A Whistleblower Speaks Up at Your Company — Now What? 5 Key Considerations

At first blush, news that an employee has filed an internal report detailing illegal or unethical behavior at your company may seem like a terrible development. It’s natural to feel shocked when a whistleblower makes such accusations … but then again, it’s better than keeping it in the dark.

“Legitimate companies should want their employees to come forward with legitimate concerns,” said Bill Lawler, a partner in Government Investigation and White Collar Defense at V&E. “If a whistleblower brings up a real problem, you want to understand what it is and resolve it.”

In fact, according to a report in Harvard Business Review, internal whistleblowing is a sign of a company’s good health. In an analysis of 1.2 million internal whistleblower reports at U.S. companies, researchers Stephen Stubben of the University of Utah and Kyle Welch of The George Washington University found that those “actively using their internal reporting systems” faced fewer lawsuits and had lower settlement amounts. “While all firms are likely to have some frequency of issues, firms where these are reported early are more likely to address them before they become larger problems resulting in costly litigation,” Stubben and Welch wrote.

Of course, company leaders can be forgiven if they don’t rush to celebrate each new internal complaint. Internal reporting doesn’t guarantee that a whistleblower won’t later sue or share their concerns with the government. Some whistleblowers may find approaching the government especially appealing due to whistleblower “bounty” programs established through the False Claims Act and the 2010 Dodd-Frank Wall Street Reform and Consumer Protection Act.

In any case, whistleblower allegations must be handled with care. Below, Lawler and his fellow Government Investigation and White Collar Defense partners Jessica Heim and Jeff Johnston share a few considerations to keep in mind:

1. Ensure your internal reporting system and investigation procedures are robust.

As the HBR report notes, giving employees the tools to voice concerns internally can help prevent larger problems down the road. But for many companies, establishing internal reporting systems is also a legal requirement. The Sarbanes-Oxley Act of 2002 mandated that public companies establish a channel to allow employees to engage in anonymous whistleblowing as part of their compliance programs.

In recent years, private companies have also come under pressure to create similar mechanisms. In the worst-case scenario, when a company winds up in the crosshairs of a government investigation, it’s always in the company’s advantage to show it takes internal reporting and investigations seriously. “When companies are investigated by the DOJ and the SEC, they take a very hard look these days at companies’ compliance programs to make sure they’re not just paper programs,” Heim said. She noted that government investigators typically ask questions about who’s in charge of reviewing whistleblower allegations, who determines whether an investigation is warranted, who conducts an investigation, how results are reported and more. “They really dig deep to make sure that all elements are very thought out and deliberate,” she said.

When companies determine that an allegation warrants an internal investigation, they may choose to handle it through a designated in-house investigator such as a compliance officer, to hire outside counsel to conduct the investigation, or to pursue a hybrid approach, with designated company personnel and outside counsel sharing investigative responsibilities.

Some whistleblowers find it more comfortable to share information with an outside counsel hired to conduct an investigation. “Quite often, we have taken over the communications with the whistleblower and they know that they can follow up with us directly without fear of reprisal,” Heim said. (See more on whistleblower communications farther down.)

2. Recognize when whistleblower protections apply.

Both Sarbanes-Oxley and Dodd-Frank created rules to discourage retaliation against whistleblowers. Under Sarbanes-Oxley, in particular, those protections extend to internal whistleblowers. But Johnston noted that sometimes company leaders are confused about who is technically considered a whistleblower. Johnston advised that a person need not follow established internal reporting procedures to be eligible for whistleblower protections.

“Clients may say that because an employee didn’t report it on a form, or they didn’t call HR or didn’t jump through some other hoop of formality, they’re not really a whistleblower,” Johnston explained. “And I always say, ‘It really doesn’t matter how they report it. They can send it by telegram. They can write it on a napkin and stick it in your mailbox.’ No matter what way someone within your company expresses concern of unethical or illegal or inappropriate conduct, they are a whistleblower. End of discussion.”

3. Recognize what constitutes retaliation and how to avoid it.

Firing or demoting a whistleblower are obvious forms of retaliation, but companies must take care to ensure that they’re not engaging in other actions that could legally be interpreted as retaliation. Those might include moving the whistleblower’s desk or requesting that they work from home. Such actions should be avoided even if they were planned before the whistleblower came forward. “When you make a misstep here, you create private causes of action where whistleblowers can sue you and recover damages for that retaliation, and various government agencies can open enforcement actions and come after you for civil penalties for retaliating,” Johnston said.

Companies may find themselves in a particularly tough spot if a whistleblower was scheduled to be included in a planned reduction in force. “It may be entirely appropriate to include them on a layoff list. You can demonstrate that they got on that list for some unrelated reason that has nothing to do with their being a whistleblower,” Johnston said. “But question whether you want to have to be defending that decision.”

4. Maintain communication with the whistleblower.

Companies may find it is in their interests, when possible, to maintain communication with whistleblowers, including anonymous ones — certain reporting tools may provide company investigators a means to continue contact with anonymous whistleblowers. Maintaining open lines of communication could allow whistleblowers to report if they’re experiencing possible retaliation while allowing investigators to give whistleblowers updates on how investigations are proceeding. Such steps may help whistleblowers feel confident that their allegations are being taken seriously and may discourage them from elevating their concerns to government agencies.

Of course, such communication has its limits. “Once you get into an investigation, oftentimes there’s only so much you can say. And you can’t make whistleblowers a part of your investigation team or a part of senior management’s strategic decisions,” Johnston said. “But you do want them to feel like they’re being heard and that their complaints are being taken seriously.”

Sometimes whistleblowers make their identities known to investigators but nonetheless request a degree of anonymity. In such cases, Lawler said, it’s important to manage expectations. Sometimes, it’s not possible to keep whistleblowers totally anonymous.

“For public companies, there can be reporting obligations. If something happens and there is wrong-doing that is eventually reported to, say, law enforcement or the FCC, you’re not going to be able to maintain anonymity there at all,” Lawler explained. “At the beginning it’s very hard to know what circumstances would require you to provide information about the identity of the whistleblower. If it’s appropriate, you could tell them, ‘We will try to do what we can to maintain your anonymity, but we can’t guarantee it.’”

5. Keep emotions in check.

Some company leaders can’t help but feel emotional over news of a whistleblower accusation. Managers who learn that a whistleblower shared a complaint with another company official or through a reporting mechanism may feel “there’s been a betrayal of trust,” Lawler said. “They might ask, ‘Why didn’t you come to me?’” In the case of anonymous whistleblowers, managers may focus too much time in trying to determine who the whistleblower is and what their motivation may be rather than focusing on the substance of their allegation.

“I’ve seen a lot of clients just really wrap themselves around the axle, spending a lot of time and energy trying to do that, and frequently they’re wrong,” Lawler said. “They’ll say, ‘Oh, we think it’s Bob,’ and it’s not Bob at all. So I tell clients, if you don’t know who the whistleblower is, don’t make yourself crazy trying to figure out who it is.”

Lawler said focusing on the substance of the allegations, rather than the source, is key. “There can be very legitimate emotional issues, but they’re not helpful in trying to get to the bottom of the factual allegations.”