Whistleblower provisions

October 2024  |  ROUNDTABLE | FRAUD & CORRUPTION

Financier Worldwide Magazine

October 2024 Issue

A cultural shift encouraging transparency, accountability and ethical behaviour has led to a noticeable increase in whistleblower reports of misconduct in recent years. In turn, award programmes have rewarded whistleblowers and held misbehaving companies to account, with governments recovering billions through fraud enforcement actions. As more organisations implement effective compliance and ethics programmes that include properly designed whistleblower provisions, whistleblowers remain a key source of information for many categories of financial misconduct.

FW: To what extent has there been an uptick in the number of employees blowing the whistle in recent years? How important is this trend in the fight against corporate wrongdoing?

Morris: Whether through critical Google reviews, 1-star ratings or tweets expressing our dissatisfaction, as a society we are increasingly able to hold misbehaving companies to account. This is equally true in the workplace, where today’s employees demand fair treatment and ethical behaviour. This has led to a rapid increase in employee whistleblowing reports, with the number of claims reaching employment tribunals in the UK rising by 92 percent between 2015 and 2023. In terms of impact, according to the Association of Certified Fraud Examiners, 43 percent of workplace frauds are identified via people speaking up to organisations. In our experience, whistleblowers are a key source of information for many other categories of financial misconduct. Where fraudulent activities are deliberately concealed or hidden within a mass of financial transactions, having an engaged whistleblower who can explain the mechanics of the scheme and decode cryptic communication is often the key factor in a successful investigation.

Zack: Both survey and anecdotal evidence point toward a rise in internal reporting of suspected wrongdoing. In its most recent report, based on 2023 data, Navex indicated that reports per 100 employees reached their highest level in 2023. There seems to be a correlation between increased reporting and a couple of factors. First, as more organisations implement effective compliance and ethics programmes that include properly designed whistleblower provisions, employees are increasingly comfortable in reporting something that does not seem right. In addition, as more government enforcement agencies launch hotlines – some that include financial rewards for whistleblowers, although this is concentrated heavily in the US – compliance departments are doing more to make sure employees are aware of their options for reporting internally in hopes that these channels will be used before resorting to external reporting. Lastly, more companies are making their hotlines available to third parties, such as suppliers, vendors and customers, who may be aware of problems. This further increases the likelihood of learning about issues early, before they have a chance to grow.

Evangelista: There are several whistleblower award programmes in the US, including programmes administered by the Securities and Exchange Commission (SEC), the Commodity Futures Trading Commission, the Financial Crimes Enforcement Network (FinCEN) and now the Department of Justice (DOJ). The SEC’s programme in particular has been extremely successful with over $2bn in awards paid to whistleblowers since the programme’s inception in 2011. According to statistics released by some of the agencies, whistleblower reporting continues to increase every year. For example, the SEC received over 12,300 tips in 2022, a record that was broken in 2023 when over 18,000 tips were submitted to the agency. Other programmes appear to be growing as well, including FinCEN’s relatively new programme that now covers both anti-money laundering and sanctions violations. I expect this trend to continue and the importance of these programmes to both corporate governance and government enforcement efforts to increase in the coming years.

Petrov: There has been a noticeable increase in whistleblower reports of misconduct in recent years and there are several factors contributing to this trend, including a broader cultural shift that encourages transparency, accountability and ethical behaviour. Employees are becoming more vigilant about corporate wrongdoing and are increasingly willing to speak up to protect the interests of their organisations, colleagues and society. These reports can offer an early detection mechanism to discover potential wrongdoing which can prompt action before significant harm has occurred. No doubt, the rise of digital platforms and social media provide outlets to expose wrongdoing with relative ease and anonymity. Reports can generate additional measures to prevent and detect misconduct, ultimately enhancing corporate governance and integrity. By encouraging and protecting whistleblowers, organisations can demonstrate their commitment to integrity and responsible business practices. This helps build trust and confidence among employees, customers, investors and the public, enhancing the reputation of the organisation.

FW: Why it is important for companies to include a whistleblower programme as part of their corporate governance efforts? Has it become integral to promoting good ethics, culture and conduct?

Zack: Studies consistently show that use of a reporting channel is one of, if not the most, valuable methods of identifying fraud, corruption or other forms of noncompliance and wrongdoing. Biennial studies repeatedly indicate that reports from whistleblowers are the most common way that fraud and corruption is discovered, ahead of internal audit and other internal controls. Indeed, reporting by whistleblowers is one of the three primary methods of detecting noncompliance or breakdowns in internal controls. The other two are an internal audit function and a variety of internal monitoring activities. These three pillars of detection are all crucial to having an effective compliance and ethics programme.

Evangelista: A strong internal whistleblower programme and ‘speak up’ culture is integral to promoting a strong culture of compliance and integrity within any organisation. It is important for employees to have safe and confidential channels to report potential misconduct, and for companies to have strong anti-retaliation policies in place. Regulators are increasingly viewing a well-designed and implemented programme as one factor that can help demonstrate that the company has a strong culture of compliance.

Petrov: Including a whistleblower programme in corporate governance efforts is crucial for promoting ethical conduct and culture for many reasons. It enables early detection and mitigation of misconduct, fosters an ethical work environment, demonstrates commitment to compliance and governance, enhances trust and employee engagement, identifies systemic issues, ensures legal compliance, protects against reputational risks and encourages internal reporting over external avenues. By offering a confidential and secure reporting channel, companies can detect and address misconduct at an early stage, preventing further harm, and ensure that reporting persons do not fear retaliation because of raising concerns. It is essential for the programme to be embedded in the company’s code of ethics or a similar document to emphasise its significance. By doing so, the company sends a clear message to its employees that ethical behaviour and reporting concerns are valued and encouraged and promote a culture of openness, visibility and accountability.

Morris: A successful whistleblowing or ‘speak up’ programme provides a window into the culture of an organisation, and can identify issues and problems before they become catastrophic. Other commonly reported benefits include increased employee satisfaction and engagement, promotion of positive culture, mitigating risk of reputational damage, cost savings and improved internal controls and processes. However, while such programmes are now commonplace, companies that are willing to ‘listen up’ are less so. Failing to act on reports, or worse, allowing victimisation and retaliation of whistleblowers, particularly where concerns are raised about leadership, ruins careers and stifles future reporting. One recurring feature of complex fraud investigations is that those responsible have been the subject of previous complaints or grievances about bullying, micro-management and other forms of harassment. Failure to deal with these issues seems to create a culture where financial wrongdoing can go unchallenged.

FW: What legal or regulatory requirements do companies need to satisfy in their whistleblower frameworks? What penalties or other consequences could they face in the event of non-compliance?

Evangelista: While there are no formal legal requirements in the US for internal whistleblower programmes, in general, companies need to ensure they adopt and implement strong anti-retaliation and whistleblower-protection policies and procedures to comply with applicable federal and state laws. For example, the Sarbanes-Oxley Act, which applies to publicly traded companies in the US and their wholly owned subsidiaries, prohibits a broad range of retaliatory adverse employment actions, including discharging, demoting, suspending, threatening, harassing or otherwise discriminating against a whistleblower. Companies also need to be aware of any potentially improper confidentiality restrictions in their employment contracts or separation agreements that could be viewed as limiting the ability of employees to report misconduct directly to government authorities. Also, the European Union (EU) Whistleblower Directive, as implemented by member states, contains requirements for companies of a certain size to design and implement reporting channels and anti-retaliation policies.

Morris: In the UK, the key whistleblower legislation is the Public Interest Disclosure Act 1998 (PIDA), which protects workers from reprisals from their employer if they disclose concerns which are in the public interest. The PIDA also defines ‘prescribed persons’ who are individuals or organisations which workers can blow the whistle to. The most stringent regulations come from the Financial Conduct Authority and the Prudential Regulation Authority. They require firms to implement internal whistleblowing policies and appoint whistleblowing champions, and can penalise firms and senior managers through public censure and disciplinary actions including fines. In Europe, the EU’s Whistleblowing Directive 2019 was intended to harmonise requirements and set common minimum standards across member states. However, piecemeal implementation and bespoke additions have created a patchwork of different requirements. Where these interact with data privacy laws, multinationals may even find that different national laws and regulations conflict with each other, and we have seen a growth in enquiries for professional advice to help avoid potential fines.

Petrov: Companies need to satisfy various legal and regulatory requirements in their whistleblower frameworks, which can vary depending on the jurisdiction. Some common requirements include protecting the anonymity, confidentiality and non-retaliation of whistleblowers, often accomplished through a dedicated hotline or email. The investigation needs to be an unbiased and fair process to assess and address reported concerns. Companies also may be required to communicate their whistleblower policies and procedures to employees and provide training on their rights and obligations. In the event of non-compliance, companies may face penalties and other consequences imposed by regulators or legal authorities. The specific penalties can vary significantly based on jurisdiction and the severity of the non-compliance. Some potential consequences could include legal actions, financial penalties and reputational harm, and a loss of trust from customers, employees and stakeholders.

Zack: Whistleblower requirements can be quite complicated, particularly for multinational companies. It is always advisable to research the specific provisions in place in each country in which you operate. Even determining whether a company is considered to ‘operate’ in a country and be subject to its whistleblower rules can be complex. Once that is determined, assessing what is required or allowed in each country is important. Provisions that are required or permitted in one country could violate the law in another country. Provisions that differ from one country to another may include issues dealing with privacy and anonymity, how reports can be made, what types of issues can be reported, whistleblower protection, and even whether a hotline itself is allowed.

FW: To what extent is there a risk that individuals will bypass internal whistleblower programmes and report their concerns directly to regulators? How can companies avoid this scenario, and ensure that their own whistleblowing programmes are seen to be effective and protective?

Petrov: There is no doubt that individuals may bypass internal programmes and directly report their concerns to regulators. But of course, a company would like to hear concerns directly and should seek to increase the level of trust employees have with internal reporting mechanisms. Having a comprehensive and well-publicised internal programme that provides clear guidance on how to report concerns, ensures confidentiality and demonstrates a strong commitment to addressing reported issues is critical. Employees should be comfortable to voice concerns internally without fear of retaliation and the company must demonstrate that reports are taken seriously and addressed promptly. It is critical that programmes provide awareness and educate employees on how to make reports and what their rights are. Managers and leaders should also be trained on how to handle allegations of misconduct appropriately. Lastly, collecting feedback from employees, tracking reporting trends, investigating allegations promptly, and making improvements in response to identified weaknesses can foster better practices and effectiveness.

Zack: Individuals bypassing internal whistleblower programmes and reporting their concerns directly to regulators is increasingly becoming a risk, particularly given the proliferation of government reporting channels and the increased use of financial rewards. But it is a risk that an organisation can reduce significantly by maintaining an effective and trusted whistleblower programme. Mandating that employees report first internally before they can report to regulators simply does not work and may even be illegal in some jurisdictions. The most effective programmes are those that offer multiple methods of reporting – ranging from in-person reporting to supervisors or others, to web-based, telephone-based, and other options. As a result, employees are aware of the reporting options and are encouraged to use them. Employees are also given clarity regarding what the reporting system should be used for and how to submit a useful and actionable report. A timely and effective investigation function allows reports to be followed up on promptly, ensures that there is an effective whistleblower protection programme in place, and follows consistent practices in enforcement and discipline in order to avoid perceptions of favouritism. Trust is the single most important element of a reporting programme. Employees must be able to trust that their reports are properly handled, that they are protected from retaliation, and that the organisation takes appropriate action when wrongdoing is discovered.

Morris: Whistleblowers may choose to report externally, whether to a regulator or the press, irrespective of whether they have first reported the issue to the company internally. This poses a risk to companies as external scrutiny in itself can damage brands, and regulatory enquiries are frequently costly and time-consuming. Companies can avoid or mitigate regulatory censure by having effective whistleblowing frameworks which engage with employees. There are many components to an effective whistleblowing programme but two key elements which make a real difference are protecting the whistleblower and following up with them on concerns raised. Companies should also focus on having strong leadership with a commitment to ethical behaviour, clear whistleblowing policies and procedures, accessible channels for reporting concerns, appropriately experienced and resourced investigation teams, and a commitment to implementing corrective actions when issues are identified.

Evangelista: There is always going to be a risk that individuals will report directly to regulators, particularly given the financial incentives that are now in place. But the risk is somewhat ameliorated when government programmes allow whistleblowers to obtain awards if they report to the government within a certain period of time following an internal report. For example, the DOJ’s pilot programme provides that a whistleblower can still be paid an award if they file a report with the DOJ within 120 days of making an internal report, even if the company has made a self-disclosure following the internal report. Ultimately, companies can minimise the risk that employees will bypass internal whistleblower programmes by investing in the design and implementation of their programmes, investigating whistleblower reports quickly and efficiently, and taking appropriate action to address any violations of law or company policies. Whistleblowers who do not feel that their company’s response is thorough or sufficient may opt to go directly to regulators instead. Therefore, it is often in a company’s best interest to maintain a relationship and dialogue with a whistleblower throughout the process and through to resolution.

FW: What impact can robust internal whistleblower processes have on reputational risk management?

Zack: The internal culture of an organisation can have a profound impact on both the internal and external reputation of that company. And the level of comfort that employees feel in reporting suspected acts of wrongdoing is an important part of organisational culture. Reputation can be ruined quickly when companies fail to follow the correct steps, and it can take years to recover from a single misstep. Once trust is lost, it is a long and uphill battle to recover it. Organisations should keep that in mind every time a new report comes in from a whistleblower.

Morris: Many people who raise concerns within organisations do not initially identify as whistleblowers, and simply want to fix an issue or do the right thing. Frustration with the pace and effectiveness of this process may motivate them to report externally, so protecting whistleblowers and having a plan to communicate with them regularly are important parts of a reputational risk plan. Should a request for a comment arrive from a journalist, companies that are able to state that an internal investigation is underway, and that remedial actions have already been taken, are better able to minimise the blowback and protect their value. In our experience, a robust response has even led to a net increase in company value, as investors are reassured that management is capable of getting to grips with underlying operational issues. On the other hand, trying to silence a whistleblower or cover up concerns can become the story itself, overtaking the concerns about the initial misconduct.

Evangelista: Internal whistleblower processes help companies manage reputational risk by enabling the company to identify and address potential misconduct before it becomes public or is the subject of a government investigation. Companies need time to investigate allegations of misconduct, and a well-designed and internally respected internal whistleblower programme will give the company some breathing room to investigate and remediate problems before they become public and potentially harm the company’s reputation.

Petrov: Effective whistleblower processes allow for the early detection and reporting of potential wrongdoing within an organisation. By identifying and addressing such issues internally, companies can mitigate and rectify problems before they escalate, minimising damage to their reputation. A robust internal whistleblower process demonstrates that a company takes compliance with laws and regulations seriously. This commitment can help improve the organisation’s reputation as a responsible corporate citizen, which is increasingly important for attracting customers, investors and business partners who value ethical practices. By promptly addressing and resolving reported concerns, whistleblowing processes enable companies to mitigate reputational damage and can demonstrates a commitment to maintaining high standards, which can help protect the company’s image in the eyes of stakeholders.

FW: What essential advice would you offer to companies on implementing an effective whistleblower programme? What aspects need to be considered and included?

Petrov: A strong and effective whistleblower programme should be governed by clear, comprehensive and accessible policies and procedures that outline the purpose, scope, confidentiality protections and reporting channels. There must be regular training and awareness, explaining that there are various channels to raise concerns, such as a web platform, telephone, email or phone app, and the opportunity to do that anonymously. Ensuring that there is a thorough investigation process which addresses substantiated concerns and acts on root causes and learnings, with appropriate disciplinary measures taken, is critical. Finally, closing the loop with those who spoke up, providing feedback and thanking them for their courage should not be missed as this is very powerful in building trust in the programme. In short, by prioritising confidentiality, protection and responsiveness, companies can establish an effective whistleblower programme that encourages employees to speak up and contributes to a stronger ethical corporate culture.

Evangelista: It is key for companies to assess how their current whistleblower programme is working and analyse the data. For example, how many whistleblower reports are submitted each year? What types of misconduct are most frequently reported? How quickly are matters investigated? What are the year over year trends? What communications does a company provide to a whistleblower at the start, during and at the end of an internal investigation? Like an anti-money laundering (AML) programme, periodic testing and assessment of an internal whistleblower programme is one of the best ways to ensure that a whistleblower programme is implemented effectively.

Morris: There are many essential elements to an effective whistleblowing programme which start with having a clear policy and procedures, and making your employees, contractors, suppliers and other stakeholders aware of them through campaigns and training. Organisations with mature whistleblowing functions will analyse their whistleblowing data – for example by location, department, theme and seniority of individuals involved – to identify recurring problem areas, and will evaluate their programme through regular monitoring and audits. One area that almost all organisations can improve is anti-retaliation measures. Looking at pay awards to people involved in cases, such as whistleblowers, witnesses and wrongly accused employees, in the two years post-investigation, and comparing these to their peers, can be an effective measure of whether retaliation is taking place.

Zack: Implementing an effective whistleblower programme really begins with communicating and making employees aware that the company wants to hear from them, that regardless of whether their tip leads to the discovery of fraud or illegal acts, if their report was made in good faith, they will be protected. This is an important element, making sure employees know that their report does not have to result in a conclusion that someone violated a law. If a reporter honestly reports something that to them appears to be a violation, they should be protected, regardless of the outcome of the investigation. One additional consideration is that the hotline should be viewed as the last option for internal reporting. The best cultures usually involve an openness and comfort in making reports in person, whether that is to a manager, someone in human resources, or other internal channels.

FW: Is the whistleblower’s experience a factor that should be taken into account when developing a framework? How can this improve whistleblowing frameworks?

Evangelista: The whistleblower’s experience may make a difference as to whether or how quickly a whistleblower reports an issue to authorities and whether others feel comfortable coming forward. Companies should have processes and procedures that address whistleblower communication as well as confidentiality and anti-retaliation. Companies must, of course, balance a whistleblower’s request for access to information about ongoing investigations with the company’s legal obligations and proprietary interests. But it is relatively easy to ensure that whistleblowers receive regular updates to let them know that they have been heard and that the company is expeditiously investigating their claims and remediating issues if the claims are substantiated.

Morris: The whistleblower’s experience is a critical factor for a sustainable and successful whistleblowing framework. Beyond the hygiene factors of accessibility, of particular importance is the communication with the whistleblower. If they feel they have been heard and are kept abreast of the process, they will feel engaged. Acknowledging receipt, setting out anticipated timescales and an update on closure, all help in managing expectations and the individual coming away understanding that something was done. This obviously has to be balanced with confidentiality, the rights of the subject of the reports and resource constraints. Employees talk, and a positive whistleblowing experience will enhance the credibility of the whistleblowing framework no end.

Petrov: Reporting channels should be easy to find, accessible and user-friendly. For example, offering a web platform in multiple languages or a phone hotline where employees can speak in their own language facilitates reporting. Offering the opportunity to report anonymously is vital, as various benchmarking studies show that up to half of all concerns raised are reported anonymously because whistleblowers may fear retaliation. Establishing effective communication channels that also keep reporters informed about the progress of their report – within the boundaries of confidentiality and data privacy – is crucial to demonstrate transparency and maintain trust throughout the process. By considering the whistleblower’s experience and implementing measures to ensure confidentiality and fair treatment, whistleblowing frameworks can create an environment that encourages reporting and enables effective investigations. This, in turn, enhances the overall effectiveness and credibility of the framework, promoting a culture of transparency, accountability and ethical behaviour within the organisation.

FW: How do you expect whistleblower provisions to evolve in the months and years to come? Will companies need to continue their focus on establishing a ‘continuous listening’ and ‘speak up’ culture?

Morris: The direction of travel is clear, and we anticipate further development of whistleblowing provisions due to greater employee demands and the increased public focus on fraud and corporate wrongdoing. In the UK, the 2023 Economic Crime and Corporate Transparency Act will incentivise large organisations to develop reasonable procedures to prevent fraud, which for many will include having an effective whistleblowing programme. Many corporates will continue to be proactive in developing whistleblowing provisions for the risk management benefits they bring. Others with less public oversight, or where their performance relies on questionable business practices – in areas such as procurement, environmental considerations and keeping labour costs down – may continue to lag. International companies have a complex set of legal and regulatory requirements to navigate, which mean this will continue to be an agenda item for audit committees and boards.

Zack: While this may seem counter to the preferred culture, I think we will likely see continued increases in the use of a diverse array of technology to create additional options for employees and third parties to report. We have already seen some shifting in reporting from telephone-based systems to web-based and email. Many organisations are also now offering certain elements of their compliance and ethics programmes via apps that employees can have on their mobile devices. Elements of programmes offered through these apps may include corporate policies and procedures, guidance on compliance issues, compliance training options, question and answer guidance, and hotlines. So, in addition to continued competition between internal and government reporting options, I think companies will increasingly utilise technology to provide better guidance and increased reporting options for employees.

Petrov: Whistleblower provisions are expected to continue evolving in the months and years to come, driven by a range of factors such as changing societal expectations, legal developments and advancements in technology. I believe that companies will continue to focus on fostering a ‘speak up’ culture where employees feel safe and encouraged to report concerns. This involves creating an environment that supports open communication, actively listening to employee feedback and addressing issues promptly. Continuous monitoring and listening mechanisms, such as employee engagement surveys and periodic assessments of the effectiveness of whistleblower programmes, may become more prevalent. In summary, companies will need to continue their focus on establishing a ‘continuous listening’ and ‘speak up’ culture, adapting to evolving legal requirements, leveraging technology and proactively addressing concerns related to retaliation. It is essential for organisations to stay up to date on regulatory developments and best practices to ensure their whistleblower provisions remain effective and aligned with evolving expectations.

Evangelista: I expect whistleblower provisions to evolve and become more fleshed out in the coming months and years. For example, FinCEN still needs to issue regulations to govern its whistleblower programme covering AML and sanctions violations. Most people expect FinCEN’s regulations to track the SEC’s regulations, although it will be important to see how compliance personnel are addressed in the regulations. The growing awareness and effectiveness of new and existing government whistleblower award programmes means that companies need to factor in the possibility of whistleblower reporting before, during and after major projects or initiatives are launched. A strong ‘continuous listening’ and ‘speak up’ culture anchored by a strong internal whistleblower programme will help companies manage the legal and reputational risks that stem from corporate misconduct.

Will Morris is a chartered accountant and a certified fraud examiner in Grant Thornton UK LLP’s forensic and investigation services team in London. He has over 15 years of experience of conducting financial audits and investigations, including into fraud, bribery, corruption and other forms of misconduct. He has supported organisations in the UK and internationally with the design of effective whistleblowing programmes. He can be contacted on +44 (0)20 7728 3481 or by email: will.morris@uk.gt.com.

Pavel Petrov is global head of the SpeakUp office at Novartis. The SpeakUp Office oversees the management of complaints concerning possible instances of misconduct within the company. These complaints may involve infringements of the code of ethics, relevant company policies, as well as local laws and regulations. Mr Petrov joined Novartis in 2005 and has progressively assumed positions of greater accountability within the finance, internal audit, and ethics, risk and compliance departments. He can be contacted on +41 (61) 529 2954 or by email: pavel.petrov@novartis.com.

Gerry Zack is chief executive of Society of Corporate Compliance and Ethics (SCCE) and Health Care Compliance Association (HCCA). He leads the global strategy and activities of SCCE & HCCA and its 18,500 members across 100 countries. He has more than 35 years of experience providing preventive, detective and investigative services involving fraud, corruption and compliance matters. He can be contacted on +1 (952) 567 6215 or by email: gerry.zack@corporatecompliance.org.

Alessio Evangelista advises global financial institutions and multinational corporations on compliance and enforcement matters involving anti-money laundering, economic sanctions, export controls, anti-bribery and corruption, and other corporate crimes. His clients range from international banks and investment management companies to multinational technology companies and industrial firms. He can be contacted on +1 (202) 371 7170 or by email: alessio.evangelista@skadden.com.

© Financier Worldwide

THE PANELLISTS

Will Morris

Grant Thornton

Pavel Petrov

Novartis

Gerry Zack

Society of Corporate Compliance and Ethics & Health Care Compliance Association

Alessio Evangelista

Skadden, Arps, Slate, Meagher & Flom LLP and Affiliates