SOX's Section 806: Is the Corporate Whistleblower Any Safer?

Five years after SOX's passage, the scope of the whistle-blower protection section might still be uncertain. Fraud examiners need to know the latest discussions and litigation on the 90-day deadline, private companies responsibilities, and proving a case.

Troubled by certain questionable practices he has discovered in the company's accounting department, John Sentinel approaches his supervisor. John explains what he's discovered and discusses his belief that certain practices in the accounting department are improper and probably illegal. His supervisor indulges John and says he'll look into it. A short time later, John's supervisor tells him there's no longer room for him at the company, and he has two weeks to find another job. Understandably disappointed with the company's action and believing his termination is directly tied to his report of accounting misconduct, John resorts to protection afforded by the Sarbanes-Oxley Act by filing a complaint against the company under Section 806. As we'll see, resolution of that complaint will depend on several things, not the least of which is the timing of John's action.

When the U.S. Congress passed the Sarbanes-Oxley Act on July 30, 2002, it imposed a measure of control on corporate conduct hoping to ensure that public companies behave as good corporate citizens. SOX includes detailed, some would say onerous, requirements pertaining to record-keeping, accounting, internal controls, public disclosure and transparency, and heightened reporting and certification standards, among others. But SOX doesn't stop there. Directors, officers, fraud examiners, internal auditors, accountants, loss prevention analysts, and others must beware: much is at stake.

PROTECTING THE WHISTLE-BLOWER 

SOX recognizes a specific type of whistle-blower -- the corporate fraud variety -- and imposes substantial civil (and criminal) penalties on companies (and their officers) that retaliate against them:

(a) WHISTLEBLOWER PROTECTION FOR EMPLOYEES OF PUBLICLY TRADED COMPANIES “No company with a class of securities registered under section 12 of the Securities Exchange Act of 1934 (15 U.S.C. 78l), or that is required to file reports under section 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. 78o(d)), or any officer, employee, contractor, subcontractor, or agent of such company, may discharge, demote, suspend, threaten, harass, or in any other manner discriminate against an employee in the terms and conditions of employment because of any lawful act done by the employee:"
  (1) to provide information, cause information to be provided, or otherwise assist in an investigation regarding any conduct which the employee reasonably believes constitutes a violation of section 1341, 1343, 1344, or 1348, any rule or regulation of the Securities and Exchange Commission, or any provision of Federal law relating to fraud against shareholders, when the information or assistance is provided to or the investigation is conducted by:
    (A) a Federal regulatory or law enforcement agency; (B) any Member of Congress or any committee of Congress; or (C) a person with supervisory authority over the employee (or such other person working for the employer who has the authority to investigate, discover, or terminate misconduct); or
  (2) to file, cause to be filed, testify, participate in, or otherwise assist in a proceeding filed or about to be filed (with any knowledge of the employer) relating to an alleged violation of section 1341, 1343, 1344, or 1348, any rule or regulation of the Securities and Exchange Commission, or any provision of Federal law relating to fraud against shareholders.

Section 806 protects employees who provide information to authorities in the executive branch, to Congress, or to the employer, that the employee reasonably believes shows the employer violated federal laws against shareholder fraud.¹ SOX, in short, prohibits retaliation against corporate fraud whistle-blowers. Five years after its passage, what does that mean and what have we learned?

YOU'RE DISMISSED 

Before corporate fraud whistle-blowers (or sentinels as the ACFE calls them) can file suit against their employers for retaliation, they must satisfy a number of administrative requirements. Foremost among those requirements, a corporate fraud whistle-blower must file his 806 complaint with either the secretary of labor or OSHA area director within 90 days of the alleged retaliation.² If a corporate fraud whistle-blower misses that 90-day deadline, nothing else matters -- being late by as little as a single day precludes the Department of Labor from awarding any relief and deprives federal district courts of jurisdiction over a suit brought under 806.³  

Perhaps the most critical lesson to be learned from early 806 litigation is the rigidity with which this requirement is applied. Federal courts and the Department of Labor have resoundingly clarified that the 90-day deadline will be strictly enforced. In Walker v. Aramark Corp., for example, Walker's complaint was properly dismissed "[b]ecause Complainant's first contact with OSHA was 105 days after his termination." ⁴ And in Flood v. Cedant Corporation OSHA dismissed a complaint that was filed 84 days after Flood's termination because it was at least 95 days after Cedant told Flood he would be fired as of a particular date.⁵ As the administrative law judge explained, "the limitations period commences once the employee is aware or reasonably should be aware of the employer's decision."

It's important to recognize this limitation on the company's risk exposure. Both the whistle-blower and the company must be aware of the 90-day deadline and when it expires. Obviously, they must determine what triggers the 90-day clock. Unhelpfully, the statute vaguely requires the employee to file within 90 days of "the date on which the violation occurs."⁶ The implementing regulation, though, provides that an alleged violation occurs "when the discriminatory decision has been both made and communicated to the complainant." ⁷ This clarification is consistent with the Flood decision and with the Department of Labor's commentary on the regulation:

The alleged violation is considered to be when the discriminatory decision has been both made and communicated to the complainant. ... In other words, the limitations period commences once the employee is aware or reasonably should be aware of the employer's decision.⁸  

So the 90-day filing deadline might start to run before the employee actually suffers the adverse personnel action.⁹  

Faced with the prospect of being completely barred from any recovery under 806, corporate fraud whistle-blowers have resorted to arguing that the 90-day clock should be pushed back or extended to give them some additional time to file their 806 complaints. This argument hasn't met with great success. While the Department of Labor's Administrative Review Board (ARB) has recognized the possibility of extending the deadline in certain limited instances, that's the rare exception rather than the rule.

Merely showing, for example, a lack of prejudice isn't enough nor is the employee or his attorney's lack of familiarity with SOX. As the ARB succinctly put it, "ignorance of the law will generally not support a finding of entitlement to equitable modification."¹⁰ Instead, the ARB has identified three instances in which equitable tolling may be appropriate:  

  (1) [when] the defendant has actively misled the plaintiff respecting the cause of action;
  (2) the plaintiff has in some extraordinary way been prevented from asserting his rights; or
  (3) the plaintiff has raised the precise statutory claim in issue but has mistakenly done so in the wrong forum.¹¹  

The employee in all events bears the difficult burden of proving that the 90-day deadline should be extended.¹²  

Putting all this together, the first five years of 806 litigation shows that the 90-day filing deadline will be strictly enforced, that the 90-day clock starts with notice to the employee of the adverse action, and that equitable exceptions likely will be few. This obviously affects a company's risk assessment and management, and other strategic decisions.

PRIVATE COMPANY EXPOSURE 

Officers and directors of private companies -- and those assessing risk, conducting fraud examinations, and auditing books -- shouldn't turn a blind eye to 806. By SOX's very nature, driven by its focus on public accountability and risks to shareholders, many might initially assume, not altogether unreasonably, that it only applies to publicly traded companies. That assumption, however, might be misguided. Private companies might, in fact, be subject to 806 under one of two theories. First, 806 specifically encompasses individual officers, employees, and agents of the publicly traded company as well as the publicly traded company's contractors and subcontractors.¹³ Private companies might be subject to 806 when performing contract work for publicly traded companies.

Second, a private subsidiary of a publicly traded parent might be subject to 806 solely because of that relationship. The question remains unresolved because the ARB, reversing a judge's dismissal but declining to answer the question, held that its prior cases "did not have occasion to discuss whether a non-public subsidiary of a public parent could be covered under the Act." ¹⁴ Thus, non-public subsidiaries of public parents shouldn't ignore the lessons learned from early Section 806 litigation.

NOW PROVE IT 

Once an employee satisfies his threshold obligation of timely filing a complaint with the Department of Labor or OSHA against an employer subject to 806, he must still prove his case. At its most basic, to prevail, a SOX complainant must prove by a preponderance of the evidence that: (1) he engaged in a protected activity or conduct; (2) the respondent knew that he engaged in the protected activity; (3) he suffered an unfavorable personnel action; and (4) the protected activity was a contributing factor in the unfavorable personnel action.¹⁵ Therefore, speaking generally, the employee must blow the whistle on corporate fraud by reporting his concerns to a person with supervisory authority (or participating in an investigation); he must then suffer employment action that either tangibly impacts his job or would, from an objective perspective, dissuade employees from complaining.And his whistle-blowing must have been a factor tending to influence the decision. The bar isn't high in that respect. But even if the employee proves each of these elements, the employer might still avoid 806 liability by demonstrating with clear and convincing evidence that it would have taken the same action in the absence of the employee's protected activity.¹⁶  

THE RISK IS REAL 

Public and private companies -- and their directors, officers, fraud examiners, internal auditors, accountants, loss prevention analysts, and others -- should appreciate the risks presented by 806, and its impact on company decisions. If nothing else, the first five years of 806 litigation has emphasized those risks and the broad scope of the statute. SOX has provided fertile ground for public commentary, dispute, and litigation. Recently, talk of modifying the statute and curtailing some of its more costly requirements has escalated. But none of those possible modifications appear targeted at the whistle-blower protection provisions of 806. Therefore, corporate decision-makers and risk analysts mustn't ignore the impact of Section 806 and the potential litigation companies might face.

Floyd R. Hartley Jr., J.D., is a partner with Hughes Luce LLP in the Dallas, Texas, office. He concentrates his practice on civil litigation and white-collar matters in federal and Texas courts. Hartley has extensive experience in whistle-blower claims.

References 

1 Halloum v. Intel Corp., 2003-SOX-7 at 10 (Mar. 4, 2004) (citing 29 C.F.R. 1980.102(b)(1)).

2 18 U.S.C. 1514A(b); 29 C.F.R. 1980.103(c), (d).

3 Murray v. TXU Corp., 279 F. Supp. 2d 799, 802 (N.D. Tex. 2003).

4 2003-SOX-22 (Aug. 26, 2003).

5 2004-SOX-16 (Feb. 23, 2004).

6 18 U.S.C. 1514A(b)(2)(D).

7 29 C.F.R. 1980.103.

8 69 Fed. Reg. 163 at 52106 (Aug. 24, 2004).

9 Lawrence v. AT&T Labs, 2004-SOX-65 at 5-6 (ALJ Sept. 9, 2004).

10 Moldauer v. Canandaigua Wine Co., ARB Case No. 04-022 at 6 (ARB Dec. 30, 2005).

11 Harvey v. Home Depot U.S.A., Inc., ARB Case No. 04-114 at 16-17 (ARB June 2, 2006).

12 Carter v. Champion Bus Lines, Inc., ARB Case No. 05-076 at 7 (Sept. 29, 2006).

13 18 U.S.C. 1514A(a).

14 Klopfenstein v. PCC Flow Technologies Holdings, Inc., ARB Case No. 04-149 (May 31, 2006).

15 Henrich v. Ecolab, Inc., ARB Case No. 05-030 slip op. at 9 (ARB June 29, 2006).

16 See, e.g., Halloum v. Intel Corp., ARB Case No. 04-068 at 6 & 8 (ARB Jan. 31, 2006); Harvey v. Home Depot U.S.A., Inc., ARB Case No. 04-114 at 10 (ARB June 2, 2006).

The Association of Certified Fraud Examiners assumes sole copyright of any article published on www.Fraud-Magazine.com or ACFE.com. Permission of the publisher is required before an article can be copied or reproduced.