Harvard Business School professor Eugene Soltes tested the “integrity hotlines” companies are supposed to have to let employees report misconduct. In many cases, they do not work or do not protect whistleblowers’ anonymity, despite Sarbanes-Oxley prescriptions.
A CIA official is now one the most famous people in US politics, even if his or her name is unknown: He or she wrote the complaint on President Donald Trump’s phone call with Ukraine president Volodymyr Zelensky, which is the foundation for Congress’ impeachment inquiry. A few weeks ago, the New York Times celebrated Val Broeksmit, an unemployed rock musician with a history of opioid abuse who almost destroyed Deutsche Bank, one of the most powerful financial institutions in the world, with a front-page article. Broeksmit passed secret Deutsche Bank documents to journalists and investigators: When his father, a Deutsche Bank executive, died, Val used his passwords to gain access to financial secrets. The whistleblower is a new kind of American hero, but what happens when the hero tries to blow the whistle and nobody can hear?
Eugene Soltes, the Jakurski Family Associate Professor of Business Administration at Harvard Business School, tested 250 companies’ “whistleblowing hotlines,” which are supposed to provide employees the opportunity to report alleged misconduct. In his paper The Difficulty of Being Good: The Efficacy of Integrity Hotlines, Soltes presents findings of his field research on corporate whistleblowing: “One-fifth of firms have impediments (e.g., phone line disconnected, e-mail bounce back, direct to an incorrect website) that hinder reporting. Once a report is made, however, most firms respond in a timely manner.”
After major financial and accounting scandals such as Enron, the United States adopted the Sarbanes-Oxley Act (SOX) in 2002. This law requires firms to provide a means for employees to anonymously report alleged accounting misconduct. If a firm facing allegations of misconduct can show that it had a properly functioning integrity hotline at the time of the allegations, the Department of Justice may provide a reduction of up to 95 percent of the fines. The possibility for employees to report fraud seems crucial to minimize the impact of misconduct.
The median duration of fraud detected through internal sources is 17 months, whereas frauds detected by external auditors or law enforcement last 24 and 36 months, respectively. According to the Association of Certified Fraud Examiners, detecting fraud earlier tends to mitigate losses: Fraud losses detected within 6 months average $50,000 (via monitoring); within 12 months, $108,000 (via internal audit); within 18 months, $130,000 (via tips); and within 24 months, $935,000. Shareholders benefit significantly from whistleblower reports; not so corporate executives who are the targets of complaints. Therefore, it is no big surprise that not all companies provide an effective integrity hotline or timely investigations after alleged misconduct is reported.
Soltes tested whistleblower hotlines with an unprecedented experiment. First, he chose a random sample of 250 out of 685 potential firms within the S&P 500 or S&P 400 midcap index. He did not disclose the companies’ names, to avoid any legal liability. The next step was to write four credible anonymous complaints: The reports needed to be plausible enough to not be dismissed without an additional investigation. At the same time, they had to be vague enough that the scholar would not risk legal consequences for making false accusations against anyone.
Soltes wrote four complaints regarding different kinds of misconduct: 1) A local city council member asked to use one of the company’s parking lots as an extra staging area for an upcoming event at a nearby school, 2) a supervisor suggested to hold off paying some invoices to avoid an unpleasant impact on the quarterly budget, 3) a colleague appeared on Facebook in a photo from a white-supremacist rally, and 4) an employee who avoids alcohol because of his religious beliefs is being penalized by his supervisor for not going out for drinks with clients.
After Soltes anonymously submitted these inquiries by phone or email, the majority of firms answered asking for additional information. 46 companies, however, provided an explicit answer without any investigation, and 52 percent of the firms that received the parking lot complaint approved the decision to accept the politician’s request to use it for personal purposes.
Overall, across the sampled firms, Soltes finds 12 different obstacles impeding the reporting of misconduct, including redirects to incorrect webpages, email bouncebacks, and disconnected phone lines. In some instances, the reporting channel itself is non-functional and would thwart reporting. He finds that 20 percent of firms within his sample have at least one obstacle on their phone, web, or email hotline.
One additional relevant result is that 13 percent of the sample, or 33 companies, explicitly discourage individuals from reporting anonymously. It is a relatively small portion of firms, but such discouragement is potentially significant in that it implicitly undermines the spirit of having an “anonymous” hotline.
In one firm, Soltes reports, when an email was sent to the firm’s hotline, an automated response was sent back saying that the “anonymous” hotline only accepted emails sent from identifiable accounts owned by the firm.
| “Just as democracy’s integrity requires that whistleblowers be free to report misconduct, so does the integrity of markets, to protect shareholders’ rights.” |
Despite the fact that the Sarbanes-Oxley Act explicitly mandates that firms have an anonymous reporting system, neither regulators nor auditors usually verify whether hotlines actually protect the identity of whistleblowers so they can avoid any retaliation after reporting.
It may sound surprising, but there is no significant difference in how companies react to different kinds of allegations. Firms are only marginally quicker in responding to financial manipulation and harassment inquiries than to reports about bribery and discrimination.
According to Soltes’s research, it is much easier to stop subordinates from reporting alleged abuses of power, corruption, and harassment in private companies than it is in elective institutions. Just as democracy’s integrity requires that whistleblowers be free to report misconduct, so does the integrity of markets, to protect shareholders’ rights.
The ProMarket blog is dedicated to discussing how competition tends to be subverted by special interests. The posts represent the opinions of their writers, not necessarily those of the University of Chicago, the Booth School of Business, or its faculty. For more information, please visit ProMarket Blog Policy.
