Sarbanes-Oxley Whistleblower

Best Practices In Whistleblower Systems

November, 2005
Library Sections:
 

A whistleblower hotline is probably the easiest and least expensive means available to improve corporate governance.  Waste, fraud, and the abuse of authority can all be combated by having an independent reporting mechanism that uses employees to report malfeasance.

Public companies are required by Section 301(4) of the Sarbanes Oxley Act to have a whistleblower system.  However, these systems are also valuable for private companies.  In 2005, the American Institute of Certified Public Accountants (AICPA) recommended that all organizations implement a whistleblower system for reporting wrongdoing.  In part:

"A key defense against management override of internal controls is a process for anonymous submission of suspected wrongdoing … Various forms of fraud are detected 40 percent of the time by tips, which [makes] this the leading method of detecting fraud."

Government entities also are encouraged to have whistleblower solutions by the Office of Government Ethics internal mandate under OGE 5 C.F.R. - 2635.101(B), and by requirements or encouragements such as the Hatch Act, the Whistleblower Act, the Federal Employee Protection of Disclosures Act, and OMB Circular A-123.  Similarly, non-profit organizations are finding that they have sensitive issues that are most credibly handled through an independent reporting mechanism.

Why Whistleblower Hotlines are a Best Practice

Independent whistleblower hotlines deliver the following advantages:

  1. Investigations often demonstrate that coworkers are aware that something was amiss well before management had a clue.  While some employees are comfortable reporting concerns through an open-door policy, others are not.  Despite policies to the contrary, there is sometimes still the fear of retaliation by either informal peer groups, or by supervisors.

    Ernst & Young conducted an employee survey that demonstrated this concern.  80 percent said that they would be willing to report a co-worker's unethical or illegal conduct.  Almost 40 percent said that they would more likely do so if they could remain anonymous.
  2. Earlier detection of fraudulent activities is the best way of limiting the loss.  A study by the Association of Certified Fraud Examiners reported that fraud discovered through a tip had losses that were 50 percent smaller than similar frauds detected through other methods
  3. Other losses can also be limited by early detection.  Discovering white-collar crime or financial irregularities before the problem is reported publicly can save an organization's reputation.  Similarly, an early detection and response to discrimination or harassment claims can substantially limit liability.
  4. An interactive communication generates significantly more information than a one-way communication, like an anonymous note.  There may not be a second chance to gather information, so human interaction is preferable to ensure that information is clear, complete, and coherent.
  5. A surprising number of complainers report that they have previously informed management of their concern, yet they believe that no action is being taken.  These employees use the outside complaint mechanism as a second means of handling issues that have not been addressed by those close to the problem.

An independently-run whistleblower solution is extremely inexpensive when compared to these significant money-saving advantages.  For example, Fulcrum's complete solution starts at $700 annually.  Internal solutions, while seeming inexpensive, actually cost as much or more than the independent alternatives.

Here's What Your Whistleblower Hotline Should Contain

According to the AICPA recommendation, here are the important attributes that should be part of your whistleblower solution:

  1. The solution should be operated by an independent third party.  Employees and others that might want to submit a complaint are more inclined to do so if it is publicly known that the system is operated independently.
  2. The system should have trained interviewers available to handle complaints, instead of only fully automated systems, such as voice mail and internet reporting.
  3. The solution should have a dedicated phone number, and further accept complaints using fax, website, email address, and regular mail.  The solution should be available 24 hours a day, 365 days a year.
  4. The solution should have multilingual capability to support complainants with different ethnic backgrounds, or that are calling from different countries.
  5. Complainants should have a means that allow them to either call back later, or otherwise provide responses to follow-up questions from investigators.
  6. The solution should have protocols for distribution of each type of complaint to appropriate individuals within the company based on the nature of the complaint.  Complaints involving senior management are automatically directed to the Audit Committee without filtering by management or other internal personnel.
  7. The existence of the system should be made known to employees, vendors, and other stakeholders in public documents, as well as in standard communications to each group.

What Reporting Mechanism Should be Used

There is no good reason to limit the means that employees, vendors, and others have for reporting concerns.  Each person should be encouraged to report his concern in a manner that is less threatening.

The Ernst & Young survey mentioned earlier addressed reporting preferences.  Of the employees who were willing to report problems, 57 percent preferred a phone hotline, 20 percent preferred an anonymous letter, and 16 percent preferred an anonymous website.

Regardless of the means used to collect complaints, the system should have the ability to collect supporting documents from the complainants.  This will greatly facilitate the resulting investigation and resolution that must occur.  In addition, resolution is enhanced by having a means of getting additional information from the complainant. Interestingly, although employees say that they prefer to remain anonymous, the majority of phone callers choose to provide information that allows subsequent follow-up.  Complainants realize that additional information may be needed; they will provide the means of contacting them once they realize that (i) the complaint system is operated independently, and (ii) their information will not be given back to the company without their specific permission.

Fulcrum Inquiry is a licensed CPA firm that provides an independent whistleblower solution that meets the AICPA's recommendations.  Fulcrum's solution appears to be the only whistleblower process that meets all of the AICPA's best practices. We also provide fraud investigation services.