Demystifying Sarbanes-Oxley: Suggestions for Public and Private Company Preparedness and Compliance with Employment and Whistleblower Provisions

As the Sarbanes-Oxley Act becomes more familiar to corporations and the legal community, new facets are revealed to show the complexities and reach of the legislation. Following initial public perception that Sarbanes-Oxley impacts only the governance and reporting of publicly traded companies, there is an emerging awareness that it cuts much deeper. Of course, Sarbanes-Oxley promotes corporate transparency, reforms corporate governance and requires independence in important functions of companies with publicly traded securities, and it reinforces those principles with civil whistleblower protections. But far less attention has been given to Sarbanes-Oxley provisions affecting privately held businesses and companies based outside the United States and having no securities traded in U.S. markets.

Criminal provisions affecting corporations and individuals are often missing from accounts of the significant impact Sarbanes-Oxley will have not only on publicly traded companies, but also on privately held businesses and any company with employees in the United States. Criminal penalties attach to newly prohibited activities concerning employees and their participation in governmental proceedings.

Because of the reach of Sarbanes-Oxley and the significance of criminal law consequences for violations, it is particularly appropriate that companies having U.S. operations be prepared with programs to ensure that they and their executives, managers and supervisors will not suffer criminal law liability.

This article will address first the well-publicized but relatively limited civil whistleblower protections applicable to employees of companies having publicly traded securities before proceeding to revelations of the criminal law provisions affecting other businesses.

Civil Whistleblower Protections Affecting Publicly Traded Companies

Perhaps the hallmark employment provision of Sarbanes-Oxley is the widely misunderstood civil whistleblower provision. Applicable only with respect to employers having publicly traded securities, its language is common to non-discrimination and anti-retaliation legislation existing elsewhere in the employment arena. The class of protected employee disclosures is not broad. To qualify for Sarbanes-Oxley protection, the disclosure must relate to federal crimes involving mail fraud, wire fraud, bank fraud, or to securities fraud, fraud against shareholders or violations of Securities and Exchange Commission ("SEC") rules or regulations.

Within the protected disclosures relating to federal criminal laws and shareholder and SEC matters, whistleblowing employees are protected against the customary array of adverse employment actions: discharge, demotion, suspension, threats, harassment and other forms of discrimination in employment terms and conditions. Employees are protected against retaliation for their disclosures if they reasonably believe they are providing information concerning a prohibited violation or otherwise participating in an investigation by a federal or regulatory or law enforcement agency, Congress or a person having supervisory authority over the employee. Protection is provided, additionally, to an employee disclosing information within the protected class in proceedings that the employee files or in which the employee participates. Strikingly, it appears that this latter measure of protection extends to employee participation in proceedings that may have been initiated by others — even if they have interests potentially adverse to the employer — including competitors or customers and vendors.

Employees will be entitled to conventional "make whole" relief by way of job reinstatement with full seniority, together with back-pay, interest and compensation for any special damages sustained as a result of the discrimination, including litigation costs, expert witness fees and reasonable attorneys' fees. Subject to a very brief 90-day statute of limitations, a whistleblower may obtain relief through an administrative proceeding filed with the Occupational Safety and Health Administration as the designee of the Secretary of Labor. However, if the administrative process has not resulted in a final decision within 180 days after the filing of the administrative complaint, the employee may proceed by bringing an action in a United States District Court.

Criminal Sanctions Applicable to Disclosures by Employees  —
Without Regard to Publicly Traded Securities

Logic would suggest that the criminal whistleblower provisions of Sarbanes-Oxley would complement the civil whistleblower provisions. They do not. Far from mirroring the civil provision and overlaying criminal penalties, the criminal provisions for retaliation against whistleblowers have little in common with the civil whistleblower provisions.

Sarbanes-Oxley establishes criminal penalties for taking action that is harmful to any person, including interference with the lawful employment and livelihood of any person, for providing to a law enforcement officer any truthful information relating to the commission or possible commission of any federal offense, if the action is taken knowingly and with the intent to retaliate. Violators — whether or not they have securities traded in U.S. markets, and individuals participating in the prohibited activity — may be fined, or imprisoned for as much as ten years, or both.

Two definitions govern the breadth of the criminal whistleblower provision. First, to be protected, the communication must be made to a law enforcement officer. In reality, virtually any federal government employee involved in the prevention, detection, investigation or prosecution of a federal offense is considered a law enforcement officer. With such an expansive definition of the communication's recipient, the term "federal offense" becomes pivotal to appreciating the breadth of the provision. However, Sarbanes-Oxley does not define federal offense, leaving it uncertain whether the term is meant to apply to criminal or civil matters, or to both.

It is customary that criminal acts are considered "offenses," while civil acts are labeled "violations." If prosecutors treat Sarbanes-Oxley as reaching only federal criminal offenses, the criminal whistleblower protections will have important, but relatively limited, reach. However, if federal offense is construed to include violations of federal civil law, employers will be exposed across the spectrum of federal regulatory measures. As a consequence, even seemingly routine and mundane matters, frequently escaping executive attention but involving federal agencies, would come within the ambit of Sarbanes-Oxley's criminal sanctions.

Criminal Sanctions for Tampering With a Record or Otherwise
Impeding an Official Proceeding — Without Regard to Publicly Traded Securities

Furthering the theme of ensuring corporate best practices, Sarbanes-Oxley criminalizes the corrupt alteration, destruction, mutilation or concealment of a document with intent to impair its integrity or availability for use in an "official proceeding" or otherwise obstructing, influencing or impeding an official proceeding. As with its criminal whistleblower provision, Sarbanes-Oxley again departs from its core focus on companies having securities traded in U.S. markets.

Whether or not they have publicly traded U.S. securities, employers and their representatives may suffer criminal responsibility for actions, including those by individual managers or supervisors, with respect to official proceedings and employee participation in those proceedings.

The term official proceeding comprehends court proceedings, proceedings before Congress and proceedings before any federal government agency, as well as proceedings involving the business of insurance in interstate commerce. Unlike the criminal whistleblower provisions that relate only to disclosures concerning federal offenses, criminal sanctions for tampering with a record or otherwise impeding an official proceeding can derive from employee participation in a broad range of activities, including otherwise unexceptional administrative agency proceedings.

Criminal liability in the nature of a fine or imprisonment for as much as twenty years, or both, may apply to employers and individuals serving as executives, managers and supervisors.

Required Reporting by Attorneys Appearing and Practicing before the SEC

Sarbanes-Oxley has also provoked considerable comment and consternation with respect to required attorney disclosures. Unlike the civil whistleblower provision, which protects employees making disclosures but does nothing to encourage reporting, Sarbanes-Oxley, together with the SEC's Final Rule implementing its standards, mandates certain attorney disclosures. Once an attorney appearing and practicing before the SEC becomes aware of evidence of a material violation of securities law, breach of fiduciary duty or similar violation by the company or any of its agents, he or she must report that evidence to the issuer's chief legal officer, or to both the chief legal officer and the chief executive officer, unless the company has previously established a "qualified legal compliance committee" for the processing of such reports.

As the recipient of a report, the chief legal officer is required to cause "appropriate inquiry" to determine whether the reported material violation as occurred, is ongoing or is about to occur. Unless the chief legal officer reasonably believes that no material violation has occurred, is ongoing or is about to occur, he or she must take all reasonable steps to cause the issuer to adopt an appropriate response and advise the reporting attorney thereof. If the chief legal officer determines there is no merit in the report, he or she must notify the reporting attorney and provide the basis for that determination.

An attorney reasonably believing that it would be futile to report evidence of a material violation to the issuer's chief legal officer and chief executive officer, or reasonably believing that the chief legal officer or chief executive officer of the issuer has not provided an appropriate response within a reasonable time must report the evidence of the material violation to: (1) the audit committee of the issuer's board of directors; (2) another committee of the issuer's board of directors consisting solely of directors who are not employed directly or indirectly by the issuer and who are not "interested persons"; or (3) the issuer's board of directors.

An attorney receiving an appropriate and timely response to a report of a material violation has no further obligation with respect to that report. However, if the attorney does not reasonably believe that the issuer has made an appropriate response within a reasonable time, he or she must explain his or her reasons therefor to the corporate representative to whom the evidence of a material violation was reported. If, on the other hand, the attorney reported to a qualified legal compliance committee, there is no further obligation to assess the issuer's response.

Unlike civil whistleblower employee protections, the Sarbanes-Oxley provisions applicable to in-house and outside attorneys having knowledge of a material violation are framed as attorney obligations. Sarbanes-Oxley does not provide specific employment protections to attorneys making mandated disclosures or confer a private right of action on an attorney reasonably believing that he or she has suffered an adverse action for reporting evidence of a material violation. An attorney who reasonably believes that he or she has been discharged for reporting evidence of a material violation may notify the issuer's board of directors, or any committee thereof, that he or she believes the discharge was for reporting evidence of a material violation.

An attorney complying in good faith with the SEC's Final Rule is insulated by it to the extent he or she may not be subject to discipline or other liability under inconsistent standards that otherwise might be imposed by a state or other United States jurisdiction where the attorney is admitted or practices.

Although attorneys appearing and practicing before the SEC do not have whistleblower protection, the SEC may seek civil penalties and remedies against attorneys appearing and practicing before it for a violation of federal securities law. Additionally, the SEC may initiate administrative disciplinary proceedings against attorneys, seeking censure or temporary or permanent denial of the privilege of appearing or practicing before the SEC.

The SEC's Final Rule makes clear that an attorney appearing and practicing before the SEC in the representation of an issuer owes professional and ethical duties to the issuer as an organization. Working with the issuer's officers, directors or employees, and advising them in the course of representing the issuer, does not make those individuals the attorney's clients.

The SEC's Final Rule allows attorneys appearing and practicing before the SEC in the representation of an issuer to reveal to the SEC — without the issuer's consent — confidential information related to the representation to the extent the attorney believes necessary (1) to prevent the issuer from committing a material violation that is likely to cause substantial injury to the financial interest or property of the issuer or investors; (2) to prevent the issuer in an SEC investigation or administrative proceeding from committing perjury, suborning perjury or committing an act likely to perpetuate a fraud upon the SEC in violation of federal law; or (3) to rectify the consequences of a material violation by the issuer that caused, or may cause, substantial injury to the financial interest or property of the issuer or investors in the furtherance of which the attorney's services were used.

Code of Ethics for Senior Financial Officers of Publicly Traded Companies

Sarbanes-Oxley directs the SEC to issue rules requiring disclosure and periodic reports of the company's adoption of a code of ethics for senior financial officers. Indeed, if no such code has been adopted, the reasons must be disclosed. The term "code of ethics" is defined to mean standards reasonably necessary to promote: (1) honest and ethical conduct, including the ethical handling of actual or apparent conflicts of interest between personal and professional relationships; (2) full, fair, accurate, timely and understandable disclosure in the periodic reports required to be filed by the issuer; and (3) compliance with applicable governmental rules and regulations. The code of ethics must be reasonably designed to deter wrongdoing, to promote the prompt internal reporting of violations of the code to an appropriate person or persons identified in the code and to promote accountability to adherence to the code.

Preparedness and Compliance Advice

Sarbanes-Oxley consequences may be felt not only by issuers having equity and debt securities traded in U.S. markets, but also by virtually any company doing business in the United States and its executives, managers and supervisors. The law is likely to expand best practices in an array of employment matters, and its reach invites establishment of employment-related controls.

Companies should recognize that there may be four distinct types of reports and corollary investigations flowing from those reports. First, there may be investigations of allegedly wrongful activity reported by a whistleblower. Second, a whistleblower may complain of retaliation alleging that an adverse employment action has resulted from a protected disclosure or participation in proceedings or investigations. Third, an attorney employed or retained by a company having publicly traded U.S. securities may report a securities law violation or fiduciary breach. Fourth, there may be a report of a violation of a publicly traded company's code of ethics for senior financial officers.

Preparedness for the diverse types of reports or complaints allowed, authorized, invited or required by Sarbanes-Oxley should be given high corporate priority. Depending upon the type of report, a different measure of attention will be required at the board, executive, managerial or supervisory level of the company. Policy statements or procedures should give clear guidance to assure appropriate business and/or legal awareness of reports and control to protect against civil or criminal exposure.

  • The company should maintain a centralized log to note and control the receipt of a whistleblower report or complaint of retaliation.

  • Officials and/or attorneys should be designated for the receipt of reports or complaints.

  • Communications concerning the report or complaint should be restricted.

  • Access to information concerning the report or complaint should be limited to those with a need to know.

  • Procedures should be established for the investigation of reports.

  • Confidentiality of documents and communications should be preserved.

  • Access to electronic and print data should be restricted.

  • A control list of communicators and recipients of information should be established.

  • Distribution and duplication of reports should be controlled.

  • A single summary of factual conclusions should be created.

  • Each copy of the final report should be numbered with a log showing the document number given to each recipient.

  • Depending upon the nature of the matter and the involvement of others, procedures should be established for communicating the decision to: (a) the board and/or management having a need to know, (b) the whistleblower, (c) investigators and interviewers and (d) witnesses providing information during the investigation.

  • After the decision, procedures should be followed to:
   (a)   Control communication of the report, investigation and decision.
   (b)   Control relations with the whistleblower who has continuing employee
          status as well as the whistleblower whose employee status has ended
   (c)   Control relations with witnesses and other participants in the
          investigation or decision.
   (d)   Address media and third party inquires.
* * * *

Developing procedures for receipt of whistleblower and retaliation complaints and the ensuing investigation and determination of merit may appear bothersome and burdensome. That initial reaction does not adequately account for the alternative to creating and maintaining an internal process for dealing with such matters. The whistleblower believing that an internal procedure is unavailable or unavailing may be motivated to seek redress by resort to administrative or judicial proceedings.

This is a time when companies are searching for ways to enhance their corporate images and conserve their financial and human resources and costs of litigation. Encouraging internal whistleblower reporting — and being prepared with appropriate investigative and decision-making procedures — may come at an attractive price, when the possibilities of involvement in external proceedings are weighed.