Balancing Confidentiality and Ethics:

External Reporting of Internal Information

Anthony Menendez, CFE, CPA

Forensic Litigation Consultant

Monday, June 19th, 2017

Balancing Confidentiality and EthicsExternal Reporting of Internal Information & Sarbanes-Oxley

Anthony J. Menendez CPA, CFE

tony@FinancialFraudExaminer.comFinancial Fraud Examiner LLC

Global Cost of Fraud

✤ The Association of Certified Fraud Examiners (ACFE)

2016 Report to the Nations, estimates the typical

organization loses 5% of annual revenues to fraud.

✤ Of the three major categories of occupational fraud,

financial statement fraud caused by far the greatest

median loss per scheme.

Common Anti-Fraud Controls

✤ External Audits (82%)

✤ Code of Conduct (81%)

Fraud Detection

✤ The Association of Certified Fraud Examiners (ACFE)

2016 Report to the Nations, reports that

whistleblowing “tips” were the primary method of fraud

detection (40%).

✤ External audits account for a very small percentage

of detected frauds (3%)

Ethics Resource Centers 2014

National Business Ethics Survey

✤ (41%) of employees witnessed illegal or unethical

misconduct during the previous year, a significant

percentage (37%) did not report it.

✤ (21%) of those who reported misconduct experienced

some form of retaliation.

✤ (46%) of employees indicated that fear of retaliation as

the reason they did not report the wrongdoing.

The Morality of Whistleblowing

Whistleblowing: “An attempt by a member or a former member of an organization to

disclose wrongdoing in or by the organization” (Valasquez 2006)

Moral Agency

✤ Moral agency is an important aspect of moral behavior

and influences the agent’s behavior. A distinguishing

factor of moral agency is autonomous will or “to act

according to reasons and motives that are taken as

one’s own and not the product of organizational

policies and external forces such as whistleblowing

legislation” (Near and Miceli 1985).

Moral Justification

✤ The “standard theory” on whistleblowing of Davis (1996, p. 147)

holds that whistleblowing is morally required when it is required

at all: people have a moral obligation to prevent serious harm to

others if they can do so with little costs to themselves.

✤ Davis believes that what seems to make whistle-blowing morally

problematic is its organizational context. “The whistleblower

cannot blow the whistle on just any information received as a

member of an organization. Instead, to be a whistleblower is to

reveal information with which one is entrusted” (1996, p. 148).

Moral Permissibility (Extreme View)

✤ Employees are never permitted to externally blow the

whistle, typically based on the notion of loyalty to

one’s firm and/or due to confidentiality agreements.

✤ This position is rejected because it is either morally

repugnant to a free and democratic society, or

because absolute loyalty toward anyone or any

entity does not exist (Duska 2009) or as an ethical

notion is never absolute (Lindblom 2007).

Moral Permissibility (Extreme View)

✤ Employees are always morally permitted to externally

blow the whistle for any reason, typically based on the

notion of free speech.

✤ This position is also always rejected as free speech

has never been considered an absolute moral

principle, or due to the unnecessary harm caused to

the firm by externally blowing the whistle. (Hoffman |

Schwartz 2014)

Morality of External Whistleblowing

Criteria: Richard T. De George

Morally Permissible Criteria

✤ (1) the firm’s actions will do serious and considerable

harm to others;

✤ (2) the whistleblowing act is justifiable once the

employee reports it to her immediate supervisor and

makes her moral concerns known;

✤ (3) absent any action by the supervisor, the employee

should take the matter all the way up to the board, if

necessary;

Morally Obligated Criteria

✤ (4) documented evidence must exist that would

convince a reasonable and impartial observer that

one’s view of the situation is correct and that serious

harm may occur; and

✤ (5) the employee must reasonably believe that going

public will create the necessary change to protect the

public and is worth the risk to oneself. (De George

2010)

Corporate Whistleblower Protections

Before Sarbanes Oxley

✤ No whistleblower protections for corporate employees

✤ In 2001 and 2002 corporate frauds exploded in the U.S.

resulting in large bankruptcies, tens of thousands lost their

jobs and pensions, and investors lost billions in shareholder

value.

✤ Congressional investigations revealed that although many

individuals knew about the wrongdoing they remained silent

and those who came forward were ignored and/or retaliated

against.

Sarbanes Oxley

✤ Whistleblower advocates and scholars alike greeted

SOX with great enthusiasm as it appeared to provide

the strongest encouragement and very broad

protections.

✤ Pioneered jury access

✤ Mandated confidential reporting channels

✤ Created criminal liability for retaliation

Protected Activity (SOX)

✤ 18 U.S.C. Sec. 1514A(a)(1): Information regarding

conduct which the employee reasonably believes

constitutes a violation of law regarding fraud against

shareholders or any rule or regulation of the Securities

& Exchange Commission to ...any person with

supervisory authority over the employee, or any

person who has the authority to investigate, or

terminate the misconduct.”

SOX Failures

✤ SOX simply did not protect whistleblowers who

suffered retaliation. Statistics through 2011:

✤ Employee Wins = 23

✤ Employee Losses = 1,237

✤ For fiscal years 2006 - 2008, Employees lost 488

straight decisions!

SOX Failures

✤ SOX did not protect the investing public from the

financial crisis of 2008 and 2009

✤ Housing prices fell 31.8%

✤ Unemployment exceeded 9% for years

✤ Taxpayer funded $700 billion bailout package

Dodd-Frank

✤ Bounty Provision: Section 922 of Dodd-Frank provides that the SEC

shall pay an award or awards to whistleblowers:

✤ Who voluntarily provide “original information”

✤ That leads to successful SEC enforcement actions, resulting in

collections of $1 million

✤ Not less than 10% or more than 30% of the sanctions collected

Dodd-Frank

✤ Dodd-Frank Act strengthens the whistleblower

protection provisions of the False Claims Act, and

contains one of the strongest confidentiality provisions

for whistleblowers ever enacted.

✤ For the first time, whistleblowers are allowed to

initially report fraud anonymously by filing a claim

through an attorney.

SEC Enforcement: Confidentiality

Provisions

✤ Rule 21-F-17 prohibits companies from taking any

action to impede whistleblowers from reporting possible

securities violations.

✤ “SEC rules prohibit employers from taking measures

through confidentiality, employment, severance, or

other type of agreement that may silence potential

whistleblowers before they can reach out to the SEC.

We will vigorously enforce this provision.” - Director

SEC Division of Enforcement

AICPA Code of Professional Conduct

✤ Permits disclosure of client information under the

following circumstances:

✤ Compliance with subpoena and summons,

✤ Compliance with professional obligations (AICPA,

state society, state board

investigations, or

✤ Compliance with peer review requirements.

Diversity in State Accountancy

Requirements

✤ Today there are statutes for the State Board of Accountancy in each of the 55

jurisdictions. Each jurisdiction sets its own requirements regarding the disclosure of client

information (“CPA whistleblowing”).

✤ Only 3 states out of the 55 jurisdictions explicitly permit CPA whistleblowing. Those 3 states

are:

✤ Colorado permits the disclosure “as part of the process of initiating a complaint with or

responding to an investigative or disciplinary body established by law or formally recognized

by the Board”.

✤ Michigan permits disclosure when the CPA “has knowledge that forms a reasonable basis to

believe that a client has committed a violation of federal or state law or local governmental

ordinance”.

✤ North Carolina permits CPA whistleblowing when the “CPA concludes in good faith based

upon professional judgment that a crime is being or is likely to be committed”.

Implementation of the Whistleblower Provisions of

Section 21F of the Securities Exchange Act of 1934

✤ “Contrary to the suggestion from a number of commenters, we are

not excluding information that is received in breach of state-law

confidentiality requirements, such as those imposed on auditors,

because to do so could inhibit important federal-law enforcement

interests.”

✤ “Several commenters recommended that whistleblowers should have

to use internal reporting processes by either reporting up the chain at

the audit firm or reporting to the audit client. We are declining to adopt

a rule that would require all employees of accounting firms use the

internal processes whether at the audit firm or at the audit client.”

Confidentiality: Empowering

Whistleblowers

✤ The Ethics and Compliance Initiative’s 2013 National

Business Ethics Survey of the U.S. workforce revealed

that 45 percent of individuals surveyed did not report

misconduct because they did not trust their report

would remain confidential.

American Accounting Association’s journal

Behavioral Research in Accounting

✤ The researchers posited that when companies enact

policies that describe “explicit whistleblower

protections” from retaliation, whistleblowers are

actually discouraged by the “salience of retaliatory

threats.” In other words, hearing detailed information

about the various forms of retaliation from which they

were protected, made individuals feel increasingly

afraid of retribution and less likely to report

misconduct.

Survey of US & UK Financial Services

Industry

✤ 28% earning > $500,000 say their company’s confidentiality

policies bar the reporting of potential illegal or unethical acts

to law enforcement or regulatory agencies.

✤ 25% earning > $500,000 have signed or been asked to sign

confidentiality agreement prohibiting reporting to authorities.

✤ 19% of respondents find it likely that their employer would

retaliate if they reported wrongdoing in the workplace.

Survey of US & UK Financial Services

Industry

✤ 47% find it likely that their competitors have engaged

in unethical or illegal activity to gain an edge in the

market.

✤ 34% of those > $500,000 have witnessed or have first

hand knowledge of wrongdoing in the workplace.

✤ 23% believe it is likely that fellow employees have

engaged in illegal or unethical activity.

✤ Percent of Reporters Who (at Some Point) Utilize This Resource:

✤ Supervisor 82%

✤ Higher management 52%

✤ Human resources 32%

✤ Hotline/Helpline 16%

✤ Ethics officer 15%

✤ Someone outside the company, not government or regulatory authority 13%

✤ Legal 11%

✤ Government or regulatory authority 9%

National Business Ethics Survey

NBES: Why Report Externally

✤ 50% Problem was ongoing and I thought someone from outside could help stop it.

✤ 45% I did not trust anyone in my company.

✤ 40% I was retaliated against after I made my first report inside the company.

✤ 40% I was afraid I would lose my job if I did not get outside assistance.

✤ 39% I thought keeping quiet would case possible harm to people or the environment.

✤ 36% My company acted on my report, but I was dissatisfied.

✤ 29% My company did not act on my report.

✤ 29% I thought keeping quiet would get my company into trouble.

✤ 22% I was afraid for my safety.

✤ 14% I had the potential to be given a substantial monetary reward.

Questions?

Anthony J. Menendez CPA, CFE

Financial Fraud Examiner LLC

tony@FinancialFraudExaminer.com

Balancing Confidentiality and Ethics:

External Reporting of Internal Information

Anthony Menendez, CFE, CPA

Forensic Litigation Consultant