In a letter the National Association of Corporate Directors sent to the SEC on Friday, the group protested the SEC's Dodd-Frank generated "whistleblower" provisions, which the group says encourage employees to bypass their own banks' compliance departments in their eagerness to inform the SEC of suspected foul play.
"Ethics and compliance rank highly among the characteristics needed in today's corporations, and a proper system for internal whistleblowing is vital to those causes," the group noted in its letter. But the new provisions "provide an incentive for persons having 'independent knowledge' of possible corporate wrongdoing to report directly to the SEC," the NACD says. "In NACD's opinion, the legislators who enacted the original provisions in the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 did not weigh the consequences the provisions could have on the ethical and compliance-based cultures of corporations."
Current attorney conduct rules in Section 307 of the Sarbanes-Oxley Act and in ethics rules of the American Bar Association require attorneys to report suspected legal violations "up the ladder." Additional rules under Sarbanes-Oxley (Sections 301 and 406) require that public companies have hotlines for reporting accounting concerns as well as codes of ethics supported by "prompt internal reporting to an appropriate person or persons identified in the code of violations of the code." "The new whistleblowing rules should build on these requirements for internal reporting," the NACD says. The rules should include a requirement for all employees to report to immediate supervisors prior to submitting complaints to the SEC.
The group notes that whistleblowing systems often elicit complaints about management matters best addressed by internal human resources professionals. "Such matters are not appropriate for SEC investigations conducted at taxpayer expense," the NACD says.
The SEC's rules do attempt to promote the use of internal systems by granting higher monetary rewards to whistleblowers who first report their complaints to the company, and to give companies some time to address problems internally before the SEC investigation begins. The rules also offer seven exceptions to the "independent knowledge" definition intended to promote the use of internal systems. But the NACD believes these exceptions do not go far enough to ensure the full use of internal systems. "With certain restrictions, any individual should be able to report suspected legal violations through an internal whistleblower system that includes the ability to report to the SEC," the group says. "Therefore, the rules should require individuals to make use of corporate compliance systems prior to submitting any allegations to the SEC."
The group also objects to the incentives for whistleblowers, in which people are "incentivized to avoid internal compliance systems and deal directly with the SEC."
The NACD's argument has a historical parallel. In the early days of Rome, regional governor Pliny the Younger asked Emperor Trajan what he should do with anonymous informers. Trajan responded, "Informations without the accuser's name subscribed must not be admitted in evidence against anyone, as it is introducing a very dangerous precedent, and by no means agreeable to the spirit of the age." Trajan said the accuser must face the accused and then Pliny was to decide the case.
The NACD has offered valid reasons why the SEC should not encourage whistleblowing for small-potatoes offenses. But there is another side to this. The past decade has shown us that there are firms in which corruption is rampant, and in which going to one's direct supervisor or internal compliance department is about as effective as telling a fox that the henhouse door is open. Perhaps the SEC could come up with rules that distinguish between minor ethics infractions, which should be reported internally first, and Madoff-style fraud that the SEC should hear about directly. (This is a flawed example because in the Madoff case, the SEC did hear about the Ponzi scheme directly but did not respond. But obviously, there's a huge difference between the types of behavior that should be reported to the SEC and that which should not, and the rules ought to make that clear.)