Whistleblower Rules Could Set Off a Rash of Internal Investigations

Compliance departments should now get ready for an onslaught of internal investigations, many of them at the insistence of the Securities and Exchange Commission.

Corporate lawyers say the SEC's new whistleblower rules, adopted last week, will bring a flood of new allegations to an already overburdened agency. The end result? The SEC is likely to put the onus back on companies to investigate the initial claims and report back on their findings.

The new rules, passed on a 3-2 vote, establish a bounty program to reward individuals who provide original information to the government with as much as 30 percent of the penalties collected in resulting enforcement action. The final version deviated from the SEC's proposal in that it extended the grace period from 90 to 120 days during which a company can investigate a tip internally before the whistleblower is required to report the information to the agency to remain eligible for a bounty. A whistleblower could also be eligible for a more substantial reward by participating in a company's internal reporting system.

The whistleblower rules broadly exclude in-house counsel, compliance officers and those in similar roles (that is, people generally obligated to report wrongdoing to the SEC) from the reward program, although the final version of the rules added more exceptions when those individuals can qualify for the bounty.  The rules do not, however, require internal reporting before or even simultaneously to a whistleblower reporting to regulators—a change that many companies had vigorously lobbied for.

As a result, regulators and companies should be prepared for a “flood” of complaints, as some comment letters on the proposed rulemaking warned. While the Commission expressed confidence in its ability to handle this increase, companies should expect to field many of the investigations themselves, since the SEC is likely to send many inquiries their way. Whether or not companies are notified by the agency or from a whistleblower directly, the new pressure to detect fraud and conduct more investigations means an increase in the use of third-party investigators and higher costs. In short, the final provision means tough times for compliance officers, and dollar signs for whistleblower attorneys.

“Referral back to the company for internal investigation will happen whenever it makes sense, which will be much of the time,” says Lawrence West, a partner at the law firm Latham & Watkins. Still, the SEC might hesitate to turn the investigation over to the company in certain situations, he says, such as when the senior executives at the company are in question.

How It Will Work

The major difference with complaints that companies receive from the SEC, rather than from whistleblowers directly, is that the compliance department won't be able to control the scope and timing of the investigation nor any corrective measures, says David Feldman, a partner at the law firm Nixon Peabody. “If the SEC receives the initial report from the whistleblower, it will have a head start on the facts, and the compliance department will need not only to get up to speed on the relevant issues quickly, but then, get in front of them, certainly when there's a real issue or problem,” he says.  

Companies will also have less leeway to determine up front that a whistleblower claim lacks merit, Feldman says. “The company will more often need to explain to the SEC why it has no merit and be prepared to answer a potentially lengthy series of follow-up inquiries from the SEC,” he says.

“What's going to change—and I believe this is very unfortunate—is that the SEC will cause companies to go to greater lengths to investigate marginal or non-meritorious claims that would otherwise not have required an investigation,” says Steven Scholes, a partner in the law firm McDermott Will & Emery. “That is going to impose a strain on compliance officers and legal departments, and expenses on companies.”

“What's going to change, and I believe this is very unfortunate, is that the SEC will cause companies to go to greater lengths to investigate marginal or non-meritorious claims that would otherwise not have required an investigation.”

—Steven Scholes,

Partner,

McDermott Will & Emery

The whistleblower program puts pressure on compliance programs in other significant ways, as well. Eric Havian, a partner at the law firm Phillips and Cohen, says inadequate compliance programs will be seriously hit now that employees have an incentive to bring any misconduct that doesn't get taken care of internally directly to the SEC. “The failure to set up effective compliance programs will now be much more harmful to the bottom line,” he says.

The amount of oversight that the SEC will engage in during investigations it hands over to companies will depend on “how hot” the issue is for the SEC, says Randall Fons, a partner at the law firm Morrison & Foerster.

Compliance officers will also have to improve on their processes for triaging tips. “Internal compliance officers will need to look at how their business operates, where their vulnerabilities are, and where the information is, in order to come up with a way by which they effectively triage the information they're getting,” Fons says. That may be a lose-lose situation, however, since “if something slips through, the SEC or anybody else will be able to come in with 20/20 hindsight.”

FACT SHEET

Below is an explanation of rule requirements under the SEC's new Whistleblower rules:

The final rules define a whistleblower as a person who provides information to the SEC relating to a possible violation of the securities laws that has occurred, is ongoing or is about to occur.

To be considered for an award, the final rules require that a whistleblower must:

Voluntarily provide the SEC …

In general, a whistleblower is deemed to have provided information voluntarily if the whistleblower has provided information before the government, a self-regulatory organization or the Public Company Accounting Oversight Board asks for it directly from the whistleblower or the whistleblower's representative.

… with original information …

Original information must be based upon the whistleblower's independent knowledge or independent analysis, not already known to the Commission and not derived exclusively from certain public sources.

… that leads to the successful enforcement by the SEC of a federal court or administrative action …

A whistleblower's information can be deemed to have led to a successful enforcement action if:

1. The information is sufficiently specific, credible and timely to cause the Commission to open a new examination or investigation, reopen a closed investigation, or open a new line inquiry in an existing examination or investigation.

2. The conduct was already under investigation when the information was submitted, and the information significantly contributed to the success of the action.

3. The whistleblower reports original information through his or her employer's internal whistleblower, legal, or compliance procedures before or at the same time it is passed along to the Commission; the employer provides the whistleblower's information (and any subsequently-discovered information) to the Commission; and the employer's report satisfies prongs (1) or (2) above.

… in which the SEC obtains monetary sanctions totaling more than $1 million.

The rules permit aggregation of multiple Commission cases that arise out of a common nucleus of operative facts as a single action. These may include proceedings involving the same or similar parties, factual allegations, alleged violations of the federal securities laws, or transactions or occurrences.

Source: Securities and Exchange Commission, May 25, 2011.

Encouraging Internal Reporting

Companies still gripe over the point that whistleblowers will be able to ignore internal channels, despite assurances that these instances would be the exception, rather than the rule. “The SEC is taking internal compliance systems and they're gutting those systems by allowing whistleblowers to report directly to the Commission,” says Association of Corporate Counsel's spokesman Amar Sarwal. Although the regulators who crafted the final provision have repeatedly underlined their support of internal compliance systems, “the proof is in the pudding,” he says.

As a result of the new rule, compliance officers are likely to pull out all the stops in encouraging internal reporting and reassuring employees of retaliation protection. Compliance officers should consider not only the standard hallmarks of “effective” compliance, but also creative ways to encourage internal reporting, says Steve Fagell, a partner at the law firm Covington and Burling. “Beyond those refinements, it will be critical for companies to ensure alertness of, and communication across, each relevant department—legal, compliance, HR, internal audit—when a potential whistleblower emerges, so that a coordinated and considered response can be implemented.”

Companies can also encourage whistleblowers not to report externally within their allotted 120 days to do so by reassuring them that the internal investigation into the tip is successfully underway. Giving the employee status reports, for example, both offers reassurance that the company is responding appropriately to his or her concerns, and for an employee who has already made an external report, helps to ensure that any information the SEC receives from the employee accurately reflects the company's response to the allegations, Fagell says.

“This is going to be a turning point in driving a change in attitudes toward whistleblowers that will makes companies and their management more welcoming and more receptive of people who are raising issues internally, because it certainly is the least painful in the two ways of dealing with these issues,” says Toby Bishop, director of the Deloitte Forensic Center.