Two recent awards by the SEC are noteworthy reminders that it continues to vigorously implement its whistleblower bounty program and that companies must be vigilant when dealing with internal complaints.

A whistleblower refresher…

The Dodd-Frank Act created the whistleblower bounty program by adding Section 21F to the Securities Exchange Act of 1934. The SEC is now authorized to pay awards to persons who voluntarily provide original information about securities violations that lead to a successful SEC enforcement action resulting in monetary sanctions of more than $1 million. Awards may range from 10% and 30% of the amount recovered, with the actually percentage determined in the SEC’s discretion.

First ever award to a compliance employee…

A few weeks ago the SEC awarded more than $300,000 to an employee who performed internal audit and compliance duties for the company in question. This is noteworthy because internal audit and compliance employees are generally excluded from the SEC’s whistleblower program under the theory that they are not typically sources of “original information.” However, the rules also say that if

• at least 120 days have elapsed since such an employee provided information regarding a possible violation to the company’s audit committee, chief legal officer, chief compliance officer or a supervisor,
• the company has not taken “appropriate timely action,” and
• the SEC has not otherwise already received the information,

then that employee may report the information to the SEC and participate in the whistleblower program. The 120-day delay is intended to give a lower level employee who may be the actual source of original information time to report the misconduct to the SEC and be first-in-line for a whistleblower award.

New record award amount…

More recently, the SEC announced its highest whistleblower award so far—between $30 million and $35 million, easily surpassing the previous record of $14 million.

Takeaways…

These awards indicate that the SEC continues to take the program seriously, devoting significant agency resources and granting substantial monetary awards to encourage personnel to report misconduct information. On the other hand, the program has not become the disaster many companies feared when it was first enacted—the number of frivolous claims has been relatively small and employees almost always make an effort to report wrongdoing internally before taking their concerns to the SEC.

Even so, companies should keep the following in mind:

• Educate employees, including internal audit and compliance personnel, about the company’s commitment to a culture of compliance (see this Doug’s Note), the existence of the company’s internal reporting process and the benefits of internal, rather than SEC, reporting.
• Take all reports of wrongdoing seriously. Be sure that any investigations are properly designed to fit the circumstances. Involve lawyers (whether in house, outside, or both) early in the process to protect the attorney-client privilege and to assist with the necessary issue analysis. Properly document the reasons for closing or resolving an internal investigation. (See Protecting Internal Investigations from Disclosure: Suggested Best Practices.)
• Act in a “timely manner,” which generally means within 120 days at the latest.
• Communicate with the potential whistleblower throughout the process so that he or she will know the complaint is being taken seriously.
• Be aware of, and sensitive to, foreign laws or customs that may impact internal communications and investigations regarding possible wrongdoing.
• Be extremely alert to any behavior that could be seen as improper retaliation against the potential whistleblower.
• Remember that confidentiality provisions or other contractual limitations cannot be used to prevent someone from reporting to the SEC.