SOX Whistleblower Hotline

Sarbanes-Oxley Section 301 requires public companies set up a hotline system for whistleblowers to internally report potential securities violations to the company’s audit committee. SOX 301 does not mandate a “one size fits all” approach, so companies can use different methods to help their employees internally report ethics violations that may impact financials or accountability. But Ernst & Young (EY), one of the premier SOX auditing firms, recommends that companies do the following:

1. Set up an anonymous hotline and inform employees of it: the hotline does not need to be a literal phone line, but could instead be an online web submission form or dedicated email address, according to EY. Companies need to inform their employees of the existence of the hotline. And companies may want to consider using a third party vendor to collect hotline tips to ensure the anonymity of whistleblowers, says EY.
2. Analyze and investigate claims: the company cannot simply ignore whistleblower tips submitted to its SOX hotline. The company must analyze and investigate the claims submitted to it to determine if the whistleblower is telling the truth, and if so, do the whistleblower’s facts have a material impact on the company’s financials, requiring the company issue a corrective disclosure to investors. Unfortunately, companies sometimes ignore SOX whistleblower tips, which is why SEC whistleblowers after seek out their own attorney after trying and failing to report internally.
3. Reporting and resolution: once the company has screened whistleblower hotline tips for the most meritorious ones, EY says that those tips should be submitted to the full audit committee or board of directors for review. EY also says that the audit committee should track trends in hotline reporting. If there is a spike in the number of reports about a particular issue, then the audit committee know what issues to prioritize.