Accommodating would-be whistleblowers: Sarbanes-Oxley's Section 301 requires companies to establish effective procedures for handling whistleblower complaints. Attorneys, consultants and others talk about just how companies can best do that.

Three years ago, during the time of the Enron scandals, Alice Peterson was the chair of the audit committee at Fleming Cos. (now known as San Francisco-based Core-Mark International). In an interview, she recounts a "can-it-happen-here?" conversation she had with the company's chief executive officer at a board meeting.

"I asked the CEO, 'If we had a whistleblower like [Enron's] Sherron Watkins at our company, would she be able to find me?'" Peterson recalls asking. "And he assured me that the company had an 800-number for complaints that was up and running, and that it rang on the desk of the head of human resources."

Peterson, a former chief financial officer at PepsiCo and other companies, says she was disappointed by that answer. "The company's management had allowed [itself] to believe that, some-how, this company was different and that employees would speak out without fear of retaliation," she says.

[ILLUSTRATION OMITTED]

"But there are very strong statistics that show that internal hotlines do not get used. Nervous employees are not going to trust an inside hotline. You need a trusted third party," she adds, to field employees' complaints.

Today, Peterson heads a consulting firm called Listen Up Group, which helps companies institute confidential reporting systems--such as Fleming adopted during her tenure on the board--and sharing many of the lessons she learned in Corporate America as well. "We thought it would be best to get ahead of problems before they become headlines," Peterson says.

Now, under The Sarbanes-Oxley Act's Section 301--which took effect in 2003--audit committees at all public companies are charged with establishing effective procedures for handling whistleblowers' concerns. As Peterson notes, the law calls for a mechanism that collects, retains and manages accounting-related complaints.

In addition, all public companies must do what Peterson insisted upon at Fleming: ensure that whistleblowers are able to report financial and accounting irregularities without fear that they will suffer demotion, harassment, threats or any other form of retribution. Under the law, the Occupational Safety and Health Administration (OSHA), a division of the U.S. Department of Labor, hears and adjudicates charges of retaliation.

To comply with the whistleblower statute, most experts recommend that the company make it convenient for employees to report suspected incidents of misconduct. That entails establishing a dedicated hotline, with a toll-free number, as well as the capacity to accept collect calls where necessary. Moreover, whistleblowers should have access to a confidential Web site (but not an e-mail address, since e-mail is notoriously non-protective of anonymity), a fax number and a regular mail address or post office box.

There's certainly a cost to all that, and like much of Sarbanes-Oxley, the whistleblower provisions are seen by many companies as yet another link in a chain of too much regulation. But while there are naturally growing pains in adapting to Sarbanes-Oxley's whistleblowing provisions, particularly for smaller companies, the best strategy is to embrace the law, says Christopher Janis, a CPA and managing director at Accume Partners, a consulting firm in Moorestown, N.J. "It's been two-and-a-half years since the law went into effect," he says, "so companies should be beyond the denial-and-anger stage. They should just be doing it. The days of taking the easy way out are over."

Cathy Fleming, an attorney who heads the corporate integrity and white-collar crime group at the New York office of Edwards & Angell, argues that a change in attitude toward whistleblowers would actually benefit companies. "If you're the captain of a ship, you want to know whether there's a problem in the engine room," she says.

And there are plenty of problems rattling around in corporate engine rooms. According to the Corporate Executive Board, in 2003 the total losses from occupational fraud at Fortune 500 companies amounted to $420 billion. The CEB also reports that the typical organization loses 6 percent of its annual revenue to occupational fraud.

The Association of Certified Fraud Examiners (ACFE) in Austin, Texas, reports in 2004 that "tips" accounted for 40 percent of detected fraud, making them the No. 1 source of fraud detection, notes Toby Bishop, the organization's president and CEO. After all, in the scandals involving Enron Corp. and WorldCom Inc., tips from whistleblowers played a key role in uncovering massive financial fraud.

Bishop thinks that if there were better protection for employees reporting fraud and other forms of corporate skullduggery, the number of employee tip-offs would be higher still. "Companies should honor whistleblowers as corporate sentinels and not punish them as troublemakers," he says.

Issues Go Beyond Fraud

Companies that recognize the value of the whistleblower, meanwhile, are protecting themselves against more than just financial and accounting fraud, asserts Keith Halasy, director of marketing at EthicsPoint, a Portland, Ore.-based company that supplies a panoply of whistleblowing services to some 600 clients, including numerous Fortune 500 companies.

"Sarbanes-Oxley focused on financial issues that have a material impact on shareholders," Halasy says. "But it has also resulted in increasing civil and criminal penalties for organizations that retaliate against employees blowing the whistle in other areas--such as sexual harassment, discrimination, environmental problems, drug abuse and information technology abuse. The law has had a great splash-over effect."

At EthicsPoint, Halasy reports that about 50 percent of the contacts are by telephone, with the remaining contacts scattered among other modes of communication. One feature that EthicsPoint offers--and one which ACFE's Bishop asserts is especially vital--is that a live person be on duty to answer the telephone around the clock. "Many companies have instituted hotlines that only have voice mail outside business hours," he says. "Yet a large proportion of calls are made on nights and weekends. That makes sense, since most workers won't call until after business hours, when their conversations can be overheard."

An actual person staffing the telephone, moreover, is able to ask follow-up questions. A voice-mail system, Bishop says, is more likely to produce information that is spotty and incomplete. At EthicsPoint, which boasts clients with operations in 25 different countries, the telephone operators are not only capable of fielding calls worldwide but can do so in several different languages.

Once the information is collected, best practices mandate that it be evaluated by an impartial party, in part to make sure that frivolous or irrelevant concerns are not forwarded to the audit committee. Richard Parrino, an attorney at Hogan & Hartson in Washington, D.C., advises against having the CFO or corporate comptroller be in charge of overseeing whistleblower complaints. "This raises the issue of 'the most-interested party,'" he says.

Fleming, the attorney at Edwards & Angell, believes that a general counsel's office is the best place for a whistleblower's information to be evaluated and acted upon. "I like counsel because of the lawyer-client privilege," she says. "And when somebody is seeking legal advice, investigations don't become publicly disclosed. So when you talk about a safe haven for whistleblower, counsels are generally better attuned to those issues."

But there is a danger that senior management, including the general counsel, can "hijack" information, says Parrino, who regards the general counsel's office as "the least bad alternative." ACFE's Bishop tells why. "I came across a case where a tip of wrongdoing by the CEO was filtered out by the general counsel and kept from the audit committee," he says.

Recently, Steven Cutler, the chief of enforcement at the Securities and Exchange Commission (SEC), has urged that companies set up an office of ombudsman to handle the complaints and report directly to the board of directors. In some recent settlements, such as the one involving mutual fund company Massachusetts Financial Services, the SEC has imposed hefty fines and insisted that firms retain an ombudsman. Tyco International, on the other hand, voluntarily established just such a system some time ago (see "Restructuring Tyco," June 2004).

[ILLUSTRATION OMITTED]

At Sempra Energy in San Diego, which prides itself on its comprehensive corporate governance program, a chief compliance officer oversees not just whistleblowing complaints but the broad training program that includes everything from recognizing antitrust violations to familiarization with the Foreign Corrupt Practices Act. Experts on corporate governance say that ongoing training programs are a crucial component to developing an ethical corporate culture.

"We don't really use the term 'whistleblowing,'" says Randall Peterson, Sempra's chief compliance officer, the first person to fill the newly formed position. "That has an us-versus-them connotation. We really try to ingrain as part of our values the fact that we welcome diversity of thought and treat questions of ethics seriously."

Ethics 'Helpline'

Rather than a "hotline," Sempra has instituted an "ethics helpline" using a company called The Network, says Peterson (who is no relation to Alice). "It's not just a place to report wrongdoing, but to get questions answered," he says. "We encourage employees to ask questions on how situations should be handled. If all else fails--if you don't feel comfortable with answers from your supervisor or the chief ethics officer--then you can talk to a live operator."

After a complaint is filed, Peterson says, it is assigned a case number and reported to his office, which investigates. "We find that most complaints--about three-quarters--are personnel matters," he says. "But it may involve a matter of law, security or the internal audit department. We provide a report back to the network on whether the issue is resolved. If the person is satisfied, that's the end of it."

But where the issue "has financial statement or accounting implications," Peterson says, "then it is actually reported to the audit committee and the board of directors. Periodically, they get a summary report and are briefed on the issue and the status. But I'm not aware that we've had any issue that has involved broad financial fraud or criminal proceedings."

For companies like Sempra that have a comprehensive training program in ethics, the whistleblower hotline can serve as an important tool "for improving organizational behavior and performance," says Halasy. EthicsPoint customers are able to get reports "that show where they may have an issue with ongoing theft," he adds. "You start to get hints and insights over time where you might need to have more training, as well as potential investigations into fraud."

Whistleblower protection got a recent huge boost last November after OSHA, which hears cases alleging retaliation, found in favor of David Windhauser, who was fired after he had raised questions about the internal accounting procedures at Trane Corp., a Piscataway N.J.-based subsidiary of American Standard Cos. Trane was ordered to reinstate Windhauser to his former position as corporate controller, reimburse him for back pay and remedies totaling $105,489.55, and remove any disciplinary letters from his personnel file.

"This is precisely the type of whistleblowing activity that is protected under the law," declared Patricia Clark, OSHA's regional administrator in New York.

Perhaps the most dramatic consequence of Sarbanes-Oxley's whistleblower requirements falls on attorneys who are required to make "up-the-ladder reporting" as detailed in Section 307. Parrino notes that this requirement--which requires notification of the audit committee if there is evidence of a company official violating fiduciary duties--was a compromise after Congress rejected a "noisy withdrawal" clause. That would have required an attorney to notify the SEC and assume a "gatekeeper role" that, Parrino notes, was unacceptable to the securities bar.

In January, U.S. regulators filed fraud charges against Mexico media tycoon Ricardo Salinas Pliego, seeking disgorgement of $110 million reaped in a complex insider debt deal after engaging in what the SEC called an "elaborate scheme" to cover it up. The transactions came to light, The New York Times reported, after a New York lawyer--citing Sarbanes-Oxley--blew the whistle to TV Azteca's board and threatened to tell the SEC. After the Times reported the lawyer's departure, two U.S. directors at the company commissioned an investigation. The SEC was able to take action because TV Azteca's depository shares are listed on the New York Stock Exchange.

"Under Sarbanes-Oxley, ignoring whistleblower complaints or retaliating against them has gotten a whole lot more expensive," says Alexandra Lajoux, chief knowledge officer at the National Association of Corporate Directors. "The fact that you might get sued under the law, or that the government might sue you, will keep a director up at night."

Paul Sweeney is a freelance business writer based in Austin, Texas, and frequent contributor to Financial Executive. He can be reached at 512.499.8749.