corporate whistleblowing: investigating claims of …...corporate whistleblowing: investigating...

Corporate Whistleblowing: Investigating Claims of

Financial Fraud and Abuse and Reports of White-

Collar CrimeCorporate Risk, Ethics and Compliance Forum

September 26

REUTERS / Firstname Lastname

Sensitivity: Confidential2 Edit presentation title on Slide Master using Insert > Header & Footer

SEC WHISTLEBLOWER PROGRAM

• Created Under Dodd-Frank in the aftermath of the financial crisis

• Intended to incentivize individuals aware of potential wrongdoing

to come forward to prevent fraud or stop before it gets worse

• Three essential elements

• Confidentiality

• Financial incentives

• Anti-Retaliation Protections

Sensitivity: Confidential

SEC WHITLEBLOWER PROGRAM

Confidentiality

SEC may not directly or indirectly identify a WB to anyone outside

of the SEC without Commission approval

Financial Awards

SEC can pay WB who voluntarily provide original information to

the SEC that leads to a successful action with monetary

sanctions ordered exceeding $1M

Anti-Retaliation

Enhanced anti-retaliation protections, including extended statute

of limitations, right to bring private action and enhanced remedies

3 Edit presentation title on Slide Master using Insert > Header & Footer


SEC WHISTLEBLOWER PROGAM

Results

• Over 23,000 tips received through FY 2018 (5282 in 2018)

• Tips received from all 50 states plus 119 foreign countries

• $387M paid to 66 WBs

• More $ ($168M) paid to WBs in FY 2018 than in entire program

history

• $59.8M in awards in 2019 so far

• $1.7B in sanctions ordered, including $901M in disgorgement

• 3 Anti-retaliaton Enforcement actions

• 9 Rule 21F-17(a) actions regarding “pre-taliation”



SEC WHISTLEBLOWER PROGRAM

DIGITAL REALTY CASE

• Issue Presented: Is a WB who “only” reports internally entitled

to enhanced AR protections under Dodd- Frank?

• S CT (unanimous opinion); A WB must report wrongdoing to

the SEC to be avail him/herself of enhanced D-F protections

• SEC reported a spike in WB submissions post-decision

• Your employees will face increased pressure to report to SEC



SEC Rules Incentivize Internal Reporting

SEC Criteria for Determining WB Awards

• Exchange Act Rule 21F-6 (17 C.F.R. § 240.21F-6)

• (a)(4) – Plus factor to engage with company’s internal compliance system

• SEC will consider, among other factors, whether WB

• Reported internally before or at same time as report to SEC

• Assisted in internal investigation

• (b)(3) – Negative factor to undermine internal compliance system

• SEC will not hold it against a WB who declines to engage with company

• But for those WBs who do engage, SEC will consider whether WB

• Tried to interfere with process or delay detection of securities violation

• Provided false or misleading statements or documents



Enforcement Actions Prompted by SEC Whistleblowers

JPMorgan Chase & Co.

• March 2019, SEC announces $50m award to two whistleblowers

• Tips led to JPM’s $307m settlement with SEC and CFTC in Dec. 2015 for failure to disclose conflicts of interest to investors

• Whistleblower 1

• A JPM executive who submitted tip, met with SEC one time

• $13m award

• Whistleblower 2

• Submitted tip, met with SEC four times, provided “smoking gun” docs

• $37m award (third highest ever)



Enforcement Actions Prompted by SEC Whistleblowers

Zimmer Biomet

• May 2019, SEC announces $4.5m award to one whistleblower

• Tips led to Zimmer Biomet’s $30m settlement with the SEC and DOJ in

Jan. 2017 for FCPA violations related to medical kickbacks in Brazil

• Whistleblower

• Brazilian doctor who first submitted anonymous tip to company, then

notified SEC

• SEC never met with doctor, but company self-reported the tip

• First award for tip that prompted self-report



Rise in Fraud


Whistleblower Hotline # 1 Anti-Fraud Tool

2018 Report to the Nations - Associaton of Certified Fraud Examiners


DOJ 2019 Guidance – Whistleblower Reporting, Protection, and Incentives

The DOJ issued updated “Evaluation of Corporate Compliance Programs,” which includes several sections related to

whistleblowers, including the following.

Confidential Reporting Structure and Investigation Process – Program must have trusted mechanism by which

employees can anonymously or confidentially report allegations. DOJ questions include:

• Does the company’s complaint-handling process include pro-active measures to create a workplace atmosphere without fear

of retaliation, appropriate processes for the submission of complaints, and processes to protect whistleblower?

• Does the company have an anonymous reporting mechanism, and, if not, why not?

• How is the reporting mechanism publicized to the company’s employees? Has it been used?

• Has the compliance function had full access to reporting and investigative information?

Incentives – Program must have trusted mechanism by which employees can anonymously or confidentially report

allegations. DOJ questions include:

• How does the company incentivize compliance and ethical behavior?

• Have there been specific examples of actions taken (e.g., promotions or awards denied) as a result of compliance and ethics

considerations?

• Who determines the compensation, including bonuses, as well as discipline and promotion of compliance personnel



How to Encourage Employee Reports

• Promote Speak Up Culture

• Executive “Tone from the Top”

• Manager Training regarding how to handle concerns and policy against retaliation

• Employee Training

• Other Internal Communications

• Company Policy against retaliation

• Periodic Code of Conduct reminders

• Posters/Wallet Cards

• Company’s Home Intranet Page

• Provide many avenues to raise concerns

• Call

• Web

• Email

• Open Door

• App


DOJ 2019 Guidance – Investigations

Adds a new section for investigations of misconduct. Direct emphasis is placed on “a well-functioning and appropriately funded

mechanism for the timely and through investigations of allegation of suspicions of misconduct” In line with the theme of iterative

risk management, compliance programs are expected to use investigation results to improve their program’s risk posture.

Investigations of misconduct – Investigations must be properly scoped, conducted by proper personnel, appropriately

documented and sufficiently resourced. DOJ questions include:

• How does the company determine which complaints or red flags merit further investigation?

• Does the company have a process for monitoring the outcome of investigations and ensuring accountability for the response to

any findings or recommendations?

Consistent Discipline Process – The guidance extends emphasis on the human resource process to ensure consistent

discipline. DOJ questions include:

• Is the same process followed for each instance of misconduct, and if not, why not?

• Are the actual reasons for discipline communicated to employees? If not, why not?

Tracking of results - Prosecutors ask whether companies analyze reports and findings for patterns of misconduct or

red flags for compliance weaknesses. DOJ questions include:

• How has the company collected, tracked, analyzed, and used information from its reporting mechanisms?

• Does the company periodically analyze the report or investigation findings for patterns of misconduct or other red flags for

compliance weaknesses?



Composition of Investigation Team

• Investigators

• Unbiased, trained in conducting investigations - keep any alleged wrongdoers out of the loop

• Analytical/Audit experience

• Trained investigators may include (depending on nature of claim):

• Legal, Compliance, Compliance Monitoring, Internal Audit, HR, Security

• May involve internal or external experts such as forensic accountants or computer forensic experts.

• Consider Third Party (such as external counsel) if:

• Allegations involve executive management

• Very serious/financial significance

• Litigation is anticipated

• Ensure Independent Oversight by Legal and Compliance


Identify level 1 files

& limited metadata

Collected Data

Inventory Discover Publish

Identify all files

Extract all

metadata

Extract all text

Apply numbering

Move documents into

Relativity

ECA

Run an Early Case Assessment workflow to kickstart your investigation


Technology is an enabler

• Run a defensible and audited

process

• Create templates for

repeatable workflows

• Leverage machine learning

analytics to identify the key

facts quickly and efficiently


Remediation

• Review transaction to identify how the violation occurred

• Implement internal control or process changes to mitigate

• Determine if policies require modification or new policy is required

• Conduct internal control review by Internal Audit or External Auditor

• Identify root cause and evaluate whether incident is systematic or wide-

spread

• Conduct Culture Survey

• Assess fear of relation, whistleblower hotline awareness, integrity of

management, etc.


Considerations for Whether to Self-Report to Government

• Likelihood that government learns of allegations and investigates

• Potential leniency – declination, DPA / NPA, lower penalty

• Potential piling-on by domestic and foreign regulators

• Increase in scope and cost of investigation and remediation

• Business disruption

• Shareholder litigation


corporate whistleblowing: investigating claims of …...corporate whistleblowing: investigating...

Documents