Lynn Brewer connects the lack of an integrated whistle-blower system to Enron’s ultimate demise. She suggests that an externally based system that includes both phone and Internet access will make it both employee-friendly and less susceptible to frivolous reporting.
Confessions of an Enron Executive (Brewer) – Director’s Monthly (January ’04)
For nearly three years, in my role as a junior executive at Enron, I witnessed numerous instances of illegal and corrupt dealings, including bank fraud, espionage, power price manipulation, and gross overstatements to the press, public, and financial world. Despite several attempts to apprise senior management of the seriousness of the offenses, my warnings fell on deaf ears. When it was obvious to me that management was all too willing to overlook the warnings, I telephoned Enron’s employee assistance hotline only to be told by the service provider “inasmuch as our fees are paid by Enron, we can’t take your call—you’ll have to hire a private lawyer.”
Since resigning from Enron and going to the government, I have spent the past three years working to help companies and their directors understand what is happening “below the bottom line.” Ultimately it comes down to one thing:
Culture, Culture, Culture
The truth is that Enron’s failure was caused by two factors:
• Contribution to the corruption and/or
• Complacency towards the corruption.
Corruption cannot sustain itself unless witnesses are willing to look the other way. Although I raised my concerns with senior management throughout my tenure and in the end went to the U.S. government, unfortunately, I chose to look the other way for the financial benefit of stock options, for which I must accept personal responsibility.
The greatest risk facing a board member today is not whether a company has met all of the requirements under Sarbanes-Oxley, it is whether the culture of the organization will circumvent the systems leaving directors exposed to risk. As Jeff Immelt, chairman and CEO of General Electric said in his 2002 letter to stakeholders,“ There are no sets of laws or rules that can stop a bad culture.”
Consider Enron’s bonus structure. While Enron’s board simply approved the annual bonus pool, they never examined whether the distribution of those bonuses would motivate employees to manipulate power prices in California. Why would Tim Belden, who has now been indicted for his role in the California power crisis, not “game”the system as the manager of Enron’s power trading in the West when he was receiving an annual bonus of $5,000,000 to do so?
Below the Bottom Line
Questions like these must be asked by board members or they must rely solely upon their personal and collective trust of senior management. Enron’s board, like most directors, relied solely on financial numbers that were based in large part on assumptions that may or may not reflect what business actions were “necessary” to arrive at the numbers.
While Enron had a 300 percent increase in “whistle-blowing” reports to the office of the chairman between 2000 and 2001, the directors apparently never considered whether the actions that were the subject of the reports actually made the earnings possible.Yet in 2001, 31 percent of the reports involved criminal activity, 74 percent of which were reports of fraud.
Although the focus of Sarbanes-Oxley has been on accounting, internal accounting controls, or auditing matters, one cannot underestimate the cost of policy violations, which on their face may appear to have nothing to do with the financials. Rather, we must look deeper into a culture that tolerates or even rewards consistent violators of policies established to maintain the integrity of an organization.
Most companies have attempted to establish a culture rich in values, with a code of conduct demonstrating their commitment to compliance with the law; however, we must not assume employees are adhering to the guidelines established. Enron’s code of conduct was 65 pages, and yet more than three-fourths of the incident reports to the office of the chairman involved violations of the company’s policies.
For reasons not completely understood, Enron is not unique, but rather the first in what appears to now be an epidemic of questionable decisions that border on unethical, if not illegal, practices. In virtually every instance, the culture of an organization determines the reliability of its financial health.
In October 2003, the Ad Hoc Advisory Group of the Federal Sentencing Commission released its recommendations on amendments to the Sentencing Guidelines. The report specifically stated “directors and officers have an obligation to become informed about the accuracy and timeliness of the compliance reporting systems within their organizations in order to reach informed judgments about compliance with the law.”
Internally Developed vs. Third-Party System
The health and sustainability of an organization are dependent upon two things:
• Honesty and integrity of the workforce and management; and
• Reporting of lapses in honesty and integrity by those who witness such behavior.
Section 301(4) of Sarbanes-Oxley, commonly known as the “whistleblower” provision, mandates implementing a system for such reporting. But many directors falsely believe the assurances from senior management that a reporting system can be developed internally. Former SEC Chairman Harvey Pitt recently stated that any attempt to create a system internally exposes the company unnecessarily to liability for failing to meet the anonymous and confidentiality requirement. Unfortunately, it will only be after a system has failed that we realize it was insufficient— and the penalties, including up to 10 years in prison, should be considered when assessing the risks of an internally developed system.
Whistleblowers are not usually—despite what many believe—disgruntled employees. Rather, they are employees who have met their threshold of pain when it comes to either overlooking the corruption or, worse yet, ultimately contributing to the corruption either consciously or unconsciously. The typical whistleblower seeks to bring information to the attention of those who are in a position to stop the misbehavior and they fear two things:
• Retribution and retaliation or
However, any system that undertakes to meet the mandates of Sarbanes-Oxley is only as good as the confidence in the system that the report will make it to the right person— one who has the power to correct the problem. This brings to light the required aspects to make certain employees use the system:
• Making it accessible to all comers in a variety of media;
• Responding in a timely manner to the report;
• Treating the problems; and
• Training of employees on how to use the system.
More than a Hotline
Sarbanes-Oxley mandates a system that allows for the reporting (incident intake), retention of reports, and treatment of problems (incident analysis) as they relate to accounting and auditing matters. This can be met through a single but robust solution, one that provides the director with the required amount of information in the most efficient manner while maintaining the integrity of the data.
While many believe an 800 number meets the mandate, it clearly falls short of providing the confidence necessary to engage employees and encourage reporting. Only a quarter of Enron’s incident reports were made by telephone.The preferred method of reporting was the more direct method of e-mail or letter, which accounted for 61 percent of the incident reports to Enron’s internal system.
Reporting/Incident Intake Method
Currently, the two most accepted means of report intake are the telephone and the Internet. However, in today’s technology era, and the rate at which information is transferred electronically, the telephone alone does not provide the efficiency in dealing with items that may require urgent steps to possibly prevent an illegal action. And the fact is most employees who deal first-hand with accounting and/or auditing issues regularly use a computer; therefore, a web-based system makes far greater sense, particularly when you consider that files can be attached electronically as evidence of the offense.
Retention of Records
The second key issue in this whistle-blowing provision is the retention of information. Unfortunately, as we found in the case of Arthur Andersen, paper shredding can be the death of an organization.With an electronic 12 – January 2004 NACD – Directors Monthly retention system that integrates the web-based report intake, companies will find storage to be far more efficient, and the issue of intentional document destruction is removed. Retention is likely to be a source of risk when lawyers for whistleblowers or class-action lawyers request the documentation only to learn a company does not have a comprehensive method of retaining and documenting the process for treatment of the problem.
With a telephone-based system, reports are transcribed, then faxed or mailed to the company, and then passed on to the directors as necessary. This method allows for reproduction and uncontrolled distribution.A web-based system requires the use of password assignment for controlled access. Additionally, actions taken by any parties are electronically recorded for universal viewing by all approved viewers including directors, compared to drafts of paper reports floating around with dated information where audit committee members may not have the benefit of the most current status at any given time. A web-based system allows a director to sign-on and determine the status of any given item at any time.
A robust web-based system allows directors or ethics officers to communicate directly with a reporter in a confidential “chat” that leaves a transcript in the electronic record for review by authorized users, which can be retained to meet the mandate set by Sarbanes-Oxley.
Treatment of the Problems (Report Analysis)
The third key aspect of the Sarbanes-Oxley mandate is for the treatment of the problems. This is where it becomes clear that a robust integrated system is absolutely necessary in order to demonstrate the efforts made to first understand the problem and then treat it appropriately.
The Ad Hoc Advisory Group of the Federal Sentencing Commission recognizes that with the congressional requirement for confidentiality, a board “will likely receive more ‘documents and information’ than it otherwise would.” While many companies are attempting to alleviate this problem by giving the reports to the general counsel for review and vetting, the Advisory Group’s report clearly said that the governing authority/audit committee should be ensured “prompt and unfiltered communications . . . directly from the individuals.”A robust web-based system has “smart filters” built in, so if a “named” person in the incident report is normally on the distribution list for electronic access, he or she would never see the report, preventing any further attempts to filter the report.
A web-based system allows for electronic “alerts” to be sent to audit committee members based on a threshold established for efficiency. The director can then log on from any location to determine whether the item requires immediate attention. Once logged on, a director can run their “mouse”over the report to see the first paragraph of information to determine the nature of the problem.
The key in treating any problem is to determine whether it is isolated or systemic. Perhaps the greatest benefit of a web-based system is the integration of incident reports with a statistical compilation of all data to efficiently identify the existing problem in order to determine the necessary actions to treat that problem. Again, this tracking and integration of reports is achieved with a single- point tool that maintains the integrity of the data from the reporter to the board member.A telephone-based system, on the other hand, requires additional input, always creating the potential that the data may be compromised.
How to Reduce Frivolous Reports
Perhaps the greatest concern for any director is that the whistle-blowing provision will open the “floodgates” and they will soon be receiving reports that do not warrant direct investigation by a board member.With a telephone- based system, reporters are far more likely to be impulsive, thereby creating “false” or insignificant reports, which only adds to the burden of proof for a company to prove they have attempted to treat the problems.Webbased intake, on the other hand, allows the reporter to think through the report as they directly input information, and also provides greater accuracy by allowing the reporter to visually review the report before it is made. This also allows the reporter to provide important details that may be forgotten during a telephone call.
The deadline for implementation of a whistle-blowing system is the first annual meeting after January 15, 2004. Directors should regard this as their single most important decision of this year. Further, the system, once implemented, should be reviewed on an ongoing basis to ensure that it is meeting both the company’s and the directors’ needs. As a director, ultimately only you can decide how much you are willing to gamble for “not knowing” what is going on below the bottom line.
Lynn Brewer (Lynn@EthicsExaminers.org) is author of House of Cards: Confessions of a Former Enron Executive, and chairman of the International Society of Ethics Examiners.