Does Your Company Timely Respond to All Reports of Potential Misconduct?

On March 30, 2020, the SEC announced an award of $450,000 to a whistleblower for providing significant information in an investigation by the Division of Enforcement. The whistleblower, who had compliance-related responsibilities at the company, was credited with helping to focus an ongoing investigation on the violations that were ultimately charged and also with providing meaningful assistance to the Commission's investigation and subsequent enforcement action. Under the rules governing the SEC whistleblower program implemented under section 922 of the Dodd-Frank Act, compliance and internal audit personnel are generally not considered eligible for whistleblower awards with a few narrow exceptions. The exceptions include when disclosure may prevent substantial injury to the financial interests or property of an entity or investors and when the whistleblower believes an entity may be engaging in conduct that will impede an investigation. The award announcement acknowledged that the whistleblower had made "reasonable efforts" to work within the company's compliance structure and had suffered "unique hardships" as a result. In addition, the whistleblower had waited the requisite 120 days after reporting internally before disclosure to the Commission.

This is the third whistleblower award by the Commission to an individual who had compliance or internal audit responsibilities at a company under investigation. In 2014, the Commission awarded $300,000 to an individual who performed audit and compliance functions and who had reported alleged misconduct to the SEC only after the company failed to take action based on an internal report. In 2015, the Commission awarded between $1.4 and $1.6 million to a compliance officer at a company who had a reasonable basis to believe that disclosure to the SEC was necessary to prevent imminent misconduct from causing financial harm to the company or investors.

The key takeaway from these whistleblower awards is that companies should make every effort to see that any internal report involving potential violations of the securities laws, whether from an employee, third party, or other source, is promptly and thoroughly addressed to the extent possible. Companies should review their policies, procedures, and training programs to confirm that their policies advise supervisory personnel to timely elevate any reports of such potential violations to the appropriate level within the company or to the audit committee of the board for investigation. Companies should maintain policies prohibiting retaliation against whistleblowers that are clearly communicated and enforced at all levels within the organization.