Stakeholders at businesses worldwide listened attentively last week as a former Facebook product manager testified before a Senate subcommittee about, among other things, the company’s purported knowledge of Instagram’s impact on young users of the app. Frances Haugen, who worked on issues regarding civic integrity while at Facebook, also released thousands of pages of research and internal documentation suggesting Facebook knew about an array of problems associated with Instagram, including its allegedly toxic effect on teens.
Some speculate that Ms. Haugen’s appearance before Congress could be related to the coinciding service outage across Facebook, Instagram and WhatsApp on October 4, a disruption that cost Facebook approximately $50 billion in market cap loss, as well as $99.75 million in income during the six hours-plus the sites were down—this according to Fortune.
Clearly, not every company faces Facebook-type risks or notoriety in the wake of a whistleblower speaking out. Nevertheless, the threat that whistleblower complaints pose to businesses across industries requires companies large and small to prepare for inevitable claims.
Best practices dictate that companies develop and implement policies and processes to respond to whistleblower complaints. But what should be done in the event a whistleblower surfaces before those procedures are in place? Here are five (or so) immediate action steps businesses should keep front of mind.
1. Take Stock of the Complaint
Not all whistleblower complaints are created equal. Companies must therefore evaluate the materiality and credibility of any given allegation, taking into account the seriousness of the issue and the whistleblower’s source of knowledge, motive and potential for bias.
Management must act in accordance with the severity of a whistleblower’s revelation. An anonymous tip about a low-level supervisor engaged in timecard fraud will be treated much differently than an accounting manager’s report of widespread financial malfeasance. In some instances, additional information may be necessary to conduct a proper evaluation of the complaint. If so, very circumscribed fact-gathering may be necessary to determine how best to proceed.
Whatever the situation may be, any and all complaints coming from whistleblowers must be reviewed to establish whether violations of specific company policies are being alleged. Likewise, it should be determined which local, state, or federal laws or regulations the complaints in question touch upon, if any, or if the problematic activity brought to light by a whistleblower exposes the business to potential civil or criminal liability.
2. Inform Only Those With An Immediate Need To Know About Whistleblower Claims
Widespread disclosure of a whistleblower’s complaint could result in retaliation, destruction of evidence or other irreversible consequences. Accordingly, related information should be disseminated within a company on a need-to-know basis.
Of course, depending upon the circumstances, mandatory disclosures may be required to be given to clients, investors, regulators or even the public. Still, and to the extent possible, a whistleblower’s identity should be kept confidential and only reported to those who must know it.
With that as a guiding principle, companies should consider how to open secure and private lines of communication with necessary parties in the aftermath of a whistleblower complaint, especially where issues raised may resonate across multiple offices or jurisdictions. In addition, entities facing whistleblower activity should instruct their IT and records departments to place holds on the destruction of electronic data and consider issuing litigation hold notices to affected business units.
Finally, depending upon the scope and subject of a whistleblower complaint, companies must determine whether any mitigation efforts are required to protect the health and safety of employees and customers. This would be necessary, for instance, when a tainted product is subject to recall or in the event a business is alerted to an unsafe work condition.
3. Communicate Earnestly With Whistleblowers
If the whistleblower’s identity is known, it is advisable to assure him or her that the complaint raised will be taken seriously and investigated thoroughly and in a timely manner. At the same time, a company dealing with a whistleblower should adopt and adequately communicate a zero-tolerance policy for retaliation.
Developing trust with the whistleblower in the foregoing manner may allow allegations to remain confidential while under investigation. Such transparency can also foster an atmosphere of cooperation on the whistleblower’s part, who may be called upon to provide the names of those with critical information regarding the given complaint, key dates, the chronology of events and relevant documents.
In terms of retaliation, it is important that employers regularly monitor a whistleblower’s employment status to make certain that the complaining employee is not subject to reprisal or any change in workplace conditions. This is especially imperative when a supervisor or the employee’s department is involved in the wrongdoing as alleged. Remember, retaliation presents itself in many forms, and even the most subtle slight against a whistleblower must not be tolerated.
4. Prepare Communications and Crisis Management Strategies
For whistleblower complaints involving sensationalized or newsworthy allegations or consumer-facing issues, it is important for a company in the crosshairs to prepare communications and crisis management strategies that minimize public backlash that can result in reputational injury or economic hardship. Crisis communications and public relations consultants should be leaned upon in these instances, and traditional and social media should be monitored for relevant chatter.
5. Develop an Investigation Plan
As mentioned, all complaints need to be investigated, though the party or parties tasked with undertaking any particular investigation should be determined on a case-by-case basis. Low risk, low credibility allegations may be handled in house, while high risk, high credibility whistleblower allegations will oftentimes require experienced outside legal counsel. This is certainly true when a complaint is likely to result in litigation, regulatory oversight or criminal liability.
Careful, comprehensive, prompt and efficient independent investigations have long-term benefits; most significantly, they tend to eliminate surprises down the road. Whatever form an investigation may take, when preparing to investigate whistleblower claims, attention must be paid to timing, duration and potential costs—information that should be presented without delay to management.
The bottom line for businesses is that whistleblowers must be treated respectfully and seriously, understanding that their concerns may provide management with helpful insight into company practices or problems that need to be addressed.
This blog post is not offered, and should not be relied on, as legal advice. You should consult an attorney for advice in specific situations.