JM - Society of Corporate Compliance and Ethics

issuer of concerns regardingquestionable accounting or auditingmatters.Basic features of this law includes:■ Procedures are needed foremployee complaints and forcomplaints from outside of theorganization■ The SEC final rule provides adeadline for compliance - listedcompanies must have thesewhistleblower procedures inplace by the earlier of (a) theirfirst annual shareholder's meetingafter January 15, 2004 or (b)October 31, 2004.■ The SEC chose not to specify anyrequired procedures for a complaintprocedure, citing a desireto maintain maximum flexibility.Each audit committee is expectedto establish an approach suitableto its circumstances.Disclosure and Record Keepingunder Sarbanes-Oxley■ Section 404 requires disclosureregarding the effectiveness of theinternal control structure in thecompany's annual report and theexternal auditor's report. Theaudit committee complaint proceduresunder § 301 should be consideredan integral component ofthe internal control structure suchthat summary information regardingthe procedures is referenced.■ There is no requirement thatcomplaint records must beretained. Section 404 implies thatthey must be kept for at least thenext fiscal year.■ Section 802 creates new criminalpenalties for any knowingdestruction or concealing of documentsto obstruct or influence agovernment investigation.Because an internal investigationfrom a whistleblower communicationmay be conducted in contemplationof a governmentinvestigation, an organizationshould suspend all ordinary documentdestruction practicesinvolving investigation of aSarbanes-Oxley complaint.Whistleblower Protections underSarbanes-OxleySarbanes-Oxley contains strong prohibitionson retaliating against anyoneproviding a good faith reporton questionable accounting orauditing practices:■ Section 806 gives employees theright to sue their employer forretaliation. Employees are firstrequired to file a charge with theU.S. Department of Labor. OSHAthen has 180 days to investigateand resolve the complaint.■ Employees involved in a Section806 protected activity cannot bedischarged, demoted, suspended,threatened, harassed or discriminatedagainst as a result of thatinvolvement. Civil remedies forviolations of Section 806 includeall relief necessary to make theemployee whole, such as backpay with interest and attorney'sfees.■ Section 1107 provides for criminalpenalties, including up to 10years in prison for retaliation.Designing the Mechanism: ControlConsiderationsAssessment of Existing ComplaintProceduresExisting structures should bereviewed to determine if they containkey features that can be adaptedto ensure compliance withSarbanes-Oxley. How are accountingand audit concerns currentlyraised and handled? Can employeesreport anonymously? How areissues reported to the Board?One consideration is whether a separateprocess for Sarbanes-Oxley §301 should be implemented. Amechanism specific to potentialaccounting and auditing complaintsmay prove efficient and also betterensure that such complaints areappropriately addressed. However,there are also risks to having multiplecomplaint systems. Employeesmay become confused as to whereto report and will need to be trainedto understand which process to usedepending on the concern beingraised. Staff handling the variousmechanisms will similarly need training,and safeguards will be requiredfor Sarbanes-Oxley matters that arereported through the wrong mechanism- a company is on notice andstill needs to ensure the complaint isrouted to the audit committee andproperly investigated.Selecting a Reporting MechanismThe SEC did not specify, and the lawContinued on page 10Society of Corporate Compliance and Ethics • (888) 277-4977 • www.corporatecompliance.orgFebruary 20059