Sarbanes-Oxley—10 Years Later

By Diane Cadrain Dec 26, 2012

In 2002, Congress enacted the Sarbanes-Oxley Public Company Accounting Reform and Investor Protection Act (SOX) in reaction to the type of malfeasance that produced the Enron and WorldCom scandals.

In 2010, in the wake of the fiscal meltdown that plunged the nation into recession, the Dodd-Frank Wall Street Reform and Consumer Protection Act updated SOX—as it has come to be known—and heightened corporate liability for retaliating against employees who blow the whistle on suspected illegality. Both laws make it easier for whistleblowers to come forward and more risky for employers to retaliate against them for having done so. Both laws bring significant responsibility to the HR desk.

Here’s a look at SOX, Dodd-Frank, and the current landscape of employer exposure to liability.

Creation of a bounty program. One of Dodd-Frank’s most momentous changes is the creation of a bounty program that provides significant financial incentives for whistleblowers. Under this program, if an employee voluntarily reports original information to the Securities and Exchange Commission (SEC) that leads to successful enforcement netting at least $1 million in sanctions, the employee may be entitled to anywhere from 10 to 30 percent of the sanctions. The incentive to report malfeasance to the SEC will likely increase the number of whistleblowers and discourage employees from reporting the violation to their employers first, unless companies set up user-friendly reporting systems that take employees’ complaints seriously and reassure them that they won’t suffer retaliation for coming forward.

Coverage of a broader range of employers. SOX applied only to publicly traded companies and their subsidiaries. Dodd-Frank covers all employers, not just public companies. That increases the need for all employers to put in place robust processes for handling whistleblower complaints.

Longer timeframe. Dodd-Frankput more elbow room in what many advocates thought were unreasonable timeframes provided by SOX. Under SOX, an employee who faced retaliation had 90 days to file a claim with the Occupational Safety and Health Administration (OSHA). Dodd-Frank doubled that to 180 days. For those who claim retaliation for participating in an SEC inquiry, the deadline to file a claim is now six years from the date of the violation or three years from the date the employee discovers the violation.

Leeway to go straight to federal court. SOX set up a process requiring employee-whistleblowers to go to OSHA with their complaints of retaliation. By contrast, Dodd-Frank allows whistleblowers to go straight to federal court, potentially resulting in higher litigation costs and greater financial exposure and reputational damage for employers.

Availability of double back pay. Potentially, SOX whistleblowers could recover back pay with interest. Dodd-Frank whistleblowers can obtain up to two times their back pay with interest.

Ban on arbitration agreements. Dodd-Frank barred employers from requiring employees to sign agreements—including severance agreements—that would require them to submit their complaints to arbitration, instead of taking them to the courts, the SEC or OSHA.

“Companies now have to look at their policies about these kinds of claims,” said Debra S. Katz of Katz, Marshall & Banks, which represents employee whistleblowers.

New standard for retaliation. Under Dodd-Frank, employees who complain to the SEC, and who experience retaliation as a result, are protected regardless of the validity of the underlying complaint. In other words, even if a complaint is groundless, the whistleblower is protected from retaliation for having complained to the SEC.

New line of employee-friendly rulings. An emerging line of employee-friendly rulings from the Administrative Review Board (ARB), a branch of the U.S. Department of Labor that handles appeals from SOX decisions, is reversing a prior employer-friendly trend that resulted in the dismissal of a significant number of claims.

Meg Campbell, a shareholder in law firm Ogletree Deakins, explains that prior trend.

“When SOX was initially passed, there was a concern that employees were going to be coming out of the woodwork with complaints,” she observed. “Over the next eight or 10 years, OSHA built up a body of case law with strict, disciplined definitions that resulted in dismissal of a significant number of cases on procedural grounds.”

“Whistleblowers who overcame [those] hurdles often lost because the ARB ruled that they didn’t engage in protected activity within the meaning of SOX,” said Katz. “That case law … chilled the very whistleblowing activity that SOX was intended to encourage.”

Then, in 2011, that trend changed with the ARB decision in Sylvester v. Parexel, ARB Case No. 07-123, ALJ Nos. 2007-SOX-39, 2007-SOX-042, which resoundingly reaffirmed the scope of the whistleblower protections of SOX. “The ARB has sent a clear message to would-be whistleblowers that SOX will provide them with real protection, and that corporations will be held accountable for their misconduct,” observed Katz. “Sylvester is undeniably a major victory for whistleblowers and the investing public who depend on them.”

More exposure for employers. The enactment of Dodd-Frank and SOX, combined with liberal interpretations of SOX from the Department of Labor, means a heightened exposure to liability for employers.

“This is a very sensitive, hot issue right now because of the monetary risks and the reputational risks to a company,” said Steve Pearlman, a shareholder in the Chicago office of law firm Proskauer Rose.

Creating a culture of compliance. “A culture of compliance pays off,” said Campbell. “Too often companies get defensive in response to complaints. It’s more effective to take the approach that the whistleblower is trying to do what the compliance process asks for. If HR embraces the whistleblower, that gives the company the opportunity to make the process work, find the problem, fix it, and report it if necessary. The HR/compliance officer needs to take every allegation seriously.”

Now is a good time to review and improve whistle-blower policies, observed David Jimenez, a partner in the Hartford, CT office of employer law firm Jackson-Lewis.

“It’s important for organizations to polish their internal reporting mechanism to make it user-friendly and easy to follow, or the employee will go to the SEC,” Jimenez said. “Employers have to make sure that their reporting process ensures employees of anonymity, protects them from retaliation, and specifies how it does so.”

Guarding against retaliation. An important reason for HR to be in the loop on Dodd-Frank and SOX compliance is to monitor any employment actions affecting employees who complain of corporate wrongdoing.

“When the anti-retaliation provisions attach, any employment actions have to have legitimate business justification,” said Campbell. “Someone with an educated eye has to look at any employment actions toward that person.”

In fact, Pearlman added, “the company should attach an HR liaison to all complainants, to help them gather information and monitor the process of their complaints, because if the employee feels that the company is sitting on its hands, or retaliating, that employee will go to the government or an attorney. This is a necessary step to minimize risk. HR should teach employees they should step up and complain, but internally. You want them to go to you first so you can investigate and put out the fire.”

Providing incentives for coming forward. In fact, Pearlman said, HR can supply an incentive for reporting internally by giving whistleblowers bonuses—a sort of counter-bounty to that created by Dodd-Frank. “If someone is acting in good faith, they should be rewarded, recognized and thanked,” he observed. “Whistleblowers need for their complaints to be acknowledged, given serious consideration. HR is well situated to exhibit compassion and understanding.”

Diane Cadrain is an attorney who has been writing about employment law issues for more than 20 years.

Job Finder

Find an HR Job Near You
Post a Job


Find the Right Vendor for Your HR Needs

SHRM’s HR Vendor Directory contains over 10,000 companies

Search & Connect