Whistleblowers create huge potential liability. Under provision of the Dodd-Frank Act, the SEC has awarded $14 million and $30 million to whistleblowers providing information that led to an SEC enforcement action.   Meanwhile, a California plaintiff received a multi-million dollar jury verdict under Sarbanes-Oxley (“SOX”) for retaliation after refusing the CFO’s demands to set aside executive bonuses that had not been approved by the board of directors.

SOX safeguards whistleblowers with protection for employees of publicly traded companies who are discharged, demoted, suspended, threatened, harassed or discriminated against for providing information regarding conduct the employee reasonably believes is a violation of federal fraud statutes, SEC rules and regulations, or any federal laws relating to fraud against shareholders. 18 U.S.C. § 1514A(a)(1). Last year in Lawson v. FRM LLC, the Supreme Court expanded this to protect employees of private contractors and subcontractors who work for a public company.

SOX also creates procedural reporting requirements for public companies. Section 301 requires the audit committees of companies to establish procedures for 1) the receipt, retention, and treatment of complaints about accounting or auditing matters; and 2) the confidential, anonymous submission by employees of concerns regarding questionable accounting or auditing matters. The natural solution to Section 301 is a whistleblower hotline. But, today, such internal hotlines compete against Dodd-Frank’s bounty system that awards 10-30% commission to individuals providing information to the SEC that leads to enforcement action.

Internal reporting is advantageous to companies for a few reasons. First, it enables involvement before the government or media. This allows a company to investigate and either remediate or prepare a response to subsequent inquiries. Second, many employees (potentially as high as 96 percent) only resort to government reporting after internal whistleblowing has failed to provide a satisfactory response; a good internal system can ensure that employees don’t feel abandoned by their employer. Finally, internal reporting functions to create a strong ethical company culture as well as to control risk exposure.

In the battle for internal versus external whistleblowing, the key question to employees is “Who ya gonna call?” With that in mind, the following is a list of recommended best practices to receive and retain internal whistleblower reports.

• Effectively communicate the reporting system. Companies cannot be effective by limiting communication to the conventional modes: the company website, code of ethics handbook, internal training materials, and presentations. There must also be regular communication encouraging reporting; stressing the ability for employees to make a complaint confidentially; and explaining where to report. Then stress test your system: can kids on Bring Your Daughter To Work Day figure out how to report a problem in less than 5 minutes? With an effective system, a simple search of a company’s intranet should lead directly to the reporting system—employees should know exactly where and how to report without feeling like the company is hiding the system.
• Properly staff and manage the report center. The reporting center should be accessible 24 hours a day, 7 days a week, 365 days a year as well as offer multiple reporting options (g., internet, telephone, email, etc). Further, the intake interviewers should be sophisticated investigators as well as smooth counselors to address a whistleblower’s concerns and frustrations. Interviewers should be veterans with HR, compliance, or law department experience; intake personnel should have training in personal crisis management as well as an understanding of the potential areas of whistleblowing.
• Competently dispatch and supervise investigative assignments. It is important to have a system in place that distributes investigations based on such factors as violation type, seriousness of the misconduct, business sector, and office location. Targeted assignment will match an investigator with financial expertise to a claim of accounting fraud but an HR investigator to claims of pay disparities. There also need to be protocols in place for investigations that implicate those running this function: g., compliance officers are overrepresented in the world of whistleblowers so there must be a protocol for someone other than the head of compliance to assign the investigator and manage the outcome.
• Update the whistleblower. A crucial — and often over-looked — aspect of internal whistleblowing occurs after the first report. A company’s reporting system should ensure follow-up with the whistleblower: “thank you for your report; an investigator has been assigned; her name is …. and she will reach out to you; meanwhile, we will update you in X weeks on the status of this investigation.” These measures will help make sure the whistleblower trusts the company’s investigation and does not feel impelled to resort to external reporting for lack of response.