Anonymous Submission of Suspected Wrongdoing (Whistleblowers)

PURPOSE OF THIS TOOL: A key defense against management override of internal controls is a process for anonymous submission of suspected wrongdoing (whistleblowing) that typically incorporates a telephone hotline. Respondents to a 2004 survey by the Association of Certified Fraud Examiners (ACFE) revealed that various forms of fraud are detected 40 percent of the time by tips, which made this the leading method for detecting fraud.¹ Although the Sarbanes-Oxley Act requires that confidential reporting mechanisms be made available only to employees,² opening the system to suppliers, customers, and others can increase the number of reports by approximately 50 percent.³ This tool is intended to assist audit committees in its evaluation of the entitys whistleblowing hotline.

To learn more about whistleblower laws and rights, see the document at http://fvs.aicpa.org/

Design effectiveness

In assessing the design effectiveness of the hotline, an audit committee should consider the following questions:

Does the hotline have a dedicated hotline number, fax number, web site, e-mail address, and regular mail or post office box address to expedite reports of suspected incidents of misconduct?

Does the hotline demonstrate confidentiality, including showing how caller ID, e-mail tracking, and other technologies cannot be used to identify the whistleblower? Has the entity considered use of an independent hotline operator to enhance the perception of confidentiality in addition to any real improvement?

Does the hotline utilize trained interviewers to handle calls to the hotline rather than a voice mail system?

Is the hotline availability 24 hours a day, 365 days a year?

Does the hotline have multi-lingual capability to support hotline callers with different ethnic backgrounds or that are calling from different countries?

Are callers provided with a unique identification number to enable them to call back later anonymously to receive feedback or follow-up questions from investigators?

Does the entity have a case management system to log all calls and their follow-up, to facilitate management of the resolution process, testing by internal auditors and oversight by the audit committee? For a sample tracking report that audit committees may use for this purpose, see http://www.aicpa.org/audcommctr/toolkitscorp/14.htm.

Has the entity established protocols for the timely distribution of each type of complaint, regardless of the mechanism used to report the complaint, to appropriate individuals within the company and to the audit committee and board of directors where appropriate? Are complaints of any kind involving senior management automatically and directly submitted to the audit committee without filtering by management or other entity personnel?

Does the entity effectively distribute comprehensive educational materials and training programs to raise awareness of the hotline among potential users? Are these materials available in all relevant languages given the potential user base and take into consideration cultural differences that may require alternative approaches to achieve the desired goal?

Does the entity support outreach to potential stakeholders other than employees?

Do the entitys internal auditors periodically evaluate the design and operating effectiveness of the hotline? What were the internal auditors conclusions regarding (a) how the hotline reflects changes in the companys operations and in best practices, (b) whether the hotline is receiving satisfactory support from management, employees, and other participants, and (c) whether protocols established for forwarding information to the audit committee have been followed?

Educating employees and others about the hotline

In assessing the whether management is actively promoting the existence and use of the hotline, an audit committee should consider the following questions:

Is confidentiality of communications made to the hotline stressed?

Is training provided to employees upon hiring and periodically thereafter?

Does employee training include issues related to the Sarbanes-Oxley Act and address issues such as accounting irregularities, insider trading, improper loans to executives, related party transactions, and conflicts of interest? Does the training emphasize that the Sarbanes-Oxley Act makes it illegal for the company to retaliate against an employee who reports accounting or auditing irregularities?

For suppliers, is information incorporated into a vendor approval process, in purchase contracts, and on purchase orders?

For customers, is information provided in sales contracts, invoices, and statements as well as in the customer service section of the companys website?

Is the hotline number and other contact information provided on the companys public web site, intranet, newsletters, invoices, purchase orders, pay stubs, checks, and even company vehicles?

Evaluating communications received

In evaluating the communications received, an audit committee should consider the following questions:

Is management taking all communications made to the hotline seriously? Are allegations appropriately investigated?

Does the entity have a process for reporting back to the whistleblower on a timely basis, where possible, the action taken?

¹ Association of Certified Fraud Examiners, 2004 Report to the Nation on Occupational Fraud and Abuse, (Austin, TX: ACFE, 2004), p 18.

² A whistleblowing hotline is now the statutory responsibility of the audit committee and cannot simply be delegated to entity officials. Section 301 of the Sarbanes-Oxley Act of 2002 requires that audit committees establish effective whistleblowing procedures, a statutory responsibility that they did not have before.

³ Association of Certified Fraud Examiners, 2004 Report to the Nation on Occupational Fraud and Abuse, (Austin, TX: ACFE, 2004), p 19.