If knowledge is power, Whistle blowing is, potentially, a shot in the arm for any corporate body. The extensive new FCA measures concerning Whistleblowers, which came into force on 7 September 2016, provide a good opportunity for reflection on this sensitive topic.
Arguably, the increasing scrutiny faced by companies in today’s climate (together with the associated risk of prosecution) makes managed reporting of suspected wrongdoing and disclosure of information within an organisation increasingly more desirable. ‘Internal Whistle blowing’ can have great benefits for corporate bodies and may help them to navigate the growing minefield of corporate liability.
A poor or non-existent Whistle blowing policy can have disastrous consequences.For example, when the Whistle is blown externally via the media, such an outcome could have been avoided.
Whilst the perception of Whistle blowers in the corporate world is often negative, such views are usually based on the actions of what are sometimes called ‘External Whistle blowers’ (those disclosing information to prosecutors, regulators or the media). By contrast, ‘internal’ Whistle blowers (individual employees who report wrongdoing to their employer) are less talked about, but may be far more valuable.
What the Law says
Many countries now offer legislative protection for Whistle blowers. In the UK such protection is provided by the Public Interest Disclosure Act 1998 (‘PIDA’). The Act is a purely civil law statute and offers protection from dismissal as the result of a qualifying disclosure of various kinds of wrongdoing, including the commission of a criminal offence. The legislation applies to both internal and external Whistle blowing.
What PIDA does not do is offer any immunity from prosecution to the disclosing employee. This situation may discourage external Whistle blowing, especially if the employee has taken legal advice. Yet, the threat of prosecution may also make internal reporting of fraud and other malpractice more attractive to a potential discloser. From this point of view, PIDA makes the UK an ideal jurisdiction for the implementation of rigorous internal Whistle blowing policies. Indeed, those with the most knowledge about wrongdoing are usually those involved, and thus those most at risk of prosecution.
An EU dimension to the legislative framework surrounding Whistle blowing had just come into view when the June referendum struck. Whilst they may eventually become academic for the UK, for now the EU proposals make interesting reading.
In late 2015, the EU published proposals for a new system of reporting market abuse offences to European regulators. They provide, among other things, that internal procedures for EU regulators make provision for Whistle blowing and make clear that the intention is that reporting should be anonymous (see more on the latter below).
Even Brexit will not prevent greater official interest in a firm’s Whistle blowing procedures. On 7 March 2015 the FCA introduced rules requiring regulated firms to appoint a ‘Whistle blowers’ Champion’ to take responsibility for, among other things:
‘ensuring and overseeing the integrity, independence and effectiveness of the firm’s policies and procedures on Whistle blowing’
In addition, on 7 September 2016, further FCA measures introduced:
‘Requirements on firms in relation to the adoption, and communication to UK-based employees, of appropriate internal procedures for handling reportable concerns made by Whistle blowers as part of an effective risk management system’
These requirements are far reaching (covering areas such as the formulation of the policy, communication with Whistle blowers, record keeping and training) and will have to be implemented with considerable care. Yet, the FCA (sensibly) leaves much of the detail to the individual firm. For example, firms are to establish ‘appropriate and effective arrangements’ and how to manage conflicts of interest is left very much in the corporate’s hands.
What can the company gain?
Internal Whistle blowing has major advantages in addition to the prevention of further (or any) financial loss to a corporate. First, it gives the senior management greater control over a situation which might well otherwise have had explosive consequences. The corporate body can decide whether or not to self-report the uncovered wrongdoing to the authorities and more effectively control the flow of information to them. One of the lessons of the recent SFO Standard Bank and XYZ cases is that early self-reporting can pay significant dividends in the context of a Deferred Prosecution Agreement.
Second, Whistle blowing can enable a corporate body to manage, or even avoid,damaging public scrutiny. Assuming there is no legal duty to disclose the suspected fraud, the employees responsible can be dismissed and the activity remedied or prevented. If disclosure to the authorities is inevitable or deemed appropriate, at least the corporate body will not be taken by surprise and can begin preparing for the impending attentions of media organisations and authorities.
Whistle blowing v. Disciplinary Proceedings
Of course, all large corporates invest significant time and resources in creating compliance and disciplinary systems to prevent employees defrauding their employers. Such measures are however,imperfect and expensive. Even the most vigilant compliance department cannot watch every transaction and the more stringent a policy the greater its potential adverse impact on the corporate’s trade.
Inevitably, a single director or senior manager will know less about the minutiae of their corporate’s dealings than the workforce collectively. Of course they will know more about the overall strategy and be privy to much confidential information other workers are not, but the devil is very often in the detail. And the devil is fraud.
Whilst fraud is inherently difficult to estimate, it is undoubtedly extremely costly. Private sector fraud losses in the UK are estimated at over £144bn annually. Procurement fraud (often associated with malfeasance by employees) is believed to cost £127bn per annum. Worse, there is some suggestion that fraud is on the rise. Much of this activity could, in theory, have been reported by Whistle blowers and stopped at an early stage.
Honest employees working (literally) alongside fraudsters are very often best placed to notice and report the kind of wrongdoing. The question for the corporate is how to ensure both that employees make disclosures and that those disclosures are managed effectively.
The International Chamber of Commerce guidance on Whistle blowing includes examination of two questions that any corporate will need to consider when determining its Whistle blowing policy.
First is the question of anonymity. Should the Whistle blower be able to make their accusations without their name being revealed?Technically, it would be possible to have a completely anonymous system of reporting, such that even the receivers of the information were unaware of the identity of the Whistle blower. This is, perhaps, an extreme example but by no means an implausible one.
Firms will obviously want to avoid the use of a policy as a vehicle for untraceable bullying or undermining of employees. Equally, anonymity may make information harder to use, clarify or convert into evidence in court. Anonymity is, however, a key incentive for those who wish to come forward and may encourage frank and accurate disclosure.
For those firms operating in both the US and the EU, the anonymity of a Whistle blowing scheme can create serious issues. The restrictions of EU Directive 95/46/EC (which restricts the gathering and retention of data) can conflict with the requirement that entities listed on the US stock markets and their affiliates store data relating to Whistle blowing (as per the Sarbanes-Oxley Act 2002). A subsidiary of McDonalds has already become a casualty of this conflict and corporates will need to address the issue with care.
The second question is that of compulsion. Should employees be forced to use the Whistle blowing policy in preference to other (perhaps more informal) channels? The advantages of compulsion is clarity and a reinforcement of the importance of the policy. On the other hand, compulsion can lead to abuse and even discourage some potential informants from coming forward.
Each corporate will of course want to create a Whistle blowing policy which meets its own needs. Any policy will obviously need to be work able in all the jurisdictions in which the entity operates.
What is certain is that official intervention in the area of internal reporting of regulatory misconduct or crime (as exemplified by the new FCA measures) is here to stay, whatever impact the Brexit vote will have on the force of EU law in the UK. Internal reporting can have real benefits for corporates if implemented and used effectively,and those who swim with the tide are likely to gain significantly in the long term.
This article was originally published in Global Banking & Finance Review, and can be found here.