Among the many obligations created by the Sarbanes-Oxley Act, there has recently been increased attention to the requirement to implement a "hotline" for confidential and anonymous complaints to the audit committee from whistleblower employees. Although these procedures are not required until at least 2004, many companies are moving for early adoption to show good corporate governance.

Third party service providers are offering "one stop shopping" to address these legal requirements, but companies would be well advised to consider carefully these seemingly simple solutions before adopting them. While outsourcing may look like an easy alternative to show progress on early compliance, we believe it can pose significant risks and requires careful consideration prior to adoption.

"One-Size Does Not Fit All"

Congress and the SEC have provided little guidance to companies on what types of systems are acceptable to receive tips concerning accounting misdeeds. The SEC has not recommended that companies seek the assistance of third parties in managing hotline systems, and has in fact warned that a "one-size-fits-all" approach is not appropriate. It has clearly been left up to audit committees to decide what type of system will work best "to receive, retain and treat" confidential and anonymous complaints.

Many third party vendors have been touting their systems as "universal turnkey solutions" for Sarbanes-Oxley whistleblower compliance. Companies choosing this third party approach may face long term risks including:

1. loss of attorney-client privilege for key portions of the complaint handling process;
2. third party vendors may behave differently than the company or the audit committee in an SEC investigation or litigation setting when subpoenaed to present records or asked to present testimony;
3. vendor transcripts of complaints and other follow-up may lack the context provided by a detailed knowledge of the company and its business circumstances; and
4. a misleading scenario of a document trail that inadvertently looks like a "smoking gun" in a litigation or SEC investigation when taken out of context.

A thoughtful response to structuring and managing Sarbanes-Oxley whistleblower compliance can avoid these risks. Companies that choose instead to use internal staff combined with legal counsel can tailor an approach to receipt, review and handling of "hotline" complaints that has much lower risk of these unintended adverse consequences. The audit committee can use company resources and legal counsel to assist in the receipt and processing of complaints in a manner that preserves attorney-client privilege to the most critical sensitive evaluations and assessments of employee complaints and "tips" while still complying fully with the requirements of Sarbanes-Oxley.

Designing a Confidential and Anonymous Hotline or "Tip" Procedure: No Need to Reinvent the Wheel

There is no simple model on which all companies can pattern their hotline systems -- the circumstances of each company will dictate an appropriate solution. However, there are many companies and governmental agencies that have experience with confidential and anonymous hotlines in other areas including:

1. multi-national companies have been complying with Foreign Corrupt Practices Act since the late 1970s by developing programs where employees can report illegal payments and fraud;
2. defense contractors have been required by law since the 1980s to use hotlines;
3. companies have been creating internal reporting systems to minimize exposure to criminal penalties pursuant to the organizational sentencing guidelines since the early 1990s; and
4. many Federal governmental agencies, such as the Department of Defense, have elaborate hotline systems for reporting waste and fraud.

Who is on the Phone -- Chicken Little or Deep Throat?

For every legitimate tipster, there are countless disgruntled employees or third parties including short sellers that will attempt to access the hotline system for ulterior purposes. The hotline tip is only the first step in a process in which the audit committee must weigh and evaluate information. Tips that are detailed and specific will of course be more persuasive than general comments. The proper evaluation and handling of tips is a key component of an effective compliance system.

Audit committees are already overburdened with compliance requirements. Appropriate screening and processing of complaints is critical for the audit committee to separate meritorious complaints from those that are specious. Most audit committees will require some form of staff support to fulfill this screening role. Nothing in Sarbanes-Oxley precludes the audit committee from using company resources to provide this support so long as it can establish a process with a high degree of integrity. Indeed, long before the adoption of Sarbanes-Oxley, many public company audit committees have been required to oversee sensitive investigations into the same kinds of issues now being addressed under Sarbanes-Oxley.

The Role of Counsel

The audit committee should use legal advisors to assist in the evaluation of whistleblower complaints. To do so preserves attorney-client privilege over sensitive portions of the review process and can give the audit committee protection that it has invoked an appropriate level of diligence in processing the particular complaint prior to its resolution. Internal legal resources, or outside counsel (whether the company's regular outside law firm, or special counsel retained by the audit committee), may be appropriate depending upon the stage of the complaint and the level of the audit committee's review of its allegations. It is important to emphasize that any counsel acting to review complaints will be acting as counsel to the audit committee and will report to the audit committee rather than to some other part of the company. Special counsel may be appropriate where the complaint is considered to have potentially significant consequences or to involve conflicts of interest with management personnel. Again, there is no "one size fits all" solution to when to bring in special outside counsel for the audit committee.