hotline data, reports and analyses of the effectiveness of the hotline.
• Allow multiple methods for submitting tips. Employees should be allowed to submit whistleblower tips in multiple forms such as via U.S. mail, a designated website and a dedicated phone line. Depending on a number of factors (e.g., location, educational background, age and level of employment), employees may differ on their preferred method of reporting compliance concerns.
• Evaluate, test and audit. Hotlines, whether managed internally or outsourced to a third party, should be evaluated, tested and audited to ensure that the manner in which hotline calls are received, recorded and managed is consistent, confidential, accurate and timely, and that the hotline is operating as intended by the board and management.
• Educate other stakeholders and grant access to hotline. Companies should expand trainings and dissemination of educational materials relating to their compliance and ethics program to include not only employees, but also other company stakeholders (such as vendors) and agents. Regularly educating other stakeholders and agents on the who-what-when-where- why-how of reporting suspected wrongdoing by way of the company’s hotline may prove beneficial to the company through an increased number of substantiated hotline reports.

The quality of a company’s internal compliance and reporting programs and how effectively they are communicated to employees may significantly impact whether a whistleblower first reports internally or approaches a regulator, such as the SEC. An effective whistleblower hotline is a good corporate governance practice, is essential to a company’s successful corporate compliance program and in turn, the company’s long- term success, and helps ensure that a silent hotline reflects the effectiveness of a company’s compliance and ethics efforts and is not an indication of something more ominous.

Endnotes:

[1] 2013/2014 Global Fraud Report, Who’s Got Something to Hide?, Kroll (October 2013), at 12.
(go back)

[2] See Report to the Nations on Occupational Fraud and Abuse, 2014 Global Fraud Study, Association of Certified Fraud Examiners (2014), at 19 (noting that the top four ways organizations initially detect fraud are 42% by tips, 16% by management review, 14% by internal audit and 7% by accident).
(go back)

[3] The Sarbanes-Oxley Act of 2002 requires all publicly traded companies in the U.S. to establish a reporting function allowing for the confidential, anonymous reporting by employees of concerns regarding questionable accounting or auditing matters. To comply with this requirement, many companies have implemented an internal hotline. According to a 2011 report, 99% of surveyed publicly traded companies offer an anonymous hotline to employees as a means of reporting suspected unethical or potentially unlawful activity. Dodd-Frank: Big Headlines, Not-So-Big Impact, Society of Corporate Compliance and Ethics and Health Care Compliance Association (July/August 2011), at 4.
(go back)

[4] For additional information on the SEC Whistleblower Program, see the SEC’s Office of the Whistleblower website, available at http://www.sec.gov/about/offices/owb/owb-resources.shtml.
(go back)

[5] Such incentives, for example, include (1) making a whistleblower eligible for an award if the whistleblower reports internally, the company informs the SEC about the violation and a successful SEC action ensues, (2) treating an employee as a whistleblower, under the SEC program, as of the date that employee reports the information internally, as long as the employee provides the same information to the SEC within 120 days and (3) providing that a whistleblower’s voluntary participation in the company’s internal compliance and reporting programs is a factor that can increase the amount of an award.
(go back)

[6] U.S. Securities and Exchange Commission: 2013 Annual Report to Congress on the Dodd-Frank Whistleblower Program, at 8.
(go back)

[7] Id. at 13 and 15.
(go back)

[8] SEC Press Release 2014-113 (June 3, 2014) and Order Determining Whistleblower Award Claim, SEC Release No. 72301, File No. 2014-5 (June 3, 2014); SEC Press Release 2014-154 (July 31, 2014) and Order Determining Whistleblower Award Claim, SEC Release No. 72727, File No. 2014-8 (July 31, 2014); SEC Press Release 2014-180 (August 29, 2014) and Order Determining Whistleblower Award Claim, SEC Release No. 72947, File No. 2014-9 (August 29, 2014); SEC Press Release 2014-206 (September 22, 2014) and Order Determining Whistleblower Award Claim, SEC Release No. 73174, File No. 2014-10 (September 22, 2014).
(go back)

[9] Some whistleblower hotlines are established for the sole purpose of reporting suspected unlawful activity. As discussed further below under “Considerations to Help Facilitate Whistleblower Reporting Internally and Implement an Effective Whistleblower Hotline and Reporting Program,” other hotlines also serve additional purposes, such as “helplines.”
(go back)

[10] Report to the Nations on Occupational Fraud and Abuse, 2014 Global Fraud Study, supra note 2, at 22.
(go back)

[11] The 2014 Ethics and Compliance Hotline Benchmark Report, NAVEX Global (March 2014), at 12.
(go back)

[12] Report to the Nations on Occupational Fraud and Abuse, 2014 Global Fraud Study, supra note 2, at 31.
(go back)

[13] SEC Chair Mary Jo White (Speech), Stanford University Rock Center for Corporate Governance, Twentieth Annual Stanford Directors’ College (June 23, 2014), discussed on the Forum here.
(go back)

[14] See Hotlines for Heroes: Making a Fraud Hotline Accessible and Successful, Fraud Magazine, Janet M. McHard and Beth A. Mohr (July/August 2011), at 32.
(go back)

[15] See The 2014 Ethics and Compliance Hotline Benchmark Report, supra note 11, at 10 (reporting that first-time tipsters have a 35% substantiation rate versus 40% for repeat tipsters).
(go back)