Internal whistleblowing: how to get it right
Until Hong Kong establishes effective whistleblower protections it will continue to miss out on one of the most effective channels for the detection of fraud. CSj gets some expert advice on this and other aspects of establishing an effective internal whistleblowing channel.
In 2002, Times magazine named three women who blew the whistle on corruption at corporate giants Enron and WorldCom as ‘Persons of the Year’. They were hailed as heroes. ‘They were people who did right just by doing their jobs rightly – which means ferociously, with eyes open and with the bravery the rest of us always hope we have and may never know if we do,’ the magazine wrote.
However, real heroes, one might argue, are not necessarily the ones who make giants fall – as in the above cases – but those individuals and employees who detect misdoings within an organisation, report it internally and by doing so stop fraud, corruption or other illegal activities. Not only will this safeguard shareholder interests, it could also ensure the organisation’s future existence.
In Hong Kong there are such heroes, too. But compared to other countries, unfortunately, relatively fewer. The reason is not that Hongkongers lack guts or a notion of moral responsibility. It’s rather, according to respondents to this article, the lack of effective protections for people within organisations who want to report malpractice.
Numerous research reports show that whistleblowing is one of the most effective tools in detecting and countering corruption. When handled effectively, it safeguards both shareholders’ and society’s interests. But in order for it to reach its full potential, there needs to be a corporate environment that is conducive to whistleblowing, as well as a mechanism to protect whistleblowers against intimidation and reprisals. In many respects, Hong Kong lacks this.
Chris Fordham, Managing Partner, Asia Pacific Area, Fraud Investigation & Dispute Services, Ernst & Young (EY), said that most people want to do the right thing and stay clear of being associated with unethical behaviour. But what stops people from speaking up in Hong Kong is that, first, they don’t know whom to turn to and, second, if they do blow the whistle, they can probably say goodbye to their career.
‘It is unfortunate,’ Fordham says. ‘A lot of the frauds we deal with in terms of investigations come from whistleblowers. If companies don’t have a whistleblower policy that protects the anonymity of the informer, they are missing a fundamental route for issues to be surfaced and to detect fraud. It’s as simple as that’.
Over 43% of detected fraud within organisations is discovered by a tip, according to a global survey by the Association of Certified Fraud Examiners, and the majority of tips come from employees of the organisation. Another study by the University of Chicago showed that almost half of the fraud cases included in its survey were spotted by employees, media or non-financial market regulators.
Corruption and fraud in business are among the greatest challenges in the modern corporate world and a major threat to sustainable growth. According to studies done by the United Nations and the Organisation for Economic Cooperation and Development, corruption adds as much as 10% to the cost of doing business and 25% to the cost of public procurement.
A PricewaterhouseCoopers global economic crime survey showed that 67% of respondents have experienced asset misappropriation, 38% accounting fraud, and 24% bribery and corruption.
In China, 84% of polled companies said they were victims of fraud, a Kroll report found.
‘If fraud goes undetected, you tend to go into a culture of fraud’, Fordham warns. ‘You get a situation where people think “If he get’s away with it, why would I not get away with it”. It’s a downward spiral’.
These facts highlight the urgent necessity to combat corruption in business, and whistleblowing plays an invaluable part in this fight. Jurisdictions around the world have therefore developed legal and regulatory tools aimed at tackling corruption in business.
As early as 1863, the US pioneered the promotion of whistleblowing by enacting the False Claims Act, which since then has advanced. The Sarbanes-Oxley Act of 2002 contains significant protections for corporate whistleblowers, and prescribes a prison sentence of up to 10 years for retaliatory conduct against whistleblowers. What’s more, the US Securities and Exchange Commission (SEC) has come to rely heavily on whistleblowers since the 2010 DoddFrank Act gave it the authority to reward people whose tips lead to enforcement actions.
Regulations differ country to country. In the UK, the non-statutory Combined Code of Corporate Governance protects whistleblowers and obliges listed companies to have whistleblowing arrangements or explain why they do not. There is no cash reward system. Norway has specific legislation on the protection of whistleblowers, while neighbouring Sweden does not define whistleblowing in law, but has statutory provisions – such as the constitution, the trade secrets act and the employment protection act – that shield individual informers.
Is Hong Kong lagging behind?
Hong Kong has a history of taking proactive steps to investigate and prosecute cases of alleged corporate fraud, but the territory is lagging painfully behind when it comes to whistleblower protection.
According to a study done by the HKICS in 2007, 87% of respondents believed that it is necessary for a company to have a whistleblowing policy in place – but only half of all listed companies actually had one. And the trend does not look positive. EY’s new Asia-Pacific fraud survey said the number of employees in Hong Kong prepared to use a whistleblowing hotline has dropped significantly from 2013, to only 40% in 2015.
‘In territories that have whistleblowing protection, people are more likely to use it’, Mr Fordham says. ‘Hong Kong not only lags behind other jurisdictions; it has failed to make any strong inroads in the past few years. I’m concerned about the situation here’.
He adds, however, that Hong Kong Exchanges and Clearing (HKEx) has taken steps in the right direction. It recommends listed companies to adopt a whistleblowing policy encouraging employees, shareholders and other business associates to voice their concerns on suspected malpractice. Currently this is a ‘recommended best practice’ in the Corporate Governance Code, and is not therefore mandatory, and there is no direct legislation making whistleblower programmes compulsory. Also, crucially, Hong Kong is missing the comprehensive legislation required to offer whistleblowers protection. At present there is only a very narrowly defined provision in the Employment Ordinance which states that, ‘an employer shall not dismiss an employee by reason of his giving evidence or information in any proceedings and inquiry in connection with the enforcement of the Employment Ordinance, work accidents or breach of work safety legislation’.
In 2013, lawmaker Cyd Ho Sau-lan, a member of the Legislative Council of Hong Kong (LegCo), proposed whistleblower protection legislation which would protect individuals from retaliation for uncovering malpractices of the government or public organisations in the public interest. It wasn’t passed. Charles Mok, who represents the information technology sector in LegCo, supports an enhanced whistleblower protection system in Hong Kong. Too often, as he put it, the whistle is shoved right back down the blower’s throat.
‘I am in favour of having whistleblower protection in Hong Kong. We certainly lack such protection for people in Hong Kong’, he said. ‘Unfortunately the issue is not controversial enough to garner the attention of the public to see the merits of having such protections,’ he said.
Dr Brian Lo FCIS FCS, Vice-President and Company Secretary of APT Satellite Holdings Ltd, says it is ‘unfortunate’ that the LegCo proposals were voted down. The use of whistleblowing to combat fraud and corruption, he explains, is among the most important – as well as controversial – aspects of corporate governance.
APT Satellite Company has a wellestablished whistleblower protection policy, he explains. It works together with a complaints handling procedure under the oversight of the company’s audit committee and internal auditor. The success of such systems should not be measured by the number of tip-offs they generate, Dr Lo points out, because their very presence is a deterrent to misconduct.
He believes that Hong Kong would benefit from whistleblower protection regulation. He also believes that the recommendation in the Corporate Governance Code for companies to implement effective whistleblowing procedures should be upgraded to a code provision.
Edith Shih FCIS FCS(PE), Head Group General Counsel and Company Secretary, CK Hutchison Holdings Ltd, doesn’t think Hong Kong is in urgent need of additional legislation or amendments to the listing rules at the moment. The Independent Commission Against Corruption (ICAC) investigates suspected corruption reported by the public via its 24-hour hotline and report centres, and all companies should make an effort to have a functional internal system for tipoffs and complaints, she says.
All business units in the CK Hutchison group have some form of whistleblowing system, depending on where they are listed. The most sophisticated systems are in jurisdictions like the US and the UK where listing rules make such schemes compulsory. In Hong Kong, where whistleblowing is still a recommended best practice, the system can be simpler – an e-mail and mailbox – but such a system can still be sufficient and efficient, she says.
‘There are sophisticated whistleblowing systems in the market but these cost and if companies take things seriously then even an e-mail address for reporting is not a bad idea. It does the job, too, in preserving anonymity. It all depends on how the company handles whistleblower reports. If the internal auditor just puts it away, it’s the end of the story. But our internal auditor actually has to investigate and report the cases to the audit committee, and whistleblowing is always an item on the agenda to be accounted for at our audit committee meetings. If there have been any issues, further investigation would be conducted with a view of bottoming out the issues being reported on’.
CK Hutchison also has an ongoing education and information process to ensure that all employees are aware of the system and its benefits.
Most reports from the whistleblowing system are not about major crimes, but rather information on issues such as unfair employment treatment, harassment, suspected bribery, or breaches of regulatory or legal requirements. Whistleblowing is one of many ways of detecting misdoings, Edith Shih points out. ‘If we’re talking about major crimes, I don’t think we would rely entirely on the whistleblowing system for that purpose. The way I look at it, our internal auditor, management, risk management and internal control colleagues would have picked up those cases’, she says. ‘If material misconducts are not picked up by our own system, then we have not done our job properly and are being negligent as managers’.
Encouraging a ‘speak-up’ culture
The HKICS has been promoting the benefits of whistleblowing for some time. It has issued guidance and a toolkit on how companies can implement a whistleblowing system (available from the HKICS website: www.hkics.org.hk). ‘There is a sound commercial purpose for whistleblowing’, says Mohan Datwani FCIS FCS(PE), Senior Director and Head of Technical & Research at the HKICS. ‘If appropriate issues are escalated and dealt with, this is significant risk mitigation’.
Basically, what’s needed to create a better speak-up culture in Hong Kong and to get people to raise the flag on wrongdoings entirely depends on their ‘level of comfort’, he adds. ‘The informant must know that there is someone powerful enough in the organisation to listen from an independent perspective. For example, if the complaint is against the CEO, what is there to make sure that the complainant will not be sacked following a complaint, including for some tangential operational reasons? There thus needs to be a whole series of wrap around protections for a better speak-up culture’.
A whistleblowing policy is only as good as its implementation and the level of comfort it provides in the expected protections and abilities to lead to results. The most commonly discussed flaw by industry practitioners does not relate to having or not having a tip-off system, Datwani explains. Rather, it relates to a lack of understanding of the use of whistleblowing.
The first step is therefore for the company to have a whistleblowing policy, a viable whistleblower channnel and a training programme to ensure that employees know how – and why – to use the whistleblowing channel. Companies must set the right tone from the top so everyone in the company feels protected. If employees don’t understand the rationale behind the whistleblowing system, it all too easily turns into a forum for general criticisms and an arena for infighting. The systems must also be localised to local languages and customs – this, Fordham says, is something many organisations miss.
The second step is for the company to establish effective procedures to deal with the tips when they come in. Often the whistleblower doesn’t come forward with all the information at the same time, but sits on more documents and material. How do you keep an open channel with informers if they wish to remain unidentified? How can you safeguard their security if they step forward? Then, how do you proceed with the investigation to validate the tip-off? Do it wrong, and you risk alerting the suspects who are then likely to quickly get rid of all evidence against them by destroying computers and burning documents – this, Fordham says, happens all the time.
Fordham relates some real-life examples of how not to do it. On one occasion, a company executive got an anonymous tip-off about suspected fraud within the organisation. His reaction was to stick the letter on the staff notice board, with a note saying: ‘If you don’t have the guts to tell me who you are….’. Then he put the people who were complained of in charge of the investigation.
‘I couldn’t believe what I was hearing, it was unbelievable’, he says. ‘It later became clear that there was a fundamental issue in the company with bribery and fake invoices’.
Johan Nylander, Journalist
SIDEBAR: In their own words
“If fraud goes undetected, you tend to go into a culture of fraud. You get a situation where people think ‘If he get’s away with it, why would I not get away with it’. It’s a downward spiral.” Chris Fordham, Managing Partner, Asia Pacific Area, Fraud Investigation & Dispute Services, EY
‘‘It all depends on how the company handles whistleblower reports. If the internal auditor just puts it away, it’s the end of the story.” Edith Shih FCIS FCS(PE), Head Group General Counsel and Company Secretary, CK Hutchison Holdings Ltd
“What’s needed to create a better speak-up culture in Hong Kong and to get people to raise the flag on wrongdoings entirely depends on their ‘level of comfort’… the informant must know that there is someone powerful enough in the organisation to listen from an independent perspective.” Mohan Datwani, FCIS FCS(PE), Senior Director and Head of Technical & Research, HKICS
SIDEBAR: Ombudsman – the perfect confidant?
As mentioned in the main article, whistleblowing procedures have a relatively long history in the US. A related best practice recommendation emerging in the US is for companies to establish an ombudsman function. Having an ombudsman to provide employees with neutral and confidential advice on a range of issues, not just on suspected malpractice, is a significant benefit for companies, writes David Bogoslaw in an article in Corporate Secretary (available online at: www. corporatesecretary.com, see ‘Ombuds programs: creating a culture of trust rather than compliance’, 17 June 2015).
Formal whistleblower hotlines are often underused since they do not gain the trust of employees as an independent and confidential space in which issues can be discussed. This is a significant advantage the ombudsman function has over formal reporting channels and, while it is still a rarity in the US, increasing numbers of organisations are seeing the value of creating a safe space for employees to voice concerns and get advice on the situations they face in the workplace. The ombudsman function comes with a cost, but companies could be facing a much more costly denouement if issues are not resolved at an early stage.