Encouraging C&E Reports and Preventing Retaliation

Jeff Kaplan/Kaplan & Walker LLPSCCE Upper NE Regional ConferenceMay 17, 2013Encouraging C&E Reports and Preventing RetaliationTodays presentationwww.kaplanwalker.com2Overview of various aspects of policies, procedures and other means to encourage C&E reports and prevent retaliationPaul Robert will do a deep dive into approach at UTCThe legal imperativewww.kaplanwalker.com3While all parts of a C&E program are important, encouraging C&E reports and preventing retaliation have special status for companies and boardsSpecificity of legal expectations for boards, e.g., S-Ox 301, Caremark Bounty provisions, e.g., FCA, Dodd-FrankNecessity for being in a position to self report to win leniency or amnestyIn developing, assessing and improving a C&E program, this area requires special attentionSpecial challengeswww.kaplanwalker.com4It is also perhaps the most difficult C&E program area in which companies can excel:Many studies have shown most C&E violations are not reported internallyChallenges can be deeply culture-basedERC 2011 NBES: Retaliation against employee whistleblowers rose sharply from prior surveyNeed nearly all the general elements of a C&E program brought to bear on thisPolicies Code of Conductwww.kaplanwalker.com5Need to report should obviously be featured in the codeCEO letterSeparate section in introPerhaps in some risk-area specific sectionsBut dont want to overdo itQ&A on key pointsReporting resources often both at beginning and end of codePolicies Code (cont.)www.kaplanwalker.com6Specifics of reporting obligationNot just known violations but also where reason to suspect a violation or attempted violationsMust report actual or suspected retaliationSpecifics of retaliation discussionNot just that we dont permit it, but it is a serious violation of our policies and will be dealt with accordinglyDiscuss bad faith reporting? If do so, be gentlePolicies Code (cont.)www.kaplanwalker.com7Reporting avenuesManagers: should always be listed, but delicate issue is how strongly you push itOther C&E, Legal, HR, hotline, part-time C&E peopleBut those who are listed should be trained on how to do deal with repots (discussed below)Board/Audit CommitteeNeed to explain difference between confidentiality and anonymity If dont already have, consider offering a web-based system for reporting

Policies Code (cont.)www.kaplanwalker.com8Broader discussion of C&E program, including what happens with callsHaving discussion about the program overall should help provide confidence that company is sincere about dealing with suspected C&E violations and also help deter retaliationManagers responsibility section of code include Maintaining a work environment that encourages employees to ask questions and raise concernsAppropriate handling of any employee compliance reports

Other related policies - escalationwww.kaplanwalker.com9General escalation - factors to considerPotential impactEconomic dimensionNature of issue (including retaliation)Involvement of senior personnelImplications for controls Build into training/communicationsGenerallyFor investigators (discussed below)For lawyers - S-Ox 307 Other related policieswww.kaplanwalker.com10Procedures for the hotline providerScripts for callsNotification issuesDo you need a stand-alone whistleblower policy? Not everyone does, but it can: Be useful for bigger companies or for ones with special reporting challengesSpell out more on different responsibilities and C&E measuresAddress data privacy requirementsBe helpful for auditing of this aspect of the program

Training &www.kaplanwalker.com11Reporting should be a central focus of training, bothGeneral code trainingShort reminders, if you use theseAlso build it into risk-area specific trainingNot just reporting violations/preventing retaliation but also seeking guidance about risk area requirementsSpecial importance for anti-corruption compliance

Training &(cont.)www.kaplanwalker.com12For managers and others, consider training on how to receive a reportWhat/what not to say/do:attentiveness/empathysetting expectations avoiding unintended retaliationconfidentiality escalationOther communicationswww.kaplanwalker.com13Should have an overall communications plan which includes periodically addressing reporting issuesMessaging by all levels of management (and keeping track of these efforts)Posters, articles in company newsletters, various uses on intranet, mention on pay stub, tchotchkes Publicizing information about number and results of cases can be very helpfulMore later on thisInvestigations & www.kaplanwalker.com14Guidance in the form of training and/or written procedures - for those involved with investigations on Maintenance of confidentialityAvoidance of retaliationEscalation proceduresNote that training and guidance for investigations can be helpful for many other reasons, tooStaying in touch with whistleblowerGuidance for this including what can say in close outCase management systems can helpDisciplinewww.kaplanwalker.com15Fairness/rigor is key to encouraging reportsThe importance of organizational justiceWhat the DOJ/SEC has said (in the 2012 FCPA guidance): Many companies have found that publicizing disciplinary actions internally, where appropriate under local law, can have an important deterrent effect, demonstrating that unethical and unlawful actions have swift and sure consequences.Can be particularly useful for retaliation casesDiscipline for culpable failure to prevent/detect violations

Incentiveswww.kaplanwalker.com16A few companies provide monetary incentives for reporting suspected violationsIdea goes back about twenty yearsBut one can generally get similar benefits from intangible rewardsPublicize commendable examples of reporting (with attribution when appropriate)Provide more local forms of recognition and train managers on how to do thisGovernance and www.kaplanwalker.com17Should be an area of reasonably close involvement by boards and senior managersBoth for measures to be effective and given legal imperativesDefine categories (in escalation provisions) of reports they need to know aboutBuild into protocol requirements that any circumstances suggesting need for independent investigation must be provided to the board/audit committee

Managementwww.kaplanwalker.com18CECOs duties in this area should be spelled out in her remit and/or program charterBetter than trying to define them in the course of a crisis Having a high-level compliance committee for dealing with case management can help through strength in numbersIf investigations are overseen by regional committees, prepare a charter and conduct related audits

Auditing and monitoringwww.kaplanwalker.com19Monitoring many dimensionsTreatment of whistleblowers by checking in with themSome companies do this on a sampling basisTime to complete investigationsResults of investigations/disciplineAuditing also many dimensionsAre hotline posters up where they should be?Review investigation files re: compliance with whistleblower protection policies

Risk assessmentwww.kaplanwalker.com20Necessary for understanding need forExtra messaging Special messagingExtra monitoringAssess not only relevant organizational culture but also Geographic cultureMostly by countries but also isolation-related factorsIndustry culture

Self assessmentwww.kaplanwalker.com21Questions from employee awareness surveyGeneral on fear of reportingC&E-focused onesA good idea every few yearsCan dive much deeper e.g., find out why misconduct not reported or what experience was for those who didConsider data correlations what other factors coincide with low reporting?Possible use of focus groups Third partieswww.kaplanwalker.com22The next frontier for many companiesMany different types and different issues/challenges - range goes from contractors on site to agents and distributors far away and out of sightApproachesDirectContractual