By David Nelson and Eli Glasser
Since their implementation in 2010, the SEC’s Whistleblower regulations have been the topic of endless speculation, fascination, and analysis by the securities defense bar. But their practical impact so far has been relatively muted. According to its website, the SEC has averaged about four whistleblower actions per year. Apparently, despite the protections in place, whistleblowers still fear loss of confidentiality and retaliation. And these risks loom larger because awards rarely provide the whistleblower with the option of “walking away” from the industry entirely.
On the other hand, recent events, including the $30 million “bounty” paid to a whistleblower and the SEC’s first action based on overly restrictive language in confidentiality agreements with the potential to stifle whistleblowing, have received plenty of publicity and may incentivize and embolden other employees to come forward. The net result may be a long-anticipated increase in the number of actions brought by the SEC as a result of whistleblower complaints.
While every lawsuit filed against a company presents a disruption, an action filed by the SEC premised on particularized information provided by a whistleblower can be especially problematic, leading to a storm of litigation, including follow-on private suits. In order to effectively deal with such a scenario, companies need to have plans and key players in place to navigate a response on every front. This article discusses what steps companies should take to soften the impact of a potential whistleblower by creating a corporate culture that encourages internal reporting and to prepare in advance for the impact that reporting such information to the SEC or other outsiders will have. In addition, the discussion covers how to interact productively with the SEC once an investigation is started or a complaint is filed and to effectively manage the multiple fronts on which litigation is likely to arise.
Overview of SEC’s Whistleblower Program
Under the Dodd-Frank Whistleblower Program, a whistleblower who provides information leading to a successful SEC enforcement case which results in sanctions exceeding $1 million is eligible for awards of between 10% and 30% of the money collected. 15 U.S.C. § 78u-6(b). Moreover, whistleblowers who report potential violations of federal securities laws are protected from, among other things, retaliation for providing information to the SEC, or assisting in an SEC investigation or enforcement action. 15 U.S.C. § 78u-6(h)(1)(A). The SEC’s Whistleblower Program went into effect in July 2010 when the Dodd-Frank Wall Street Report and Consumer Protection Act was signed into law.
Planning Ahead
While a whistleblower “event” is not a common occurrence, the failure to have in place policies and procedures ahead of time can quickly turn such an event into a disaster. There is no single template for a reaction plan as variations must be made to suit the organization and the particular issues in play, but several common critical elements are outlined below. Most importantly, the procedures and policies put into place must be robust and well-publicized within the company. An important goal, among others, is to earn the trust of employees so they will feel confident that their concerns will be considered and addressed if they make use of internal means. It is said often (because it is true) that an internal reporting program’s success hinges greatly on the “tone at the top.” Every effort must be made to assure that senior executives in the organization subscribe to these principles and communicate them down the supervisory chain, with an emphasis that early and effective internal reporting is critical to getting ahead of issues that can present significant challenges for the company.
Unless there is a compelling reason not to, the company’s policies and procedures should require that the chief legal officer in the company will be informed of any whistleblower complaint. If the organization is too large for the CLO to handle the matter directly, he or she should be informed promptly and fully of any developments and the CLO should continue to have overall supervisory responsibility for any investigation or inquiry. The importance of reporting upwards is not limited to senior executives; procedures need to be instituted to assure that the need for prompt and accurate reporting up the chain is acknowledged at all supervisory levels.
Part of the remediation that is undertaken in the aftermath of a whistleblower’s revelation is to show the public company’s primary regulator, the SEC, that the company undertook in advance significant steps to foster a culture that would be receptive to and act on information from employees. Accordingly, the procedures should be carefully and fully documented as the company will want to be in a position to demonstrate that any failure to fully address a whistleblower complaint was the result of isolated failures within an otherwise effective and responsive system. This can be an important prong in demonstrating to regulators that they can rely on the company’s response because the company had in place a process that served to surface, elevate, and address legitimate internal complaints.
Other issues, less directly related to “reporting up the chain,” ought to be considered during the planning stage as well:
Evaluate the Board. Prior to a crisis, senior management should take stock of the roster of current board members and key committee chairmen. Can key members be counted on to step up and respond in a measured and effective manner to a crisis? Will independent directors get engaged and provide credibility to company decisions and direction? Will the board and its committees have a measured response that includes taking account of management’s version of events? Can they be counted on to make good decisions that benefit company/shareholders?
How is management’s “bench strength”? What are the overall capabilities of the management team? If the nature of a whistleblower’s allegations requires temporarily or permanently removing a key executive, will the company be able to survive such a loss?
Develop a “short list”. A further pre-crisis consideration for the company and its senior management team is whether management and the Board (specifically, the audit committee) can confer and agree on a short list of candidate law firms for internal investigation so there is “buy in” that the process will be fair while also being implemented quickly? Will the company put a “crisis firm” on retainer (or speed dial) to handle press? If this process is undertaken, clearly the company will want to identify firms that have sufficient familiarity with the company and resources to carry out a potentially complicated and multi-dimensional inquiry. On the other hand, the familiarity by definition has to be limited; candidates for the “short list” must have the requisite objectivity and neutrality that will resonate with regulators.
Putting into place a framework for whistleblower responses is an important component of getting through the complaint and investigation process. The company is best served if the procedures and protocol are regularly refined and updated, particularly to take account of developments in whistleblower practices and the law.
Reacting to a Complaint: Non-Public Period
Dealing with the whistleblower. Upon being served with a complaint or otherwise first learning of an investigation prompted by a whistleblower, a company must take immediate steps to protect the whistleblower from any real or perceived retaliation and to maintain his or her anonymity.
Document retention. One of the first steps companies must undertake in response to a complaint is to send out appropriate document retention notices. Management needs to get an early handle on what’s involved in terms of documents and people and make sure that all employees holding potentially relevant information are quickly advised to cease all routine destruction policies. Companies have to make sure that their C-Suite execs understand the importance of maintaining their records for their own protection and appearances.
The destruction of potentially relevant evidence, even if unintentional, can complicate investigations and create the appearance that the company has something to hide. To avoid engaging in damage control and refuting allegations of spoliation, companies will need to get ahead of these situations with timely and clear document retention notices circulated to all potential custodians, along with policies in place to ensure that such notices are being reviewed and followed.
Representation issues. In addition to retaining a law firm to assist the company in responding to the complaint, management must evaluate whether separate counsel is needed for current or former executives who will be involved in the litigation. The company should make sure to maintain current contact information for the universe of relevant ex-employees to make sure these employees have contact with company counsel and are forewarned about possible approaches by the government. Such former employees should know to direct government agents and others to communicate with company counsel.
Internal investigation. A company must move decisively and deliberately on an internal investigation. A whistleblower has 120 days to go to the SEC to preserve rights to an award. 17 C.F.R. § 240.21F-4(c)(3); 76 Fed. Reg. 34301. During this period the company’s outside counsel (in consultation with in-house counsel) must devise a timeline on when a sufficient understanding of issues has been obtained to report to the SEC and present an investigative plan. If the company appears to be acting responsibly and diligently, the SEC will generally await a final report.
Short-term Considerations
Once the whistleblower complaint becomes widely known within the organization, particularly after the work of the investigation begins, the company must promptly take further steps to protect and insulate the whistleblower from any recriminations. This protects both the company and the complainant’s immediate and up-line supervisors. On the other hand, the firm must take care not to overreact by, for example, so isolating the whistleblower that the company is open to a charge that the company has retaliated against the whistleblower by making him or her a pariah. At least two meetings should be held (one with and one without the whistleblower’s supervisor) to clarify that the complaint is being addressed, that it is unavoidable that others will learn about it, and that the company is committed to ensuring that the whistleblower’s employment situation remains as normal as possible. Also make clear that the complainant has an open channel to report anything untoward. These steps should be taken in the presence of in-house counsel and be thoroughly documented by the attending lawyers. Depending on the seriousness and sensitivity of the complaint, outside counsel (including a representative from the firm retained as an independent investigator) might also attend.
Be prepared to handle employee questions, as there will be plenty. The company should strive for a balance between preserving the confidentiality of employees’ conversations with in-house counsel with the need for the company to be able to provide information as needed to the SEC. Thus, conversations that occur as part of an internal investigation will need to be qualified with Upjohn warnings, in which employees are clearly informed that company counsel represents the company’s interests not the employee’s. While these are sometimes referred to as “internal Maranda warnings” because of the potential chilling effect they can create, with some effort they can be delivered in a manner that informs the employee but does not shut down all lines of communication.
As the internal investigation takes shape, management should make sure to reinforce the message to employees as to what’s at stake when they consent to informal interviews. They should be carefully informed that their statements could be part of a written investigation, and the company holds and can waive privilege and present to government investigators the substance of employee interviews. From time to time, this will inevitably raise the sticky issue of the consequences for an employee who wishes not to cooperate with the internal investigation. The factual circumstances are so varied that that topic itself could occupy an entire article. Suffice it to say that the situation needs to be carefully vetted with securities and employment counsel.
In addition to the question of non-cooperation, other knotty issues will arise and need to be dealt with. A prime example is deciding which employees are entitled to their own counsel. For obvious reasons, it will generally be the most senior people in the organization who were closest to the issues raised by the complainant. However, as the investigation develops, management will want to be sensitive to corollary or even new issues that might arise, and change the complexion of discussions about personal counsel for executives. The company will also need to decide when and how to communicate with employees and, prior to reporting to the SEC, what to say to the press.
The preferred course is to make early contact with the SEC, even if only to provide a very general picture, and preferably before press accounts arise. As a general rule, during the investigation less is more in terms of public statements and much thought and effort must be put into any press releases during this time. Given the many shoals to navigate, this is not always an easy stage for a public company, and the company will want to consider whether it wants to deploy a public relations or “crisis firm” as mentioned above.
Reporting out to the SEC and Department of Justice
Proactive and early communications with the agencies heading up the investigation are important opportunities to show the government that the matter is being taken seriously and handled competently. Although early reports will be preliminary and general, the company should emphasize the details of the plan going forward.
These early meetings should cover the logistics of communications with the agencies. For instance, the company should confirm that requests for documents and employee interviews should be made to company counsel; this will minimize disruption and allow in-house counsel to deal with issues such as scope and privilege. The government will generally find this arrangement acceptable if the company has convinced them that it is handling the situation responsibly.
Throughout the investigation, the company should provide the government with regular updates. While this may seem obvious, it’s not always done. The company should designate a single individual to act as the clearing house for communications with the government and vet the messages for accuracy and completeness.
Settling in for the Long Haul
Although the company must exercise restraint with its public statements during the investigation, it nevertheless must immediately begin to consider when it will be necessary to “go public.” Will this be done in stages? Is it appropriate to make a preliminary disclosure of the issues with any restatements of financials coming much later after the investigation? Detailed public reporting of the internal investigation’s findings should be held off until the company obtains a high level of confidence in their accuracy and completeness – but any delays in reporting can be mitigated by accurate forecasts of when additional information will be available. Public disclosure will have consequences, but so does uncertainty.
In addition to interest from the government, class action and derivative suits will spring up immediately after public disclosure. Other civil suits tangentially related to any drop in the stock price that might possibly be related to the public disclosures may arise as well. Any and all attempts to consolidate such actions will generally be a good idea. In addition, coordination of the legal teams involved is key to managing the process, such as making sure executives’ personal lawyers are talking to company counsel. And when dealing with a serious government investigation, particularly where the possibility of criminal actions exists, it is often wise to try to resolve other civil actions early and prior to any discovery or adverse findings by the government.
What to Expect from the SEC Whistleblower Program Going Forward
The jury is still out on the long-term impact of the whistleblower provisions. Stories of multi-million dollar payments to whistleblowers clearly will attract a lot of attention, but stories about the increasing size of awards will be tempered by the multiple instances in the program’s short history in which whistleblowers have either had their identities revealed or have been the subject of retaliation. While to date the numbers have not been what might have been expected when the program was rolled out, that calculus may change. Moreover, recent litigation and court decisions in the area of retaliation reinforce the need for companies to focus on these issues in advance.
In the meantime, it is never a mistake to prepare for a corporate crisis around the surfacing of unflattering information about a company, either from a whistleblower or from any other source. The time to take measure of procedures is clearly before the need arises to implement them.