|
By Gary Moulton
Illustration: Sandra Dionisi
 IN THE CORPORATE WORLD, BLOWING THE WHISTLE ON CO-WORKERS CAN BE RISKY BUSINESS BUT NEW LEGISLATION IS ABOUT TO CHANGE ALL THAT
It can be the honest employee's worst nightmare. No one is comfortable reporting on a colleague and everybody is terrified of speaking against his or her boss. But this was the situation Barry Collins faced a few months ago. A chartered accountant at the head office of major Canadian manufacturer East/West Ltd., Collins was reviewing the preliminary 2001 financial results for the company's western division when he noticed some unusual transactions booked right at the end of the fiscal year. One of these transactions involved a large sale to a particular customer whom Collins remembered from prior years because doubts had been raised over the customer's credit worthiness. In fact, East/West had, as a result, placed this dubious purchaser on a cash-on-delivery basis.
Collins investigated further and found more irregularities that ranged from "this time only" credit extended to the customer, to the western division accounts department fiddling with the date in which the revenue should have been booked, which turned the financial results of the division from a loss to a small profit. Concerned, Collins discussed the matter with sales executives and the accounting team, but got nowhere. He began to suspect this was a fraudulent transaction with a complicit customer aimed at improving the western division's 2001 financial results. He contacted head office and was ignored. Finally, he went to the company's legal counsel, who listened and then intervened to reverse the transaction before the misstated financial results were made public.
Collins felt very happy about what he had done, which possibly averted a financial scandal. In ideal circumstances, he would have been rewarded, but it was not to be in this case. He was, in fact, punished for whistle-blowing. His bosses interrogated him constantly about his performance, he was transferred to a different role that was essentially a demotion, he was shut out from the company's most sensitive financial data and moved from his office into a cubicle. Feeling like a pariah, he eventually quit. The Collins story is in a sense fictional; it is a composite of actual whistle-blowing events in Canada and the US. Unfortunately, stories like Collins' are not uncommon. Whistle-blowers have long suffered retaliation for exposing corporate malfeasance. Many people fail to come forward with what they know because they are afraid of retribution.
A recent US Conference Board survey on ethics found that, while many surveyed firms had whistle-blowing hotlines for employees, a majority of executives believe that fear of retaliation was a big issue in their company. Only a small number believed their companies had a culture of dissent where employees can openly speak their minds.
Recent world events, however, may be changing the way in which the corporate world treats whistle-blowers. The events of September 11 and the corporate accounting scandals at Enron and WorldCom, have raised the profile of the corporate whistle-blower and led to laws that protect them from retaliation. Legislators in both Canada and the US are creating laws to deter and detect corporate fraud. Included is legislation that protects staff that communicate concerns about their fellow employees. As a result, employees and others are becoming more comfortable with blowing the lid off corporate malfeasance.
Time magazine named 2002 as the Year of the Whistle-blower and featured a cover story on three courageous women who blew the whistle on their employers: Cynthia Cooper (WorldCom), Colleen Rowley (FBI), and Sherron Watkins (Enron). The story noted these three women took huge professional and personal risks to make public what went wrong at their particular organizations. Watkins warned that Enron's accounting methods were improper. Cooper informed WorldCom's board that the company had covered up substantial losses through phony bookkeeping and Rowley reported on how the FBI failed to heed early warning signals about the need to investigate a person who is now indicted as a September 11 conspirator.
The most common and frequent way of detecting fraud is through tips from employees, vendors and others involved in corporate activities. Sometimes whistle-blower communication is anonymous. It can be an unsigned note that's slipped under the CFO's door or an anonymous letter alleging fraud or corruption mailed to the company president. These letters are often written by someone who is close to the corporation with specific knowledge of fraudulent or unethical transactions. Sometimes the anonymous submission outlines suspicions that a senior company official is stealing. Such communication usually indicates it has been sent by an employee. Anonymous submissions alleging a payoff or kickback is required to be successful on a contract are most likely sent by an unsuccessful bidder.
"Employees are often in the best position to spot fraud," says Tim Williams, vice-president, corporate security of Nortel Networks and co-author (with W. Steve Albrecht and Gerald W. Wernz) of Fraud: Bringing Light to the Dark Side of Business. Williams notes that, as the majority of corporate fraud is perpetrated by employees, it makes sense that co-workers will eventually figure out what is happening. "But employees are often hesitant to come forward with this kind of information for a number of reasons," Williams says. "Sometimes it isn't possible to know for sure if a fraud has occurred. The tipster sees red flags but not actual proof." For example, an employee may see a manager who appears to be living beyond his means or will see aspects of a particular business transaction that he doesn't understand. "Whistle-blowers may also be concerned about reprisals. They may feel intimidated by their superiors ... or may feel that the organization does not make it easy to bring forward their suspicions."
Williams reports that Nortel set up an employee hotline in the United States in 1990 and says it has been very effective overall. "Only one percent of callers wish to remain anonymous." He believes strongly that employees should have every avenue made available to them to report suspicions of misconduct. Each call needs scrutinization and follow-up.
"Setting up a process for employees to report suspicions was an important step in reinforcing in their minds the corporation's sincerity in trying to obtain information about possible wrongdoing," says Williams. "We also established an aggressive investigation process. It's easy to talk about investigating and resolving issues as they appear, but it is quite another matter to ensure that the process is discreet, professional and fair." According to Williams, that requires constant communication and interplay between the legal department, internal audit, corporate security, human resources and line management. Working as a team, they must be able to demonstrate to employees that they take reported incidents seriously and will also seek to resolve them fairly. "You don't want to make the mistake of setting up an employee hotline without considering what to do with the information once you get it. We made sure our entire program — from the code of conduct to employee feedback and investigation — is tightly linked."
What types of red flags cause employees to suspect fraud and eventually blow the whistle? Usually symptoms of fraud can only be detected by employees who have been diligently watching for some time. Consider the predicament facing two clerks in the accounts payable department of a Canadian municipality. They were responsible for processing supplier invoices for payment and noticed that the municipality annually bought more than $100,000 worth of stationery, pens, pencils and other items from one supplier, Office Supplies Ltd. (not the company's real name). The clerks' radar eventually began to beep when they realized that they had never been visited by a salesperson, had not received a product catalogue, a price list or even a Christmas card from the supplier. They also noticed the invoices had only a post office box number as an address. When they dialed the telephone number on the invoice, they discovered it belonged to an auto-body repair shop.
When the clerks raised their concerns with their supervisor, he assured them he would look into the situation. A couple of weeks passed. The clerks had noticed the phone number on new invoices from Office Supplies had changed. This time when they dialed the number, they got a recorded message: "Sorry we are not in right now, please call back later."
There were a number of other worrying details, including that all Office Supplies invoices were approved for payment by the same employee, someone the clerks knew was a friend of their supervisor.
The clerks concluded their boss must be involved in a fraud with his friend and Office Supplies. Brushing aside fears of retribution, they notified the municipality's treasurer about their concerns. Investigative and forensic accountants and the local police were brought in; the evidence they accumulated, presented at the criminal trial, established that Office Supplies was a phantom supplier created by the accounts payable supervisor with the sole purpose of fraudulently extracting money from the town.
The proliferation of corporate fraud scandals that have occurred within the past several years has prompted US and Canadian legislators to provide additional protection to employees who blow the whistle on corporate misconduct. In the US, the Sarbanes-Oxley Act deals with this issue. Besides new regulations concerning corporate ethical conduct and the responsibility of organizations to monitor the conduct of their employees, the act also provides protection to employees who disclose information about corporate misconduct that violates any provision of US federal law relating to fraud or Securities and Exchange Commission rules. All publicly traded companies, their officers, employees, contractors, subcontractors and agents of these companies are subject to the act and may not "discharge, demote, suspend, threaten, harass, or in any other manner discriminate" against an employee protected by the act.
The Sarbanes-Oxley Act also mandates that publicly traded companies ensure that proper policies and procedures are put in place in order to address whistle-blowing complaints as well as to provide education to management, supervisors and executives concerning the recent whistle-blowing provisions. Section 301 (4) of the act requires that each audit committee establish procedures for the receipt, retention and treatment of complaints that are received by the company concerning accounting, internal accounting controls or auditing matters; and the confidential and anonymous submission by employees of concerns regarding questionable accounting or auditing matters.
In June, the Canadian federal government introduced a bill into the House of Commons designed to detect, prosecute and to deter capital markets fraud. The bill also deals with the problem of job-related intimidation that is suffered by whistle-blowers, and it is designed to protect those employees who take certain steps to expose wrongdoing by prohibiting threats or retaliation against them.
"There is no question that recent legislative initiatives will help spur an increase in whistle-blower allegations," says Kelly Friedman, a Toronto-based lawyer at Ogilvy Renault. Friedman has been frequently retained by audit committees and others to investigate whistle-blower complaints. "A lot of times, many employees within an organization, as well as others on the outside, become aware of illegal or unethical conduct –– for example, employees who are receiving kickbacks from suppliers. It's important for companies to build into their governance structure an appropriate mechanism for all such matters to be brought to the attention of the appropriate people. This should generally be the audit committee or another subcommittee of the board."
In their book Integrity in the Spotlight: Opportunities for Audit Committees, Jim Goodfellow and Maureen Sabia state audit committees should ensure that proper procedures have been established for whistle-blowing communications. These can include setting up employee hotlines through telephone, e-mail or website to facilitate anonymous submissions from employees and others. Sabia and Goodfellow note that it is not the role of the audit committee to establish and carry out such procedures; rather, the committee's role is to ensure that communication procedures appropriate to the size of the company, the business and circumstances have been established.
The audit committee needs to assess whether the company's culture and the tone at the top set by the CEO and CFO encourages or inhibits such communication. The audit committee should be satisfied that the recipient of whistle-blower communications is sufficiently independent of management. For example, the chief internal auditor or general counsel should have appropriate authority to investigate any matter and any person. The recipient of such complaints or concerns should have direct access to the audit committee and its chair and should report regularly. The reporting should include a summary of complaints, the nature of the complaints, any trends noted and complaints involving senior management, questionable business practices, intimidation of employees or auditors and possible fraud or illegal acts.
So just how ready are companies to deal with the expected increase in whistle-blower communication? A recent Deloitte & Touche survey of Fortune 1000 companies indicated that 85% of those surveyed had a method in place to accept internal complaints and 60% said they had a method in place to accept external complaints. The companies include those that utilize an internal method of collecting complaints and also that use a third-party administered system. The most-favored method was the telephone hotline, followed by e-mail and website.
The company's general counsel was the person most often responsible for receiving and validating complaints representing 62% of the respondents. This was followed by the internal auditor (29%), governance/compliance officer (24%), corporate secretary (5%) and risk officer (2%). In the remaining 10%, others were responsible including an outside third party, human resources, board or audit committee members.
When it came to actually investigating the complaints, the same pattern of results was noted. Leading the way was the general counsel (69%) and internal auditor (51%), followed by risk officer (7%) and corporate secretary (3%). In 17% of respondents, someone else was responsible for investigating complaints, including corporate security, human resources and the board or board committees.
According to Luc Vanneste, senior vice-president and chief auditor of the Bank of Nova Scotia, which as an issuer of US securities is subject to Sarbanes-Oxley, revised policies and procedures around whistle-blowing were presented to the bank's audit committee and board in the fall of 2002. Based on prior experience, the internal audit group had traditionally dealt with whistle-blower incidents at the bank so the board approved formalizing the chief auditor as individual responsible for handling complaints.
In the opinion of Vanneste, the whistle-blowing function cannot work if employees don't have an appropriate comfort level with the senior executives dealing with their complaints. "I'm very hands on related to whistle-blowing complaints," says Vanneste. "An employee with a complaint can talk to me on a completely confidential basis. Protecting employees in this situation is absolutely paramount." Last fall, the bank communicated to employees new policies and procedures on how to raise whistle-blower complaints.
Vanneste passes on the investigation of specific complaints raised by whistle-blowers to an appropriate member of his internal audit group to coordinate the investigation. That person reports directly to Vanneste at all times. If he believes that internal audit's resources need to be bolstered for certain types of investigations, he can turn to others within the organization like the corporate security group or he can retain outside assistance, such as forensic and investigative accountants. With regards to communicating with the audit committee, Vanneste discusses whistle-blowing complaints and investigations with the bank's CFO and they determine which specific complaints and investigations need to be brought to the attention of the audit committee. According to Vanneste, the process is working very well.
Regardless of the rules and regulations around whistle-blower protection, an understanding of human nature and critical interviewing skills will often dictate the level of cooperation by employees during an investigation. Ogilvy's Friedman notes that the more junior an employee is, the less he or she is likely to blow the whistle. On the other hand, more senior personnel often have a crisis of conscience and are willing to talk more freely. They often feel more secure, but even so, sometimes the facts aren't gleaned until the last minute. She recalls receiving valuable information concerning inappropriate conduct from an employee's exit interview on his last day of work before retiring. This person was a 30-year company veteran and wanted to come clean with what he knew before retiring.
Friedman also notes that it's often difficult to get interviewees to name names. Instead, the person may provide general comments about the wrongdoing and tends to say things like "You should look in that department." One of the benefits of a company launching an in-depth investigation into a whistle-blower complaint is that employees with information become bolder and more likely to bring the matter to light.
Friedman says if an organization properly structures its whistle-blowing mechanisms and policies and procedures — in other words, creates a system in which everyone feels empowered to come forward — retaliation against whistle-blowers shouldn't be an issue. "After all, unethical business conduct should be ferreted out as it's in the best interest of both the company and its employees."
Given that whistle-blowers are often reluctant to come forth, investigators should always be on the lookout for people who are dying to talk but have no corporate outlet. Richard Lederman and Andrew McKendry, both employed in Deloitte & Touche's forensic accounting practice in Toronto, recall a recent corporate investigation where they interviewed such a person. They were investigating a series of contracts between a client and a supplier. The client had given the supplier a significant amount of work and wanted to make sure that the supplier was charging appropriately for its services. "As a particular manager at the client was responsible for supervising the supplier relationship, we decided to interview some of the manager's staff to further enhance our understanding of the client-supplier relationship," says Lederman.
McKendry says, "One of the staff we interviewed started giving us some vibes indicating she had more concerns about the supplier than she was letting on. She noted we were taking extensive notes and asked if we could go off the record. She didn't want her name associated with what she was about to allege, but she had concerns that had been bugging her for two years."
She told them the manager, her direct boss, and the principal of the supplier were buddies. There were rumours that her manager and the supplier were in business together, unbeknownst to their client. She ended up giving Lederman and McKendry a lot of information they were able to investigate further. "It turned out there were some real concerns about the supplier's relationship with her manager that needed to be explored," says Lederman. "At the end of the interview, she said her husband would be proud of her."
"It was obviously a relief to have someone she could talk to about her concerns," says McKendry. "She didn't feel comfortable talking to anyone at the client about these issues because she was afraid of retribution by her manager. But the situation bothered her so much that she talked to her husband about it on several occasions"
The whistle-blowing situation is much the same in small, privately held enterprises. Consider the case involving two individuals who owned and operated a meatpacking business in Ontario. Financial statements presented to the meatpacker's bank showed all was well. The bank, which loaned against the security provided by the meatpacker's accounts receivable and inventory, was shocked to learn the financial statements it relied on were false. The owners had been falsifying sales and inventory records for years.
It all started when the owners decided they needed more financing and engaged in a scheme whereby they would pre-bill customers for shipments not yet made. In no time, they were recording phony sales invoices resulting in a fraudulent overstatement of accounts receivable. They also falsified inventory records to make it look like more inventory was on hand than was the case.
The owners went to great lengths to perpetuate the fraud. When bankers and auditors visited the meat packer's premises to check on inventory, they were told by employees that the meat locker, which was several rows across and deep, was full of meat. In fact, only the first row was full and it was so stuffed it was physically impossible to see past it. Had the bankers and auditors been able to see the rest of the meat locker they would have seen it was empty.
Several warehouse and accounting department employees were aware of the scheme, but in a peculiar twist on the usual whistle-blowing scenario, the owners of the plant blew the whistle on themselves. They decided the stress of continuing the fraud was too great and confessed to the scheme.
New legislation and increased corporate awareness has been leading companies to ensure that mechanisms are in place to enable employees to report fraud without retribution. There is no doubt that some employees may see a lot of this as lip service, and of course, such fears cannot be dismissed because there are lots of ways in which companies can covertly bring retribution down on employees. However, the key factor is that such retribution will now be a criminal offense. Once employees start to see punishment meted out, they will begin to come forward. Employees will feel they are empowered and protected, hence, the corporate world can expect the number of complaints will increase. Law enforcement, legal counsel and investigative & forensic accountants will be kept busy in the future investigating and resolving these complaints.
Gary E. Moulton, CA.IFA, is a partner in the dispute consulting and forensic services group at Deloitte & Touche in Toronto. He specializes in employee fraud investigations, including those brought to light through whistle-blowers. He is one of approximately 200 Canadian CAs granted specialist designation in investigative and forensic accounting by the CICA. | 
