The rules proposed by the SEC to implement the Dodd-Frank whistleblower provisions could undermine corporate compliance programs, in the view of the Society of Corporate Secretaries and Governance Professionals. In a letter to the SEC, the Society suggested modifications in the proposal that are intended to strike the proper balance in preserving the purposes of effective corporate compliance programs while also fulfilling the legislative mandate to maximize the submission of high-quality tips and enhance the utility of the information reported to the Commission.
Integral to compliance programs, noted the Society, corporate tip lines are valuable mechanisms for revealing and remedying securities law violations. The Society urged the SEC not to undermine these federally mandated programs which already exist at most public companies. Rather, these corporate compliance programs should be the first line for reporting violations, said the Society, and persons seeking a whistleblower bounty should be required to first report the information to the company so long as the company has an effective corporate compliance program.
Section 301 of the Sarbanes-Oxley Act, adopted as Exchange Act Rule 10A-3, required companies to establish tip line procedures for anonymous reporting relating to accounting, internal accounting controls, and auditing matters. The Society believes that these in-place procedures can be readily modified to include the anonymous reporting of potential securities law violations.
These hot line programs generally require employees to internally report any potential violations of law. In the Society’s view, it is thus important that the SEC whistleblower rules work in tandem with these existing procedures. The Society asks that the SEC rules expressly require an employee to report first through the company’s compliance and tip reporting programs, with a futility exception, or risk totally undermining existing programs. Specifically, the Society suggested that initial reporting to the company could be implemented by including a section in proposed Form TCR inquiring whether the whistleblower reported first to the company’s internal compliance program, and if not, why not.
At the same time, the Society recognized that for companies with no effective compliance programs it may be appropriate for an individual to report first to the SEC. For example, initial SEC reporting would be mandated when a company does not have any reporting process in place that protects anonymous or confidential reporting or when the audit committee has not adopted procedures for the handling of reports relating to securities violations. These exceptional circumstances should be expressly defined in the rules, said the Society, and the employee submitting Form TRC to the Commission should provide an explanation with evidence of these specified circumstances.
The Society also suggested that a company should have 120-days after being notified of a securities law violation by a whistleblower to investigate, remediate and report back to the tipper. If the tipper is not satisfied with the report from the company, the tipper may begin the SEC process. Having the employee report first to the company and giving the company an opportunity to investigate the matter and take appropriate remedial action quickly can save limited and valuable SEC resources, emphasized the Society. Also, when the Commission first receives the tip, as currently contemplated under the proposal, and then notifies the company of such fact, there could be unnecessary delay in the company learning of the violation, and therefore delay in its ability to initiate any remediation actions.
Further, the proposal to allow awards to be granted to persons who participated in the violation would reward wrong-doers. The Society believes that individuals who actively participated or facilitated the violation, even if such person did not substantially direct, plan or initiate the misconduct, should not be awarded a whistleblower’s bounty.
The Society also asked the Commission to confirm that it intends to assert the FOIA exception for records of an ongoing investigation by law enforcement agencies for any tips received by it prior to its determination to open an investigation as well as with respect to any information regarding a closed investigation where no enforcement action was recommended.
Under the proposed rules, the SEC does not have to obtain permission from a company’s counsel in order to speak with a whistleblower. While the SEC does not need permission to speak directly with a whistleblower, the Society asked the SEC to revise the proposal to require that the SEC notify the company that it intends to speak with a whistleblower. Anonymous whistleblowing to the Commission puts companies at undue risk, said the Society, if they determine to take a disciplinary action against an employee who may then claim the protections of the anti-retaliation provisions. Companies should be aware that an employee made a whistleblower claim to ensure that any actions taken by the company does not appear to be retaliatory.