On Friday, August 29, the SEC announced its first-ever whistleblower award to an audit or compliance  professional.  In a press release, Sean McKessy, chief of the SEC’s Office of the Whistleblower,  highlighted the unique ability of audit and compliance personnel to serve as whistleblowers. He  explained, “[i]ndividuals who perform internal audit, compliance, and legal functions for companies  are on the front lines in the battle against fraud and corruption.  They often are privy to the very kinds  of specific, timely, and credible information that can prevent an imminent fraud or stop an ongoing  one.”

According to the SEC, the whistleblower first reported the wrongdoing internally, but when the  company failed to take action on the information within 120 days, the whistleblower reported the  information to the SEC.  The information provided by the whistleblower led directly to an enforcement  action, and the SEC awarded the whistleblower 20 percent of the sanctions collected from the  company.

Under the rules governing the SEC Whistleblower Program, compliance and internal audit personnel generally are not considered eligible for whistleblower awards.  However, the rules carve out three  exceptions in which compliance and internal audit personnel could become whistleblowers: (1) when  the whistleblower believes disclosure may prevent substantial injury to the financial interest or  property of the entity or investors; (2) when the whistleblower believes that the entity is engaging in  conduct that will impede an investigation; or (3) when at least 120 days have elapsed since the  whistleblower reported the information to his or her supervisor or the entity’s audit committee, chief  legal officer, chief compliance officer – or at least 120 days have elapsed since the whistleblower  received the information, if the whistleblower received it under circumstances indicating that these  people were already aware of the information.

This award emphasizes the importance for companies both (1) to ensure that they have vigorous  compliance programs in place to detect potential issues and (2)  to respond immediately and  effectively to internally reported information.  Companies should communicate with employees who  make internal reports to assure them that the information has been received and is being addressed.   Companies also should train supervisors to understand their role in internal reporting and their  responsibilities when employees raise concerns of suspected wrongdoing.  Under the whistleblower  exceptions for compliance professionals, the 120-day clock begins to run when the employee reports  the information to his or her supervisor.  Therefore, it is critical that supervisors understand their responsibility to respond to employee concerns promptly and in accordance with the company’s  compliance program.  You do not want the clock ticking when the report has not yet reached the  people who can truly respond to it.

For more information about the SEC Whistleblower Program, click here.