On September 19, 2023, hundreds of current and former senior SEC officials, securities enforcement and white-collar attorneys, in-house counsel, and compliance executives assembled for several expert panel sessions at the Securities Enforcement Forum Central conference. Here are the main takeaways for SEC registrants.
Whistleblowers & Retaliation
The SEC has updated its whistleblower rules and payout guidelines to encourage a strong pipeline of tips. In 2022, the SEC received 12,300 tips and approved a record 103 awards totaling $229 million. This was quickly surpassed in May 2023 with a single award of $279 million. Panelist Rachael Clarke, SEC senior counsel, noted these headlines will encourage additional tips, and there are now specialized law firms (with retired SEC staff) to help shepherd a whistleblower through the reporting process and final settlement.
Whistleblowers are now the most common source of leads for SEC enforcement actions. The SEC considers all tips to be credible and has a fully staffed dedicated review team. Tipsters provide specific details that allow the SEC to build strong cases, sometimes down to a specific spreadsheet or document name.
Retaliation
The panel reviewed two recent publicly available SEC enforcement actions related to whistleblower retaliation. In both cases, employees had restrictions, such as an attest requirement or a pre-approval requirement, to communicate with a federal agency.
“It is critical that employees are able to communicate with SEC staff about potential violations of the federal securities laws without compromising their financial interests or the confidentiality protections of the SEC’s whistleblower program,” said Eric Werner, regional director of the SEC’s Fort Worth office.1
Best Practices for Registrants
- Do not restrict a whistleblower’s ability to communicate
- Assume any tips that come through an internal fraud hotline also have been submitted to the SEC
- Listen and acknowledge the complainant
- Take any tips seriously; credibly investigate in a timely manner
- Even if a tip is not correct, look for opportunities to improve internal controls, processes, and policies
- Thoroughly document internal investigations (this will help defend in the case of an SEC investigation)
- Do not retaliate (termination, demotion, suspension, intimidation, etc.)
Internal Controls Over Financial Reporting (ICFR)
The SEC is taking an aggressive stance on failures to maintain ICFR under Rule 13a-15. Traditionally, ICFR charges are raised along with multiple other violations. Recently, the SEC brought a standalone enforcement action under Rule 13a-15. A recent settlement with one issuer signaled the SEC’s intolerance of repeated failures to sufficiently address and remediate material weaknesses in ICFR.
Best Practices for Registrants
- Strong internal controls are a company’s first line of defense
- From the top down, a company should have a culture of compliance
- Document the internal control environment
- Identify key controls
- Test key controls:
- Walk through the design of the key controls to assess whether they are operating as intended
- Test if all controls are operating throughout the year
- If errors are found in the steps above, remediate and correct them before year-end
- Report to management, regulators, and external auditors the results of testing
- Any significant changes to ICFR should be captured and documented in a timely manner (new accounting standards, system updates, etc.)
Source: Chartered Institute of Internal Auditors2
Conclusion
Forvis Mazars works with hundreds of publicly traded companies in the delivery of assurance, tax, or advisory services, within the U.S. and globally. If you have questions or need assistance, please reach out to a professional at Forvis Mazars.
- 1www.sec.gov/news/press-release/2023-184.
- 2iia.org.uk.