The enactment of the Sarbanes-Oxley Act of 2002 led to significant changes in corporate governance and financial reporting policies at public companies. While the enactment of the Dodd-Frank Wall Street Reform and Consumer Protection Act in 2010 expanded the breadth of the Sarbanes-Oxley Act to cover employees of private subsidiaries and affiliates of publicly traded companies whose financial information was included in the public company's consolidated financial statements, those private companies that did not come within the scope of Dodd-Frank believed they were beyond the coverage of the Acts. The U.S. Supreme Court has now held that private companies are not spared from the whistleblower provisions of Sarbanes-Oxley. On the heels of this decision, the Securities and Exchange Commission cautioned companies against incentivizing employees to keep complaints internal and not report complaints to external agencies.   

U.S. Supreme Court Developments

On March 4, 2014, the U.S. Supreme Court held in a 6-3 decision that Sarbanes-Oxley "extends whistleblower protection to employees of privately held contractors who perform work for public companies."  Lawson v. FMR LLC, No. 12-3, 571 U.S. ____ (2014).

In Lawson, two former employees of different privately held companies involved in the business of mutual fund investments claimed that their employers retaliated against them for having raised certain concerns about the mutual funds. The defendant companies sought to have the employees' lawsuits dismissed, arguing that as employees of privately held companies, the plaintiffs were not covered by the Sarbanes-Oxley whistleblower provision.

This statute provides, in relevant part:

No [public] company . . . , or any officer, employee, contractor, subcontractor, or agent of such company, may discharge, demote, suspend, threaten, harass, or in any other manner discriminate against an employee in the terms and conditions of employment because of [whistleblowing or other protected activity].  18 U.S.C. § 1514A.

Prior to Lawson, other federal district courts had found that employees of private companies, including subsidiaries of public companies, were not covered by this whistleblower provision. No court of appeals had considered the issue prior to Lawson.

The district court in Lawson noted that the legislative history of Sarbanes Oxley "makes clear that Congress was concerned about the related entities of a public company becoming involved in performing or disguising fraudulent activity, and wanted to protect employees of such entities who attempt to report such activity." Based on this, and its reading of the statutory text, the district court found that the whistleblower provision protects employees of any related entity of a public company, including the plaintiffs in the Lawson case. On appeal, a divided panel of the U.S. Court of Appeals for the First Circuit held that the protection of the Sarbanes-Oxley whistleblower provision was limited to employees of publicly traded companies, noting that the broader reading of the statute adopted by the lower court "would provide an impermissible end run around Congress's choice to limit whistleblower protection in that subsection to the employees of two categories of companies the title and caption call ‘publicly traded companies.'" 

The Supreme Court disagreed with the appellate court, holding that the Sarbanes-Oxley whistleblower provision applied to employees of privately held contractors who perform work for public companies. Although the plurality opinion authored by Justice Ginsburg first analyzed the text of the statute, the Court's decision seemed largely driven by the reasons that led Congress to enact Sarbanes-Oxley, which the Court explained was "[t]o safeguard investors in public companies and restore trust in the financial markets following the collapse of Enron Corporation … [g]iven Congress' concern about contractor conduct of the kind that contributed to Enron's collapse, we regard with suspicion construction of [the whistleblower provision] to protect whistleblowers only when they are employed by a public company, and not when they work for the public company's contractor." While it appeared significant to the Court that subject companies were mutual funds which like "[v]irtually all mutual funds are structured so that they have no employees of their own," the Court nonetheless broadly concluded that the Sarbanes-Oxley whistleblower provision "shelters employees of private contractors and subcontractors, just as it shelters employees of the public company served by the contractors and subcontractors."

Concerns Over "Stunning Reach" of Supreme Court's Interpretation

The Supreme Court's decision in Lawson is expected to lead to a sharp rise in the number and type of whistleblower claims brought under this provision of Sarbanes-Oxley.  As Justice Sotomayor explained in her dissent, the Court's interpretation gives the whistleblower provision "stunning reach" by expanding its protection to "any household employee of the millions of people who work for a public company and any employee of the hundreds of thousands of private businesses that contract to perform work for a public company." The Court's interpretation, Justice Sotomayor explained, would permit "a babysitter to bring a federal case against his employer—a parent who happens to work at the local Walmart (a public company)—if the parent stops employing the babysitter after he expresses concern that the parent's teenage son may have participated in an Internet purchase fraud." Justice Sotomayor found nothing in the text, context or purpose of Sarbanes-Oxley to suggest that Congress wanted "to create this kind of sweeping regime that subject a multitude of individuals and private businesses to litigation over fraud reports that have no connection to, or impact on, the interests of public company shareholders."

Analysis and Implications of Lawson Decision

The Lawson decision makes clear that private companies can no longer ignore the compliance programs and policies that public companies have implemented as a result of Sarbanes-Oxley. Any private company that contracts with a public company should take proactive steps to decrease the likelihood of Sarbanes-Oxley whistleblower lawsuits.

First, private companies that contract with public companies may consider instituting internal compliance programs and employee hotlines that employees can use to report suspected violations of the federal securities laws. These types of programs, which many public companies have adopted in response to Sarbanes-Oxley, should allow for the reporting of suspected fraud by the company or its officials as well as by the public company client and its officials. Such private companies may also implement plans to investigate any issues raised to ensure a prompt and appropriate response.

Second, private companies that contract with public company clients may consider implementing broader internal compliance programs which are not limited to reports of suspected violations of federal securities laws. The Supreme Court expressly declined to limit the protected whistleblowing related to securities fraud or the work for which a private company contracts to perform for the public company client. As a result, an employee or former employee may bring a lawsuit under Sarbanes-Oxley relating to alleged whistleblowing that does not relate to the work the company performs for the public company client. For example, a private company's employee may ostensibly claim that he "blew the whistle" on his employer's billing practices, claiming that his employer had sent "trumped-up" invoices to individual customers through the mail. In light of Lawson, such an employee may be protected by the Sarbanes-Oxley whistleblower provision despite the fact that the allegedly fraudulent activity did not relate in any way to the private employer's public company client.

Third, companies may consider providing information to employees, either through a formal whistleblower policy or a message from company leadership, that (1) all employees are expected to comply with all applicable laws, (2) employees should report any suspected violations of law to company management, (3) such reports will be investigated by appropriate company officials, and (4) retaliation for such reports will not be tolerated. 

Finally, regardless of the type of compliance programs and whistleblower policies that a private company may implement, it is critical to train managers regarding such policies and to ensure that a whistleblower is not retaliated against in any manner because he or she has made a complaint.

Securities Exchange Commission Warning

While encouraging employees to report concerns is a sound practice, on March 14, 2014, Sean McKessy, Chief of the SEC's Office of the Whistleblower, stated that the SEC is "actively looking" for agreements between employers and employees which provide benefits to employees if they agree not to go to the SEC or to report concerns to regulators. Creatively-drafted contracts which attempt to incentivize employees to keep complaints internal and not bring company wrongdoing to the SEC's attention will be targeted and scrutinized by the SEC. While it is advisable to develop programs and policies that encourage employees to follow the law and immediately report any concerns to management or via an employee hotline, companies must stop short  — and far short — of policies which arguably fall within the scope of the incentive policies Mr. McKessy cautions against. Policies and company management should focus on encouraging employees to report concerns and providing avenues for such reports, while avoiding the implication of incentivizing employees for not reporting, and preventing retaliation against employees who do take their concerns outside the company.