by Joe H. Smith
Some would say whistleblowers are altruistic and compassionate individuals willing to sacrifice personally and professionally to expose behaviors and practices that are wasteful, fraudulent, or harmful. On the other hand, others would describe the whistleblower as merely disgruntled employees who are malicious and reckless in their leveling of allegations against those they perceive have wronged them. Whatever your perspective, to some extent, you’re right. There are whistleblowers who call attention to abuses of power and, regrettably, they often suffer retaliation; and others who are inaccurate, misinformed, or simply mean spirited that can disrupt work environments and destroy professional careers.
Viewing the whistleblower issue objectively, organizations really don’t have a choice. Due to potential negative consequences for both the individual and company, proactive measures are necessary. Failure to effectively respond to the whistleblower internally will inevitably result in increased instances of management shake-ups, criminal/regulatory investigations, and indictments/penalties. The following are suggested processes to enable a meaningful whistleblower program that will provide for communication channels to be established, instill a belief amongst employees that their concerns will be taken seriously, and reprisals will not be tolerated.
Establishing Reporting Channels
Mechanisms need to be established to educate the whistleblower on established reporting channels and means of follow-up. These channels may be the responsibility of a company employee or department, or an external party. Channels should afford communications originating inside and outside the organization. Regardless, reporting and follow-up procedures should follow a documented directive possessing certain key elements:
• Hotlines are recommended, inclusive of phone numbers, email addresses, website, pamphlets/promotional material, invoicing materials, business cards, and vendor portal. Anonymous communications accepted and pursued with equal vigor.
• Protection of confidentiality afforded both the reporting party and the person or practice being reported on. Likewise, unauthorized access should be restricted.
• Specification of a fixed period receipt of the report is acknowledged, and investigation initiated.
• Requires a diligent and impartial investigation, communication of the results to persons in authority, and when appropriate, feedback to the whistleblower about the final outcomes.
• The whistleblower is allowed to review, approve, and edit initial reports and subsequent interview notes. At the whistleblower’s discretion, reporting may be in writing, orally, or both.
• The party responsible for performing the follow-up inquiry should be provided clear authority to seek external assistance.
• Whistleblowers may be referred to the grievance procedures or afforded access to support measures, as warranted.
• Anyone attempting to hinder the investigation or knowingly provide false or misleading information is subject to disciplinary action.
• The following persons are covered by the whistleblower program:
– Current and former (part or full-time) employees, inclusive of job applicants/trainees/interns/volunteers
– Directors
– Temporary workers
– Fixed-term contractors/sub-contractors
– Self-employed persons
– Suppliers/vendors
Message
The goal of the program is to facilitate whistleblowers reporting breaches of the organization’s ethics and compliance culture. Accordingly, it is important for potential reporting parties to have access to the culture statement and obtain guidance on recognizing forbidden behaviors, in which all have an interest in detection. The following acts are suggested for discussion:
• Compromising the integrity of the financial reporting by interfering with the completeness, consistency, correctness, or accuracy of the financial data.
• Altering or falsifying financial service transactions offered for the benefit of patrons.
• Causing or allowing products or services to pose a health and safety risk to customers or employees.
• Causing harm to the environment.
• Jeopardizing confidential information of the organization or privacy of customer or employee personal data.
• Disregarding internal policies and procedures, with emphasis on the ethics and compliance culture, and rules governing interactions with the public.
• Failing to comply with applicable laws and regulations.
Retaliation and Reverse Burden of Proof
At the heart of an effective whistleblower program is protection of the whistleblower from retaliation. Failure to afford such protection is incredibly damaging not only to the program but also to the organization’s culture. Furthermore, protection should be afforded those who support a whistleblower. To better ensure efficacy of the directive, the concept of “reverse burden of proof” is suggested. Accordingly, organizations assume responsibility for proving that no retaliation has occurred, whether overt or subtle. However, before delving into measures to thwart retaliation, first examine the question of what a retaliatory action is:
• Suspension, lay-off, dismissal or equivalent measures.
• Demotion or withholding of promotion.
• Transfer of duties, change of work location, reduction in wages, or change in working hours.
• Withholding of training.
• Negative performance assessment or employment reference.
• Imposition of disciplinary measures, reprimand, or other penalty.
• Coercion, intimidation, harassment, or ostracism.
• Discrimination, disadvantageous or unfair treatment.
• Failure to convert a temporary employment contract into a permanent one.
• Failure to renew a temporary employment contract.
• Harm to a person’s reputation – social media, loss of business or income.
• Blacklisting based on an industry-wide agreement potentially impacting person’s ability to find employment.
• Early termination or cancellation of a contract for goods or services.
• Cancellation of a license or permit.
Proactive measures need to be established to prevent the above actions from occurring and be communicated to internal personnel and external third parties. Since the protection measures may be subjected to regulatory/judicial scrutiny, the organization needs to be able to demonstrate the sincerity of its efforts, which is not unrelated to the idea of “reverse burden of proof.” The organization presumes that, when a whistleblower suffers a detriment at work, it exists as a form of retaliation to their report. Proactive steps to consider include:
• Review the current anti-retaliation requirements to ensure the policy is comprehensive, up to date, and communicated to employees and third parties.
• Examine relevant documentation to confirm the board of directors support and monitor anti-retaliation directives.
• Evaluate the awareness campaign:
– Evaluate mechanisms employed to communicate the policy to employees, such as the curriculum, frequency, and means of obtaining clarification.
– Evaluate mechanisms employed to communicate the policy to third parties and whether they have a confidential point of contact.
– Confirm high-risk individuals and managers are afforded enhanced training to ensure they are aware of the anti-retaliation policy and consequences of noncompliance.
– Confirm those charged with identifying and implementing anti-retaliation strategies, inclusive of those interacting closely with the ethics and compliance initiative, received specialized training.
• Adopt analytical procedures whereby the risk of retaliation is identified based on a filed report. Communications are had with those who might be tempted to retaliate, and follow-up is made with the whistleblower.
• Periodically audit certain markers that might reflect on compliance. Consider retaliation markers such as pay raises, performance reviews, transfers, job reassignments, and relocations. Compare the markers to whistleblower reports filed during the period reviewed and make note of any outliers. This step recognizes certain retaliation characteristics and is designed to detect noncompliance. Data indicates 72% of retaliation occurs within 3 weeks of the initial report, 90% within 6 months, and the remainder occurring thereafter.
To highlight the most challenging aspect of implementing a whistleblower program, let’s accept the premise that the program demonstrates the commitment to developing a ‘speak up’ culture that values the employee. The tone is set at the top that illegal behavior and wrongdoing will not be tolerated; however, this does not mean the devious can take advantage of the program. Vexatious whistleblowers intentionally and knowingly reporting incorrect or unreasonable information of a malicious nature should not be afforded protection under the program. Case handlers must be careful to distinguish between employees raising genuine concerns from those simply being difficult. This can be achieved by being cognizant of a reporter who is aggrieved, frustrated, or has other reasons for their behavior. The evaluator must focus on the merits of the case rather than the attitude of the complainant. Factors to consider include:
• Issues have already been investigated by another and no new information is provided.
• Reporter seeks to prolong contact with the case handler by continually changing the substance of the compliant.
• Reporter raises additional concerns or questions whilst the compliant is being investigated.
• Reporter fails to clearly define the substance of the compliant or the issues warranting investigation.
• Reporter’s compliant is founded upon trivial matters.
• Reporter makes excessive contact with the case handler or seeks to impose unreasonable demands or expectations.
Obviously, vexatious and malicious complaints can be difficult to identify and often require considerable professional judgement. Each case should be considered on its merits, be evidence based and investigated. However, to preserve the integrity of the whistleblower program, using it to achieve vindictive motives must not be tolerated, and when discovered, disciplinary actions initiated.
To address the question of why whistleblower initiatives are of value, remember, it is required by the Anti-Money Laundering Act of 2020. However, aside from the regulatory imperative, the overshadowing reason is that a strong culture of internal reporting and whistleblower protection just makes good business sense. Put more succinctly, it is to the interest of the organization and its stakeholders to implement channels for the reporting of fraud, corruption, and misconduct.
Joe H. Smith, CPA, CFE, CFF, CGAP, is a Senior Consultant for REDW, LLC and Commissioner for the Picayune Rancheria of the Chukchansi Indians Tribal Gaming Commission. He can be reached by calling (503) 314-2009 or email [email protected].