134rd Year no.

26

RECORDER
www.therecorder.com

MondaY, JULY 18, 2011

A further look at the new Dodd-Frank rules

The SECs whistleblower provisions encourage affected companies to revamp their compliance and internal reporting standards
look back provision states that a person who reports possible violations internally will still be an eligible whistleblower if he provides the information to the SEC within 120 days. Further, the submission will be measured as of the earlier internal reporting date. Thus if A reported internally, and subsequently B made a submission to the SEC concerning the same matter, A will still be considered the initial whistleblower so long as he or she contacted the SEC within 120 days (although as discussed in part one, B may have an advantage of first-intime status), and As internal report would have been sufficiently specific and credible to have caused the SEC to commence an investigation. blower will be eligible for an award based on that action even if the original internal tip would not have satisfied the led to requirements. What if the whistleblower internally reported information concerning discrete misconduct that triggered an internal investigation in which the company, after significant expense and effort, uncovered and reported to the SEC information concerning much greater misconduct that is mostly unrelated to the whistleblowers tip? Does the whistleblower receive an award based on sanctions in a SEC action resulting from entire internal investigation or is the award limited to a certain percentage of the sanctions that directly related to the initial report? There still remain significant disincentives for internal reporting. The potential whistleblower might be concerned that by alerting the company to a potential violation, the company will self-report to the SEC, thereby significantly reducing or avoiding a monetary sanction. There is also the risk that while waiting for the 120-day look back to expire, someone else will run to the SEC with more specific information about violations, which in turn might result in sharing or losing an award. Similarly, there may be the risk that the initial internal report will be deemed not sufficiently credible or specific to have caused the SEC to open an investigation. And of course there is always the risk of retaliation and/or being blamed for the reported misconduct. The smart money would bet that the rational whistleblower will report possible violations simultaneously to the SEC and to the company, thereby doubling the chances of receiving an award either from the SEC investigation or an internal investigation that leads to a SEC proceeding. Amount of An AwArd The SEC provides extensive criteria for determining the amount of a whistleblow-

Jared L. Kopel

Securities
Second of two parts. Last week part one addressed the definition of whistleblower and eligibility. This part discusses internal procedures and award amount determination, and suggests best practices for corporate compliance.

he Securities and Exchange Commission in May issued its final whistleblower rules as required by the Dodd-Frank Wall Street Reform and Consumer Protection Act passed by Congress last year. In so doing the SEC refused to require that a whistleblower initially report possible violations through internal compliance procedures before providing information to the SEC. Numerous commentators argued that the lack of such a requirement would undermine internal control procedures required by SarbanesOxley and that companies should be permitted to investigate and remedy potential misconduct on their own before being subjected to a SEC investigation. The SEC responded that there could be instances where internal disclosures could be inconsistent with effective investigation or the protection of whistleblowers, and that whistleblowers should be allowed to assess whether reporting possible violations internally would be effective. Rather, the SEC provided incentives for employees to report internally. First, a

management must convince employees that there are effective channels for reporting possible violations. Such channels must be open to employees in offices outside of the u.S. and non-English speakers must be able to utilize these channels.
Second, a whistleblowers participation in internal compliance systems is a factor that could increase the amount of an award, while the lack of participation may reduce the amount. Further, a whistleblower who reports internally before or at the same time as to the SEC will receive full credit for the information that the company later reports to the SEC as if the whistleblower had provided it. Thus, when the employer provides information to the SEC that leads to a successful enforcement action, the whistle-

Jared L. Kopel is a partner at Wilson Sonsini Goodrich & Rosati in Palo Alto. He extends his appreciation to Nicki Locker and Caz Hashemi of Wilson Sonsini for their ideas and analysis.

er award. The whistleblower must provide the SEC with information that was sufficiently specific, credible and timely to cause the SEC to open or reopen an investigation, or if an investigation already had commenced, the information must have significantly contributed to the success of the action. As discussed previously, a whistleblower is eligible for an award if he or she initially reported the allegations through internal compliance procedures; the company reported the information or the results of an investigation initiated in whole or in part in response to the whistleblowers tip; and the whistleblower reported the information to the SEC within 120 days after the internal report. Assuming that the criteria are met, the SEC has discretion to determine the amount of the whistleblowers award, which must be 10 to 30 percent of the total monetary sanctions (including penalties, disgorgement and prejudgment interest) if they exceed $1 million. The SEC will treat as one action two or more administrative or judicial proceedings that arise out of the same nucleus of operative facts even if the sanctions from some or all of these separate actions were $1 million or less. If the SEC already made an award, a subsequent action resulting in a sanction of $1 million or less will be considered part of the prior action(s) if they arise out of the same nucleus of operative facts. The SEC may make multiple whistleblower awards so long as the total payments equal 10 to 30 percent of the aggregate sanctions. The SEC may (but is not required to) consider various factors that may increase or decrease the amount, or determine the allocation among multiple whistleblowers. Factors that may increase the amount are the significance of the information; the assistance provided by the whistleblower to the SEC; law enforcement interest in making an award; and the whistleblowers participation in internal compliance systems. Factors that may decrease the amount are the whistleblowers culpability; an unreasonable reporting delay; and interference with internal compliance and reporting systems, which includes hindering, preventing or delaying a companys efforts to detect, investigate or remediate securities violations. A company may not require employees to report internally before reporting to the SEC or discipline a whistleblower for failing to report internally. Whistleblowers are not entitled to amnesty from SEC actions. While culpability

does not exclude eligibility, the $1 million threshold does not include sanctions that the whistleblower must pay or that are paid by any entity whose liability is based substantially on conduct that the whistleblower directed, planned or initiated. Further, eligibility for an award is excluded for a person who provides information to the SEC by a means or in a manner that resulted in a criminal conviction. The rules also contain extensive procedures for submitting information, making a whistleblower claim and appealing the SECs award decision. A whistleblower must declare under penalty of perjury that the information submitted to the SEC is true and correct to the best of the persons knowledge and belief. A person also may submit information anonymously through an attorney, although the attorney must certify that she has verified the whistleblowers identity and that the information is true, correct and complete to the best of the attorneys knowledge and belief. An attorney submitting information in this manner is subject to SEC disciplinary sanctions for any misconduct. The SEC may not disclose the identity of a whistleblower except as required in a judicial or administrative proceeding, or, when the SEC deems necessary, to the Department of Justice, the PCAOB or state or foreign securities and law enforcement authorities. The SEC may demand that the whistleblower enter into a confidentiality agreement. ISSuES In whIStLEbLowEr ruLES Because of its limited resources, the SEC may request companies initially to investigate the subject matter of a whistleblower allegation. The SEC, while preserving the confidentiality of the whistleblower, will in appropriate circumstances contact a company, describe the nature of the allegations, and give the company an opportunity to investigate the matter and report back, according to the rules. The company will have to decide, based on the facts and circumstances, what kind of investigation will satisfy the SEC. May an inquiry be conducted by management or outside counsel, or will the board need to retain special counsel and auditors? Should the company provide the SEC with a written report that is discoverable in private shareholder litigation and/or offer to waive the attorney-client privilege and work product doctrine to provide the SEC with the results of employee interviews? While these questions are always present, they take on

greater urgency given that the inquiry is conducted specifically at the SECs request and the investigation must satisfy the SEC. Companies should have a game plan for responding to the SEC or an internal whistleblower complaint. For example, managers in the IT department must be able to immediately preserve hard copy and electronically stored information in all of the offices, divisions, servers and hard drives that may contain relevant information. Management, the board and outside counsel should have strategized in advance how to conduct an internal investigation in response to allegations of possible violations. Counsel should conduct internal investigations so that information conveyed to other employees is subject to the attorney-client privilege. The number of employees aware of the investigation should be limited. The 120-day window for the internal whistleblower or an excluded person (or anyone learning information from them) to report to the SEC begins to run when a company becomes aware of information concerning possible securities violations. The company also must quickly investigate the matter to avoid an excluded person (or anyone who learned information through them) contending that he is an eligible whistleblower because the company was engaging in conduct that would cause substantial injury to investors and/or was impeding an investigation. Most importantly, the company must decide whether to report to the SEC within the 120-day window even if there is no indication that the SEC is aware of a possible problem and/or if the internal investigation is not yet completed. The decision is clear (yes) if an internal investigation has revealed significant violations that will have to be publicly disclosed. But it is a much harder issue if an internal inquiry indicates that there was no misconduct or that any impropriety was not material. Companies may decide to self-report to the SEC anyway in an effort to preclude any SEC investigation if the whistleblower contacts the SEC. While employees cannot be required to report possible securities violations internally, they may be encouraged to do so. The SEC asserted that many whistleblowers who report internally are motivated by nonmonetary incentives. However, employees will respond to such encouragement only if they believe that internal complaints will be handled seriously and

that whistleblowers will not be subjected to retaliation. Management must convince employees that there are effective channels for reporting possible violations. Such channels must be open to employees in offices outside of the U.S. and non-English speakers must be able to utilize these channels. Management should also keep a whistleblower reasonably apprised of the status of an investigation and management should explain the basis for a conclusion that there is no violation to avoid the impression that the inquiry was a whitewash. Some commentators have suggested providing bounties to employees who provide whistleblower complaints. But aside from the practical problems of awarding boun-

ties, it will be impossible for bounties to compete with the potential rewards from the SEC. Companies should have regular training concerning nonretaliation policies for all employees, but particularly managers, who must understand that their career advancement will be harmed by any retaliation against whistleblowers. The nonretaliation policy must be reiterated annually in the form of memoranda and/or a company-wide email and be posted prominently. Additionally, companies must evaluate and upgrade their internal reporting capabilities. Employees should be able to report complaints anonymously. The SOX certifi-

cations and subcertifications by employees should address possible legal violations in addition to financial statement accuracy. Performance and exit reviews should be utilized to discover whether an employee knows of possible violations. ConCLuSIon As described above, the SECs whistleblower rules constituting only one of the numerous rules mandated by Dodd-Frank are complicated and challenging. It remains to be seen whether the rules yield the promised benefits. Companies and counsel must understand the operation of the rules and the changes in corporate culture that might result.

Reprinted with permission from the July 18, 2011 edition of The Recorder. Copyright 2011. ALM Media Properties, LLC. All rights reserved. Further duplication without permission is prohibited. For information, call 415.490.1054 or cshively@alm.com.