Insiders at Enron and WorldCom grabbed headlines by blowing the whistle on accounting irregularities that exploded into what became the biggest U.S. accounting scandals ever. There's still some speculation about whether the accounting improprieties could have been nipped in the bud if a well-designed and effective whistleblower complaint-reporting process had been in place at these companies. The informants were well positioned to express their concerns; they enjoyed access to the inner sanctum and shared their initial findings with the leadership in person. But these executives weren't the only employees aware of the chicanery; many underlings knew about it as well.
Prompted by this knowledge, Congress made it easier for employees to report accounting problems at public companies by adding Section 301 to the Sarbanes-Oxley Act. The section instructs audit committees to establish procedures for gathering, retaining and dealing with complaints related to accounting, internal controls and auditing and requires committees to provide a confidential, anonymous channel for employees to submit their concerns.
Congress left it up to affected enterprises to decide what procedures would be appropriate for their business and how to evaluate their program, so companies quickly created processes that met Section 301 requirements. "Most people got advice from law firms and other experts as to how to do it," says Bob Kueppers, deputy CEO of Deloitte & Touche LLP in New York City.
"It  probably didn't exist in any formal form in most companies," he explains. In the initial need to comply, "companies set up their 301 process -- [whether it was] redoing their audit committee charter, getting hotline-type mechanisms in place, establishing the responsibilities as to who the first responders are, and doing the triage and vetting of whatever the incoming is."
Then businesses turned their full attention to the complexities of complying with Section 404. Now that those efforts have been streamlined, organizations are ready to exhale and take another look at their mechanisms for reporting whistleblower claims. Numerous businesses are finding thin, disorganized complaint-handling pro-cesses operating in crisis mode and producing few measurable results, according to a white paper by Grant Thornton LLP.
"In many cases, companies have chosen to deal with the requirements of SOX using policies, procedures, manuals, and training and compliance officers, among other items. However, audit committees are seeking validation that these steps are sufficient, effective and valuable," says Bradley J. Preber, west region managing partner, economic and advisory services, at Grant Thornton in Phoenix.
And they're doing so with good reason. "Committees are being bombarded with numerous whistle-blower complaints on everything from human resource-related matters to off-color jokes to the food in snack machines," he explains. Others "are reporting that they are receiving no whistleblower complaints at all."
To bring their complaint-handling process back on track, businesses need to develop a detailed, comprehensive plan, according to Grant Thornton. The firm offers a model for such plans. At the outset, companies must make an important assessment: identifying and understanding the stakeholders and their needs. Next, they should establish procedures for handling complaints. Grant Thornton recommends the following steps:
• Receiving. Company representatives choose and implement channels for receiving complaints, a method for documenting and housing them and a process for screening them to determine whether they should be forwarded to the audit committee.
• Analyzing. The audit committee, assisted by legal counsel, develops standards for classifying complaints and then uses those criteria to perform a detailed analysis and decide on the best course of action.
• Investigating. Appropriate group or individual experts within and outside the organization are brought in to advise and assist the audit committee in its fact finding.
• Resolving. The audit committee and its assistants issue and implement a corrective action plan if necessary.
• Reporting. Appropriate disclosures are provided to stakeholders as well as to regulators, auditors and creditors as needed. This step may require the assistance of legal counsel and public relations professionals.
• Retaining. Documents produced during the process must be preserved with guaranteed confidentiality and restricted access. They provide proof of the audit committee's compliance with Section 301.
Once the complaint-handling process is up and running, companies need to monitor and test it for compliance with the objectives and standards that the audit committee established, according to Grant Thornton. The audit committee should adopt performance measures and operating benchmarks and establish mechanisms for capturing this information.
Some metrics that companies can use to gauge performance include categorizing complaints by number (total number of complaints, average number of complaints per specified time period, complaints by division, branch, store); by cost (average cost per complaint and per investigation); and by ratio (ratios of complaints to type of outcome, sales and head count).
The timing for developing an effective complaint-handling process is right. "I do think companies are about at the time now or in the next 12 months [that] they will be taking a look at their programs and saying -- OK, we've got some experience now, is this working? Can we improve it?" declares Kueppers.