More Thoughts on Whistleblower Awards

Today let’s revisit the Justice Department’s whistleblower awards program, first announced 10 days ago. Since then we’ve all had time to contemplate the program’s implications, several of which deserve compliance professionals’ attention.

Let’s begin with the question most important to compliance professionals: Will the existence of this awards program drive would-be whistleblowers not to report their misconduct concerns internally, and instead take their concerns directly to regulators? 

Well, no. Indeed, in a roundabout way, the existence of the awards program might make whistleblowers even more likely to report internally first.

Think about it from the whistleblower’s perspective. You’re Employee X, and you’ve discovered a corruption scheme in the Latin America divisoin at your global business. You could bring that concern directly to the Justice Department, which might open an investigation, and four years later the company settles the matter for $50 million. You get 30 percent of that sum.

Or, you could report your Latin America concern to the company first. It launches an investigation and discovers corruption schemes are also happening in Asia and Africa, because a global-level sales executive is behind it all. The company self-reports to the Justice Department, and four years later the company settles with a $150 million penalty. You get 30 percent of that sum.

Several whistleblower lawyers described this scenario to me last week, and it’s not far-fetched. Employees often see one slice of the misconduct, but not the whole pie. If they report internally, and the company then self-discloses the whole pie to the Justice Department, the whistleblower stands to win an award based on the whole pie rather than the single slice he or she knew about. So why not report internally first and then reap the benefits of the company’s investigative legwork? 

Then again, perhaps it’s not so simple.

A Whistleblower Award Dead Zone

We could also envision an alternative scenario where the whistleblower reports internally first, and then puts a chain of events into motion that leaves him or her at a disadvantage.

Let’s go back to Employee X. He first reports his Latin America suspicions on the internal compliance hotline because he genuinely does want his employer to correct its problems, and then reports his concerns to the Justice Department too so he can claim those whistleblower retaliation protections just in case.

The company, however, is a paragon of ethics and compliance with no prior history of misconduct. It immediately self-discloses the issue to the Justice Department, fully cooperates in holding that global sales executive accountable, and implements far-reaching compliance reforms. Two years later the company gets a declination and only pays $28 million in disgorgement. The whistleblower gets 10 percent of that amount.

So the whistleblower tries to do the right thing by reporting internally first, and the company also tries to do the right thing — so well that the company secures a declination or non-prosecution agreement, with much smaller financial penalties (if any at all). That whole pie of misconduct we described earlier has now dwindled to the size of a corn muffin, to the whistleblower’s detriment.

Several whistleblower lawyers described that scenario to me last week, too. In fact, we should remember that under the Justice Department’s Corporate Enforcement Policy, declinations are the presumptive outcome for companies that voluntarily self-disclose, cooperate, and remediate. So this scenario is likely to be more common than the other two I described above where prosecution settlements are involved. 

What’s unclear to me right now is how much whistleblowers will actually engage in this sort of game-theory analysis before reporting to anyone. Whistleblower lawyers are certainly doing that, for sure; but I don’t know how many would-be whistleblowers engage counsel before they make that first report. But even the simple existence of whistleblower award programs does add a dimension of complexity that compliance officers would be foolish to ignore.

A Timeframe for Disclosure

We should also spend more time pondering the Justice Department’s new policy for voluntary self-disclosure credit. 

Specifically, if a company receives an internal whistleblower report and then self-discloses those allegations to the Justice Department within 120 days, and the Justice Department has not yet reached out to the company itself; then the company remains eligible for all the benefits of the voluntary self-disclosure program even if the whistleblower has already submitted the information to the department.

Why is that interesting? Because now we have a sense of how quickly you need to disclose an issue if you want credit for “prompt” voluntary self-disclosure: 120 days.

To be clear, the Justice Department has not expressly declared that 120 days is the deadline for prompt self-disclosure. (The Justice Department giving a clear answer on anything? Please.) But the policy shift does mean that if you don’t disclose within that 120-day window, you lose eligibility self-disclosure credit. 

So that’s what compliance and legal officers need to ponder here. Do you have a process to evaluate internal reports of criminal misconduct and make decisions about voluntary self-disclosure within 120 days? 

Inevitably some people will retort, “There’s no way we could complete an investigation and self-disclose within 120 days!” Well, nobody’s asking you to do both of those things. All you need to do is decide whether to disclose the existence of a potential issue within 120 days; the investigation itself could take longer. 

For all the limp noodles who still say it can’t be done, recall that back in 2019 Cognizant Technologies received an admirably small settlement ($25 million) for egregious FCPA violations involving two of its most senior executives. One reason the company received such a superlative result: because the company voluntarily disclosed the misconduct within two weeks of discovering it. Few companies will be able to move that quickly, but moving within four months is not an unreasonable ask from the Justice Department. 

The challenge for compliance teams is to build a process that can reach a disclosure decision within four months. Some of that will depend on basic investigative capabilities. Some of it will depend on bringing the right voices into the conversation, including the general counsel, outside counsel, senior management, and possibly the board. 

Companies would be wise to build that structure now, in the abstract, without an actual criminal misconduct allegation hanging over the company’s head. Otherwise you risk dithering for so long that you miss the 120-window, or rushing through so quickly that you reach the wrong conclusion. Neither one does your company any favors, especially with a whistleblower who might become so frustrated that he or she gives up and goes to the feds.