When to Blow the Whistle
(With Respect to a Private Organization)

John P. Beavers
Bricker & Eckler LLP
December 2006

The following is from a luncheon presentation by John Beavers at the annual Private Companies Conference of the Ohio Society of CPAs on December 7, 2006.

Although much has been written that organizations should encourage reporting of irregularities within an organization and that Federal law, as a result of the Sarbanes-Oxley Act of 2002, prohibits retaliation against those who report such matter to Federal authorities, not much has been written giving guidance as to when someone should “blow the whistle,” especially with respect to tax-exempt organizations and private companies.

Legally, “whistle-blowing” means reporting of an irregularity involving an organization either internally within the organization, which is referred to as “reporting up,” or externally to a regulatory or enforcement official or agency, which is referred to as “reporting out.” For example, Ohio’s and many other states’ statutes protecting whistle-blowers require the whistle-blower to “report up” to a superior before he or she is entitled to protection for reporting out a law enforcement or prosecuting authority.

The purpose of this article is to offer some guidance on when someone may be legally required to blow the whistle with respect to an organization. However, legal requirements determine only minimum standards with respect to whistle-blowing, so this article will also provide for consideration some best practice for the organization in dealing with whistle-blowing and for individuals deciding whether and how to blow the whistle.

General Rule

Generally, there is not legal liability for failing to speak, report, or “blow the whistle” unless there is a legal duty to speak. So, when do you have a legal duty to speak?

When Do You Have a Legal Duty to Speak?

When you have knowledge of a felony, it is a crime for you under Federal law not to as soon as possible make known the same to some US judge or civil or military authority. Similarly, it is a crime for you under Ohio and many other states’ laws knowingly to fail to report such information to law enforcement authorities. These are generally known as the “misprision” of a felony statute.

When making a written or oral statement under oath (or, for Federal law, under oath or penalty of perjury), it is a crime for you to make a false material statement that you know is not true. This includes not only when you are under oath for purposes of a court, legislative or administrative, but also during any deposition as well as many examinations by investigating or law enforcement authorities. For Federal law this includes many filings, such as tax returns, that are made under penalty of perjury.

So, you have a duty to speak when you have knowledge of a felony or you are under oath or penalty of perjury.

Absent knowledge of a felony or being under oath or penalty of perjury, whether you have a legal duty to speak generally depends upon your relationship to the organization and whether the relationship creates a fiduciary duty. Generally, being in any of the following four relationships results in fiduciary duties:

• Director or member of the governing board, you have a duty to speak when an ordinarily prudent person in a like position and under similar circumstances would speak.
   
• Officer, you have a duty to speak when an ordinarily prudent person in a like position and under similar circumstances would speak.
   
• In an expert or professional relationship, such as a lawyer, accountant, auditor, tax advisor, investment banker, etc., you have a duty to speak when an ordinarily prudent expert in your profession under similar circumstances would speak. Beginning February 1, 2007, a lawyer for an organization to report up to the highest authority of the organization when the lawyer knows or should know that an action, or refusal to act, (1) violates a legal obligation to the organization, or (2) is a violation of law that reasonably might be imputed to the organization and is likely to result in substantial injury to the organization.
   
• ERISA fiduciary, you have the duty to act for the exclusive purpose of providing benefits to participants and their beneficiaries with the care, skill, prudence, and diligence under the circumstances then prevailing that a prudent man acting in a like capacity and familiar with such matters.

In addition, fiduciary duties can be created by contract, including both the expressed terms of an employment agreement as well as those implied, such as impliedly agreeing to abide by an organization’s employment policies or its governing documents.

Ohio for-profit corporation law was amended in July 2006 to provide that, absent an agreement to the contrary, employees or vendors do not have fiduciary duties to an organization or its shareholders or creditors.

In summary, absent knowledge of a felony or being under oath or penalty of perjury, you do not have to speak or blow the whistle on your organization unless you are:

• A director or officer of the organization;
   
• In an expert or professional relationship with the organization, such as a lawyer, accountant, auditor, tax advisor, investment banker, etc.; or
   
• ERISA fiduciary.

What is Applicable in Sarbanes-Oxley (“SOX”)?

Only three provisions of SOX are applicable to constituents of private companies. No one may:

• Corruptly alter, destroy any record, document or other object, or conceal, or attempt to do so, in an official proceeding, or otherwise obstruct, influence, or impede the proceeding;
   
• Knowingly, with intent to retaliate, take any action harmful to any person for providing to a law enforcement officer any truthful information relating to the commission or possible commission of any Federal offense; and
   
• Knowingly alter, destroy, mutilate, conceal, cover up, falsify, or make a false entry in any record, document, or tangible object with the intent to impede, obstruct, or influence any federal investigation or bankruptcy proceeding.

As a result of SOX, the following are the key areas for detection and addressing of corporate fraud and abuse:

• Violations of law or breaches of fiduciary duty
   
• Misstatements in financial statements
   
• Fraud or deficiencies in internal controls

Although state law has always recognized that the highest authority of an organization is its governing board, SOX generally focuses on directors or board members who are independent of the organization as the highest authority.

SOX also created new reporting responsibilities for the chief executive officer, chief financial officer, and chief legal officer of any organization that is a public company.

What Are the Trends?

For the four year period before the 2006 elections with what were considered “business-friendly” Washington, D.C., and State of Ohio, there were more:

• Official proceedings investigating corporate fraud and abuse
   
• Self investigations internally by companies
   
• Difficulty negotiating settlements
   
• Prosecution of directors, officers, professionals or ERISA fiduciaries
   
• Disgorgement of profits or gain
   
• Barring from serving as director, officer or fiduciary of others

Many of us expect an exponential increase in investigations and prosecutions because of bi-partisanship in Washington, DC, and Ohio resulting from the election, especially as the 2008 elections approach.

What Are Some Best Practices for Consideration?

Legal duties, including the legal duties to speak, set only minimum standards for conduct. Better practices than those minimum standards should be considered by both the organization as well as any whistle-blower.

Considerations for the Organization

The organization should consider:

• Facilitating “porting up” within the organization. Irregularities can be most quickly and efficiently detected and addressed within the organization than by government authorities
   
• Permitting and facilitating anonymous reporting, but encouraging attribution. A report without knowing who is reporting it does not allow the recipient to evaluate the credibility of the source or of the report, both of which are important evaluations.
   
• Self-policing by testing for compliance.
   
• Sensibly delineating within the organization responsibility for investigating and addressing irregularities. For example, the chief financial office may be designated for receiving reports of irregularities involving financial statements, internal controls, accounting policies, and auditing or review process; the chief legal officer may be designated for receiving reports involving violations of law or breaches of fiduciary duty; and the head of HR may be designated for receiving irregularities involving employment matters. However, this designation should be consistent with the culture of the organization.
   
• Designating alternative channels for reporting of irregularities. An alternative channel or person should be designated for each type of reporting. Again, more than the main channel should be consistent with the culture of the organization. In each case, it may be the CEO, depending upon the organization’s culture. In other organizations, it may be the chief legal officer. 
   
• Involving legal counsel sooner than later for (i) protection of information and (ii) advice as to what constitutes a violation of law or breach of fiduciary duty, as to credibility of the evidence of such violations or breaches, and as to the materiality of the violations or breaches.
   
• Quickly and thoroughly investigating credibility of evidence and materiality of any irregularity.
   
• If a problem is found, remediating quickly with no tolerance for violation of laws or breach of fiduciary duties.
   
• Maintaining a written record of what was reported and to whom, how it was investigated, what was found, to whom it was reported, and how was it resolved.
   
• Self-reporting any violation of law to applicable government agencies.
   
• Cooperating with any applicable government agency.
   
• Providing independent counsel, paid by the organization, for any material witness. It is important that material witnesses are informed and remain comfortable with what they may be asked to do.

Considerations for the Whistle-Blower

The whistle-blower should consider:

• If you are involved more than as an observer, immediately seeking independent legal advice. Remember, self-reporting and cooperation will be viewed favorably by courts and government agencies.
   
• Reporting up before reporting out because courts and government agencies encourage internal investigations and remediation by companies.
   
• Reviewing Ohio’s whistle-blower statute (ORC §4113.52) because it generally requires reporting up in order to be protected for reporting out.
   
• In considering reporting up, determining to whom you are required to report, and in the case of doubt, report to (or copy) the organization’s legal counsel because an attorney for an organization has an obligation to report such matters up to the organization’s highest authority. Remember, the organization’s counsel, whether in house or retained, represents the organization and not you.
   
• If you report up, disclosing all that you know. Assuming that the information you disclose belongs to the organization which may or may not report it to the government without consulting you. Also assume the organization will ask for you to maintain confidentiality.
   
• Documenting your report in writing and with attribution.
   
• Asking if the organization will provide, and/or pay for, independent legal counsel for you.

Finally, remember that the standard by which you will be judged is what an ordinarily prudent person in a like position would do under similar circumstances.