Corporate compliance officers deal with whistleblower claims all the time, so we might as well ponder a question that weighs heavily on the minds of employees considering whether to report misconduct. How long does a whistleblower case take, anyway?
Cynical compliance officers might want to mutter “too long” and be done with the subject. For employees, however, blowing the whistle on misconduct can be a huge decision, with potentially life-changing consequences. Whistleblowing can end careers and ruin friendships — and also reward you with millions of dollars and financial security for life.
The catch is that most employees don’t get to know which outcome will happen when they start their whistleblower journey. On the contrary, it’s a process fraught with uncertainty. So, of course, would-be whistleblowers will wonder how long that journey through purgatory might last.
Steps of a Whistleblower Case
Whistleblower cases all happen in several steps.
First, the whistleblower decides that he or she wants to report an allegation of misconduct. That means the employee might do research to confirm that what he or she believes to be improper actually is improper, and then the employee collects evidence. Those steps alone might take several months.
Once the employee decides to report, the next question is how to report. Yes, we should always encourage employees first to raise their concerns internally via the compliance hotline, and various studies over the years say most internal allegations are substantiated within four to six weeks. For our purposes here, however, let’s assume the employee has decided to report to some external authority.
Whether the employee files a qui tam lawsuit on behalf of the government or files a complaint directly to an agency like the Securities and Exchange Commission, now the employee should (like, really should) hire a whistleblower lawyer to handle that submission. Regulators review the complaint and will expect the whistleblower to cooperate with whatever investigation they conduct.
If the Justice Department or other regulators decide the complaint is worth pursuing, they’ll bring a case against the company. Depending on the facts, the company might offer to settle quickly or fight. In extreme cases, the complaint might result in a trial.
All of this phase could take years — three or four years, easily; and possibly longer. Only then, after the company reaches some settlement, do we even get to any potential whistleblower award.
Let’s take the SEC as an example. First, the agency must decide that the case is eligible for a whistleblower award (many complaints aren’t), and post a “Notice of Covered Action.” Then the whistleblower applies for an award, arguing that his or her information made the SEC settlement possible.
SEC staff then review the applications (multiple people might be filing claims on the same settlement) and issue preliminary determinations. If that determination is no, and the whistleblower disagrees, he or she can appeal.
So how long does this award phase take? Again, years. One recent study found that the SEC takes more than two years to decide whether a whistleblower deserves an award. Some unhappy whistleblowers have even filed lawsuits to get the SEC to work faster, so far to no avail.
Still, at the far end of all that — deciding to blow the whistle, gathering evidence, submitting a complaint, waiting through negotiations for a settlement, asking for an award, waiting for a decision — then, at long last, the whistleblower’s journey is over.
Why Whistleblower Cases Can Take So Long
The truth is that whistleblower cases take so long because there are so many complaints to investigate, and only so many government investigators to go round. The cases can be complex, involving difficult issues such as accounting fraud or overseas bribery. That’s a lot of discovery investigators need to conduct, and it all takes time.
For example, in 2018 the Civil Division of the Justice Department fielded more than 600 qui tam whistleblower complaints under the False Claims Act; that’s up roughly 50 percent from a decade earlier. The SEC now fields more than 5,000 whistleblower tips every year, compared to 3,000 tips in 2012 when the whistleblower awards program was created.
Suffice to say, staffing levels at the Department of Justice (DOJ), SEC, and other regulatory agencies have not kept pace with that growth in complaints. Nor have staffing levels in the federal courts, which hear whistleblower lawsuits. So one big reason for the glacial pace of whistleblower cases is the sheer volume of them, flooding the regulatory and judicial systems.
We can’t dismiss the complexity of whistleblower cases, either. For example, an FCPA complaint might now span several countries and require investigators to unravel complex schemes to subvert accounting controls. An accounting fraud case might be a dense journey through revenue recognition rules, with a dash of management manipulating key accounting estimates to boot.
Can thorny questions like that be answered? Sure. But they take time and expertise. Meanwhile, the whistleblower who put those events into motion has to wait.
How to Streamline Whistleblower Cases
Streamlining whistleblower cases depends on the role you play in this drama.
For whistleblowers themselves, the best way to streamline a case is to map out the shortest, clearest path to proving your allegations before you even file your complaint. That requires a clear understanding of the laws and regulations you suspect have been broken, along with documentation that supports the allegation you plan to submit.
The best way to develop that map is to work with whistleblower attorneys. Those firms exist in abundance, and ideally, you should find one that specializes in whatever issue (accounting fraud, Medicare billing fraud, False Claims Act issues) has caught your attention. You should also have a long conversation with those lawyers about whistleblower retaliation, a subject that deserves a whole post unto itself another day.
For compliance officers trying to work with whistleblowers, the situation is more delicate. CCOs are stuck between the legal function looking to avoid liability for misconduct (which nobody can fault; that’s the legal department’s job) and the whistleblower trying to expose misconduct for a greater good (and possible financial windfall). It’s a tricky position to straddle. Regardless, two principles always apply.
First, a strong commitment to compliance and ethical conduct encourages people to report internally, and that’s better. That gives the company more control over crucial questions such as whether to disclose an issue when to disclose and what to disclose. In short, a strong commitment to ethics is more likely to keep an employee as an internal reporter rather than a whistleblower. That’s a huge win.
Second, have a strong internal investigations capability. Regulators will want the company to cooperate in any investigation that happens, and that phase of investigation and negotiation can take the longest of all. The better your ability to find and document the facts, the faster the ordeal will end. This entire internal process also needs to be supported by the right technology.
Conclusion: Typically Not a Quick Process
At the end of the day, whistleblower cases take as long as they take. Although it is typically a rather lengthy process, with the right knowledge, there are ways to expedite certain steps in this process. That still extracts a heavy toll on whistleblower and company alike, and so much uncertainty lingering for so long does nobody any good.
For compliance officers, that means investing in speak up cultures to keep would-be whistleblowers close, and working closely with legal functions to wrap up cases as quickly as possible. “As quickly as possible” might still take years, but every step closer to certainty is a step in the right direction.
Matt Kelly is an independent compliance consultant and the founder of Radical Compliance, which offers consulting and commentary on corporate compliance, audit, governance, and risk management. Radical Compliance also hosts Matt’s personal blog, where he discusses compliance and governance issues, and the Compliance Jobs Report, covering industry moves and news. Kelly was formerly the editor of Compliance Week. from 2006 to 2015. He was recognized as a "Rising Star of Corporate Governance" by the Millstein Center in 2008 and was listed among Ethisphere’s "Most Influential in Business Ethics" in 2011 (no. 91) and 2013 (no. 77). He resides in Boston, Mass.