Among the many obligations created by the Sarbanes-Oxley Act, there has recently been increased attention to the requirement to implement a "hotline" for confidential and anonymous complaints to the audit committee from whistleblower employees. Although these procedures are not required until at least 2004, many companies are moving for early adoption to show good corporate governance.
Third party service providers are offering "one stop shopping" to address these legal requirements, but companies would be well advised to consider carefully these seemingly simple solutions before adopting them. While outsourcing may look like an easy alternative to show progress on early compliance, we believe it can pose significant risks and requires careful consideration prior to adoption."One-Size Does Not Fit All"
Congress and the SEC have provided little guidance to companies on what types of systems are acceptable to receive tips concerning accounting misdeeds. The SEC has not recommended that companies seek the assistance of third parties in managing hotline systems, and has in fact warned that a "one-size-fits-all" approach is not appropriate. It has clearly been left up to audit committees to decide what type of system will work best "to receive, retain and treat" confidential and anonymous complaints.
Many third party vendors have been touting their systems as "universal turnkey solutions" for Sarbanes-Oxley whistleblower compliance. Companies choosing this third party approach may face long term risks including:
Designing a Confidential and Anonymous Hotline or "Tip" Procedure: No Need to Reinvent the Wheel
There is no simple model on which all companies can pattern their hotline systems -- the circumstances of each company will dictate an appropriate solution. However, there are many companies and governmental agencies that have experience with confidential and anonymous hotlines in other areas including:
For every legitimate tipster, there are countless disgruntled employees or third parties including short sellers that will attempt to access the hotline system for ulterior purposes. The hotline tip is only the first step in a process in which the audit committee must weigh and evaluate information. Tips that are detailed and specific will of course be more persuasive than general comments. The proper evaluation and handling of tips is a key component of an effective compliance system.
Audit committees are already overburdened with compliance requirements. Appropriate screening and processing of complaints is critical for the audit committee to separate meritorious complaints from those that are specious. Most audit committees will require some form of staff support to fulfill this screening role. Nothing in Sarbanes-Oxley precludes the audit committee from using company resources to provide this support so long as it can establish a process with a high degree of integrity. Indeed, long before the adoption of Sarbanes-Oxley, many public company audit committees have been required to oversee sensitive investigations into the same kinds of issues now being addressed under Sarbanes-Oxley.The Role of Counsel
The audit committee should use legal advisors to assist in the evaluation of whistleblower complaints. To do so preserves attorney-client privilege over sensitive portions of the review process and can give the audit committee protection that it has invoked an appropriate level of diligence in processing the particular complaint prior to its resolution. Internal legal resources, or outside counsel (whether the company's regular outside law firm, or special counsel retained by the audit committee), may be appropriate depending upon the stage of the complaint and the level of the audit committee's review of its allegations. It is important to emphasize that any counsel acting to review complaints will be acting as counsel to the audit committee and will report to the audit committee rather than to some other part of the company. Special counsel may be appropriate where the complaint is considered to have potentially significant consequences or to involve conflicts of interest with management personnel. Again, there is no "one size fits all" solution to when to bring in special outside counsel for the audit committee.