10 Things You Might Regret Not Knowing—A Whistleblower Prep Plan

By Kristin Casler, featuring Susan Frank Divers of LRN Corp.

Did you hear about the beer company that agreed in September to pay $6 million to settle Foreign Corrupt Practices Act violations and charges it acted against the whistleblower who reported the misconduct? Or the $4 million awarded that same month to the whistleblower in a fraud case. If you heard those stories, perhaps they were a wake-up call. You may be wondering how to avoid the same fate. To get you started, here is a 10-point list from Susan Frank Divers, senior advisor and ethics and compliance leader at LRN Corp. Take a look, talk to your people and make sure your company is doing everything on the list. You don’t want to be the next organization we write about, do you?

Whistleblower laws have been around for generations, but recent changes in laws and high payments to whistleblowers—bounties of as much as 30% of the amount recovered by the government for the misconduct—have inspired more and more employees to raise complaints. The SEC’s whistleblower program has awarded more than $111 million to 34 whistleblowers since its inception in 2011. That’s why it’s essential for organizations to have an appropriate plan and response.

1. Know the law.

Not every whistleblower law applies to every business. Know which ones apply to your business, then endeavor to understand their scope, possible impact on your business, timetables and how they are being enforced, Divers said. Then you must determine what conduct reported by a whistleblower may result in a mandatory disclosure to governmental agencies.

2. Create clear communication channels.

Whistleblower laws require organizations to disseminate clear communications to employees on the range of reporting channels available to them. Divers urged employers to make sure employees know how to use internal channels (such as managers, ethics staff, human resources, legal security, internal affairs, CEO or board of directors, etc.) and external channels (Information Governance, Department of Justice, Department of Defense, Securities & Exchange Commission, etc.), as frequently required by law.

3. Know when to voluntarily disclose.

Organizations must weigh carefully the advantages and disadvantages of voluntary disclosures. Educate your management in advance about the pros and cons so they are prepared when a whistleblower calls.

4. Prevent retaliation.

Not only is it not good ethics to get back at a whistleblower who is trying to do the right thing—it’s against the law. In its second ever retaliation case under Dodd-Frank, the SEC said a casino company has agreed to pay $500,000 for firing an employee with several years of positive performance reviews because he reported to senior management and the SEC that the company’s financial statements might be distorted.

Whenever a complaint is made, ensure immediately that a whistleblower is not subject to retaliation, Divers said. This means alerting everyone that retaliation is not tolerated and letting whistleblowers know that they can’t be harmed for doing what is right.

Further, you should counsel your management and HR to avoid making assumptions about the whistleblower in the absence of facts.

5. Build a protocol.

Once a complaint is made, everyone in the reporting chain should know what to do. How serious is the report? How will it be investigated? Who should be notified? Who will contact the complainant? Should outside counsel be alerted? Once you have established this protocol, re-evaluate periodically and tweak it to maintain effectiveness.

6. Keep it in-house.

“Design and implement a robust internal process that builds trust and encourages whistleblowers to report internally rather than externally to regulators, to avoid externally driven investigations and ‘proving a negative’ at great expense,” Divers said.

7. Craft a case management process.

A well-defined case management process includes:

A. An objective fact-finding investigation by trained investigators;
B. Adjudication by an independent body of reviewers to determine whether the case is valid and, if so...
C. The types of disciplinary and corrective actions that need to be taken to eliminate the problem

8. Communicate. Communicate. Communicate.

Divers urged organizations to inform all employees of the case resolution process, so they have confidence that their complaints will be reviewed using reliable and trustworthy procedures. Have regular communications with complainants, so they know their case is being investigated diligently and inform the leadership and the board of trends and results to ensure endemic problems are addressed.

9. Conduct Root Cause Analysis.

If a complaint is valid, identify whether the misconduct was caused by individual wrongdoing (a bad apple) or organizational wrongdoing (a bad tree), Divers said. Ensure that any remediation effectively addresses the problem.

10. Broadcast your work.

Publicize the types of disciplinary actions and corrective actions to the employee population so they see that actions are taken in response to complaints, which builds trust and confidence in the internal reporting process, Divers advised.