On Friday, August 29, the SEC announced its first-ever whistleblower award to an audit or compliance professional. In a press release, Sean McKessy, chief of the SEC’s Office of the Whistleblower, highlighted the unique ability of audit and compliance personnel to serve as whistleblowers. He explained, “[i]ndividuals who perform internal audit, compliance, and legal functions for companies are on the front lines in the battle against fraud and corruption. They often are privy to the very kinds of specific, timely, and credible information that can prevent an imminent fraud or stop an ongoing one.”
According to the SEC, the whistleblower first reported the wrongdoing internally, but when the company failed to take action on the information within 120 days, the whistleblower reported the information to the SEC. The information provided by the whistleblower led directly to an enforcement action, and the SEC awarded the whistleblower 20 percent of the sanctions collected from the company.
Under the rules governing the SEC Whistleblower Program, compliance and internal audit personnel generally are not considered eligible for whistleblower awards. However, the rules carve out three exceptions in which compliance and internal audit personnel could become whistleblowers: (1) when the whistleblower believes disclosure may prevent substantial injury to the financial interest or property of the entity or investors; (2) when the whistleblower believes that the entity is engaging in conduct that will impede an investigation; or (3) when at least 120 days have elapsed since the whistleblower reported the information to his or her supervisor or the entity’s audit committee, chief legal officer, chief compliance officer – or at least 120 days have elapsed since the whistleblower received the information, if the whistleblower received it under circumstances indicating that these people were already aware of the information.
This award emphasizes the importance for companies both (1) to ensure that they have vigorous compliance programs in place to detect potential issues and (2) to respond immediately and effectively to internally reported information. Companies should communicate with employees who make internal reports to assure them that the information has been received and is being addressed. Companies also should train supervisors to understand their role in internal reporting and their responsibilities when employees raise concerns of suspected wrongdoing. Under the whistleblower exceptions for compliance professionals, the 120-day clock begins to run when the employee reports the information to his or her supervisor. Therefore, it is critical that supervisors understand their responsibility to respond to employee concerns promptly and in accordance with the company’s compliance program. You do not want the clock ticking when the report has not yet reached the people who can truly respond to it.
For more information about the SEC Whistleblower Program, click here.