Whistleblower Policies: Lessons For Associations (PDF-491kb)
Whistleblower Policies: Lessons For Associations
Association Law & Policy
Julia E. Judish
Establishing a written whistleblower policy is becoming a widely adopted practice among associations. However, not all policies are alike. The following lessons from associations illustrate how certain provisions in a whistleblower policy can lead to success or trouble.
In the wake of the Enron debacle and with the passage of the Sarbanes-Oxley Act, U.S. companies have increasingly adopted whistleblower policies as a mechanism for employees to report on financial and other wrongdoing. While only publicly-traded companies are required by Sarbanes-Oxley to establish "procedures for the confidential, anonymous submission by employees… of concerns regarding questionable accounting or auditing matters," many nonprofit associations have borrowed a page from the corporate sector in establishing whistleblower policies of their own. Indeed, the final revised IRS Form 990 for tax-exempt organizations for tax year 2008 asks whether the organization has a written whistleblower policy.1
Like traditional complaint procedures, the hallmark of whistleblower policies is guaranteeing protection against retaliation to employees who make good-faith complaints under the policy.2 Whistleblower policies, like harassment complaint procedures, also promise prompt and discreet investigations into employee complaints. Several characteristics, however, distinguish whistleblower policies from the complaint procedures that most employers already have in place for addressing complaints of discrimination or harassment:
Whistleblower policies cover complaints about financial improprieties, ethical violations, and other illegal activity.
Most whistleblower policies allow for anonymous complaints.
While most employee complaints are traditionally directed to an organization's human resources department, whistleblower policies provide for review outside the organization, such as by the audit committee of the board of directors.
Some whistleblower policies rely on third-party vendors to staff complaint hotlines.
These four characteristics create potential complications for associations enacting whistleblower policies. Using lessons learned from the actual experiences of my association clients, I offer the following best practices for developing and adopting whistleblower policies for associations.
Define the Limited Scope of the Whistleblower Policy
Because whistleblower complaints are often directed to board members or committees of the board of directors, they are a natural outlet for complaints centered on the chief officers or top management of an organization. When the complaints relate to misappropriation of organization funds or other illegal conduct, this use serves the central purpose of the whistleblower policy. I have seen an association board president discover an executive director's diversion of organization funds for the executive director's personal benefit, due to the whistleblower complaint of the executive director's executive assistant. Although the executive director's misconduct might have been identified later through normal channels for review of expenses, there is no question that the whistleblower policy provided a channel to highlight the wrongdoing and enabled the association to take appropriate action much more quickly.
In contrast to this success story, however, I have also seen boards embroiled in lengthy and expensive investigations of supposed whistleblower complaints that ultimately reflect nothing more than staff dissatisfaction with the executive director's style or policy decisions. While staff morale and internal disagreements about association policy are relevant to a board's oversight and review of an executive director's performance, such issues do not amount to allegations of illegal or unethical conduct. Whistleblower policies that are too broad in scope can force boards to devote considerable time and resources to unnecessary investigations. In addition to the drain on board member time and organization finances entailed in such investigations, the investigation process can strain relations between the board and the executive director.
As a corollary to this issue, the whistleblower policy should specify that complaints must be made in good faith. If the whistleblower policy is misused by an employee acting in bad faith or based on a grudge in order to stir up trouble for a disliked leader, disciplinary action is warranted. The good faith requirement does not deprive well-intentioned but mistaken employees of protection against retaliation for their complaints, however.
A whistleblower policy with a narrow scope does not mean that the board will never receive information on morale or policy disagreements. An active board can employ other measures to serve that purpose, including open-door visits by the board President to association headquarters, scheduled informational interviews by board members with a cross section of employees, or town-hall style meetings. These alternative sources of information do not necessarily entail lengthy and disruptive investigations.
Do Not Undermine the Association's Existing Infrastructure
Some illegal behavior may fall under both an organization's traditional complaint procedures and its whistleblower policy. Sexual harassment, for example, violates the law, but addressing harassment complaints usually falls to an organization's human resources department. Board committees are not equipped to take over this human resources function, except in unusual circumstances, nor is it healthy for the organization for its employees to bypass traditional complaint resolution mechanisms. Whistleblower policies should be carefully drafted to specify that the policy is not meant to supersede the organization's existing complaint procedures, unless the harassment or discrimination complaint involves the executive director, the general counsel, or the human resources director, or the complainant otherwise has reason to believe that existing complaint procedures are inadequate in the circumstances. Similarly, the whistleblower policy should not serve as an appeal mechanism for employees dissatisfied with the outcome of a properly investigated internal complaint.
Require Anonymous Complaints to Present Specific Facts
Many associations are far smaller than the publicly traded corporations subject to Sarbanes-Oxley, so employees may fear, with good reason, that the substance of their complaint alone will be sufficient for the target of the accusation to guess correctly the identity of the accuser. Nonetheless, allowing anonymous complaints that do not include hard facts places boards and general counsels in an untenable position. Because the complaint is anonymous, no follow-up inquiry is possible. Without specific facts that are capable of investigation, a board is paralyzed. It has been placed on notice of potential serious wrongdoing at the association, but it can take no action to address it because the allegations of wrongdoing cannot be verified.
In an extreme illustration of the pitfalls of anonymous complaints, several board members at an association client received identical, anonymous, typewritten letters. The sum total of the complaint was the single sentence: "B.D. and J.C. are bad." Although the board members could guess based on the initials (which I have changed here) that the accusation was directed at the organization's executive director and his deputy, they were naturally stymied at the meaning. Was this sent by an environmentally conscious employee appalled at the failure of organization leadership to recycle? Were the executive director and his deputy in cahoots to embezzle from the organization? The term "bad" could encompass anything from moral failings to legal violations to professional ineptitude. Although deeply unsettled by the accusation, the Board members had seen no indication in the performance of the two top officers that would justify the anonymous characterization. The Board members appropriately decided that the anonymous complaint did not fall within the scope of the whistleblower policy.
In this particular case, the anonymous complainant did not give up. A second set of anonymous letters arrived, this time accusing the executive director of having engaged in sexual harassment. The letter did not identify the victim(s), the nature of the alleged harassment, or when or where the harassment had occurred. While more specific than the first anonymous accusation, the complaint was still too vague to allow for traditional investigation. The board could not in good conscience institute an investigation in which employees were asked, "Are you aware of any acts of sexual harassment by the executive director?" The accusation might be entirely unfounded, and such questioning would inevitably raise speculation that would taint the reputation of a possibly innocent man. The Board again decided that the anonymous complaint did not fall within the scope of the whistleblower policy, although the board President decided to have a series of meetings with a cross-section of employees to ask open-ended questions about the direction and challenges facing the organization. Albeit not a formal investigation, this measure had a possibility of eliciting complaints about the executive director's conduct if that was a widespread employee concern. In fact, no such concerns surfaced.
As it happened, the anonymous complainant ultimately identified herself and supplied copies of emails in which the executive director had made inappropriate comments of a sexual nature. This evidence enabled the organization to conduct a full investigation, including an opportunity for the executive director to account for his conduct. The anonymous complaints thus did not represent unfounded attacks on the executive director. Without specific facts, however, the anonymous complaints did not serve their purpose. Thus, while allowing the option for anonymity is a significant element of many whistleblower policies, such policies must make clear that vague anonymous complaints will not be investigated.
Anonymous complaints provide an outlet for employees who do not want to become involved in an investigation to voice concerns, but invoking the whistleblower complaint mechanism entails accepting the responsibility to provide sufficient information to allow for an investigation. Similarly, the investigation into a whistleblower complaint may require employees who did not make the complaint to participate, even if they also would have preferred not to be involved. Whistleblower policies should specify that all employees are required to cooperate with any investigation by providing any requested information and by truthfully and fully answering questions. The policy should provide that failure to cooperate with an investigation is itself grounds for disciplinary action.
Third-Party Hotlines Are a Tool, Not a Solution
Twenty-four hour hotline services, staffed by external vendors, are popular components of many whistleblower policies. The fraud hotlines allow employees to report concerns during or after working hours, and hotline providers suggest that employees who might feel uncomfortable coming forward using internal reporting process may be more willing to use a third party hotline to report concerns. Association boards often prefer to use hotlines run by third parties to underscore the confidentiality of the complaints and to avoid having board members contacted directly by unhappy employees.
Third-party hotlines, however, cannot ultimately determine the validity of the complaint nor take corrective action, if warranted. Most forward complaints to the organization, to board committees, or to committees composed of board members and senior officers of the organization, depending on the subject of the complaint. A sexual harassment complaint, for example, might be routed to the human resources manager and/or the general counsel, while reports of financial irregularities will be directed to the audit committee of the board. It is critical, therefore, that the hotline staff have detailed, updated information about the composition and structure of the committees receiving the routed complaints. A whistleblower policy may well designate the executive director or the chief financial officer to be a member of the committee that investigates certain complaints. If the complaint implicates the executive director or the CFO, even just to the extent of accusing them of providing inadequate oversight, the hotline staff need to understand the organization well enough to ensure that those individuals are walled off from receiving the complaint.
Whistleblower policies have earned their status as one of the best-practice policies of associations.3 At their best, the policies help protect the organization from wrongdoing and promote high ethical standards. Such policies must be carefully drafted, however, to work well and to avoid unintended complications.
Julia E. Judish is counsel in the employment practice of Pillsbury Winthrop Shaw Pittman LLP in Washington, DC. Email: firstname.lastname@example.org
1 Form 990, Part VI, Section B, question 13. The Form notes that the Section "request[s] information about policies not required by the Internal Revenue Service." See Form 990 Redesign for Tax Year 2008.
2 Notably, Section 1107 of Sarbanes-Oxley protects employees of all types of companies, including nonprofits against retaliation for reports made to law enforcement regarding the commission of a federal offense.
3 While details of whistleblower policies may vary, implementing a whistleblower policy is widely viewed as a best practice in itself for non-profit organizations. See, e.g., Panel on the Nonprofit Sector's Principles for Good Governance and Ethical Practice: A Guide for Charities and Foundations. Establishing of a whistleblower policy is listed at number 10 of the top 33 best practices for charities and foundations. The Guide is available at http://www.nonprofitpanel.org.
(This article first appeared in Association Law & Policy, published by ASAE & The Center, July 2008.)
To read this publication in its entirety, click the link in the adjacent "Downloads" section.