804 - Whistleblower Policies: Update ACC Corporate & Securities Committee

1. 804 - Whistleblower Policies: UpdateACC Corporate & Securities Committee October 18, 2016, 4:30 p.m. Shawn Graham, Royal Bank of CanadaKevin Gross, Chevron CorporationHeidi Franken, Ontario Securities Commission Carlos Vasquez, U.S. Securities and Exchange Commission Jonathan Shapiro, Baker Botts LLP

2. Contents • SEC Whistleblower Activity: By the Numbers • SEC Whistleblower Activity: Notable Recent Case Releases • Key Questions Moving Forward • Dodd-Frank Resource Materials - History & Key Provisions - Investigation Considerations

3. SEC Whistleblower Activity: By the Numbers • 14,000+ tips since program inception - With >$111M awarded to 34 WBs • WBs Particularly Motivated in SEC FY2015 (ended 9/15) - Nearly 4,000 tips and 2,800 calls returned - More than $33M awarded to WBs ($30M to 1) - First Anti-Retaliation Award • California Leads the Nation (by a lot) - 646 tips in CA - 261 in NY - 220 in FL & TX

4. SEC Whistleblower Activity: Notable Case Releases • It’s been a busy year: numerous settlements, but no litigated resolutions. Recent notables: • Health Net: WB claims settled for $340K (Aug. 2016) (separation agreement included allegedly improper employee waiver of right to “individual monetary recovery” for providing information to government) • Anheuser-Busch InBev: FCPA & WB claims settled for $6M (Sept. 2016) (separation agreement included allegedly improper "non-disclosure" terms) • Int'l Game Tech: WB claims settled for $500K (Sept. 2016) (issuer allegedly terminated WB for unfounded internal claims of false financial reporting)

5. Key Questions Moving Forward • How can business safeguard private information without running afoul of regulators? - Can we no longer expect -- or ask -- personnel to keep company confidences? - What’s left of AC privilege & work product? • Recalibrate “self-report” decision when problem sourced by internal WB (as opposed to discovered via internal audit, data analytics, customer complaint, etc.)? • If litigated, would federal courts agree that WB claims should be treated differently than other key federal protections (e.g., those proscribing age- and race-based discrimination) released by departing personnel in compensated settlement agreement?

6. Dodd-Frank Act - Overview • President Barack Obama, signing remarks, July 21, 2010 "In the end, our financial system only works--our market is only free--when there are clear rules and basic safeguards . . . [a]nd that's what these reforms are designed to achieve--no more, no less." • Response to financial crisis of late-2000s. • Most significant financial reform since Great Depression. • Whistleblower program a key provision of Dodd- Frank.

7. Expanded Whistleblower Protections Dodd-Frank vs. SOX • Dodd-Frank - Right to bring court action for retaliation for making disclosures required or protected under SOX, '34 Act, or any rule or regulation promulgated by SEC or made to law enforcement officers. Reinstatement plus two times salary. • SOX 806 - cause of action if threatened, harassed or discriminated against for providing information regarding violation of Federal criminal or securities laws to any Federal agency, Congress or the Company. • File with Department of Labor before going to Court.

8. Dodd-Frank WB Program - Overview • May 2011: SEC adopts final rules. • August 2011: Whistleblower Program becomes effective. • Bounty program: rewards whistleblowers with 10-30% of penalties over $1 million. • SEC and CFTC have discretion to decide the exact amount of the award (factors analysis). • Private cause of action for retaliation.

9. Dodd Frank WB Program - Requirements • To recover bounty award, a whistleblower must voluntarily provide the SEC with original information that leads to the successful enforcement by the SEC of a federal court or administrative action in which the SEC obtains monetary sanctions totaling more than $1 million.

10. "Voluntarily" provide - • Means BEFORE request, inquiry, or demand from • SEC • PCAOB or any SRO • Congress/AG/other regulators. • Also not voluntary if required to report because of pre-existing legal duty; duty owed SEC; duty arising from court order.

11. "Original information" • Derived from independent knowledge and independent analysis. • Not exclusively derived from allegations in media/other report, unless individual is the source.

12. Independent Analysis • NOT attorney-client privileged communications (with limited exceptions). • NOT information obtained in connection with legal representation of a client.

13. Independent Analysis (Cont'd) • NOT independent analysis if WB obtained information because: • You're an officer, director, partner of an entity and someone else told you about the allegations of misconduct, or you learned about it in connection with entity's compliance process, or • You're an employee or consultant whose duties involve compliance/internal audit, or • Your firm is conducting an internal investigation.

14. Carveout to those exceptions: • At least 120 days since you gave the information to AC, CLO, CCO, or supervisor (or since you received the information), if you received it under circumstances indicating that any of these parties were already aware of the information.

15. Unintended Consequences of WB Program • Bounties paid only for "original" information • Employment lawyer advising "call a lawyer as soon as you can ... preferably before you file a formal complaint with your employer." • Can employee run the risk that Company self-reports before employee presents government with "original information"? • Challenge to corporate compliance • All economic incentives encourage by-passing of traditional compliance mechanisms, i.e. hot lines and up-the-line reporting. • Can corporations develop culture and loyalty that will counter-balance the economic incentives?

16. Unintended Consequences of WB Program (Cont'd) • Potential waiver of privilege • Review controls around and limit the distribution of privileged information. • Courts split on whether information can be clawed back - look to specific factors surrounding protections around the privileged material.

17. Protecting Against External Whistleblowing - Establishing an Effective Internal Whistleblower Program • Publish clear policies about the importance of reporting illegal or unethical behavior that include: • Details on the mechanisms for reporting violations, including information about hotlines. • Information on the various avenues available to report the violations (ombudsman office). • Clear message about the ban on retaliation. • Clear "tone from the top" encouraging an open culture and the internal reporting of potential illegal or unethical conduct. • Continued reinforcement of the importance of openness and honesty within the organization through memos, speeches and training. • Engage employees through surveys about how they feel the organization responds to illegal or unethical conduct. • Conduct prompt investigations of all reports, and take appropriate disciplinary action.

18. Conducting Internal Investigations After Whistleblower Allegations - What You Should Know • NLRB Ruling on instructing an employee to keep an interview confidential. • Maintain the integrity of the process - a critical step when a crisis hits. • Deal with the underlying conduct, and don't create a second layer of risk for yourself or the company. • Follow Best Practices. • Ask yourself the following questions.

19. Who Should Conduct the Investigation? • Corporate Security • Internal Audit • Management • Legal or Compliance Department • Regular outside counsel • Independent outside counsel

20. Who Should Conduct the Investigation? • Considerations: • Magnitude and seriousness of allegations and potential conduct. • Privilege. • Who in the company is potentially involved, and how high up does the conduct go? • Should self-reporting be considered? • What's the potential exposure? (Administrative, civil or criminal) • Is the conduct likely to generate headlines? • Is there a WB, or is there a possibility of a WB? • Has there been harm to anyone outside the company? • How much expertise is needed?

21. In-House vs. Outside Counsel • In-house counsel: • Familiar with company’s personnel, systems, and operations. • Employees may be more willing to open up to a colleague. • Less costly. • Can be faster and more efficient.

22. In-House vs. Outside Counsel • Outside counsel: • Expertise in investigations • More likely to be perceived as independent • Familiar with government enforcement agencies • Time and resources • Privilege

23. Regular Counsel vs. Independent Counsel • Regular counsel may be viewed as lacking in independence • Not necessarily the case • Was regular counsel involved in or does it have knowledge of underlying events (e.g. transaction that is the subject of the investigation)? • Independent counsel may not know the business or players • Can have both • Independent counsel to investigate • Regular counsel to monitor and advocate

24. Who should direct the investigation? • Board of Directors • Audit Committee, Compliance Committee or special committee • Independent outside panel • Senior management • General counsel • Others in the legal department • Compliance personnel • Corporate headquarters vs. business unit

25. Who should direct the investigation? • Considerations: • Magnitude and pervasiveness of the conduct • How high up the conduct goes/who is involved • No one with potential involvement or knowledge, of whatever degree, should be involved in directing the investigation. • Potential exposure • Company policies and procedures

26. Defining the Scope of the Investigation • Initially based upon: • Whistleblower or hotline report • Initial focus: specific conduct at issue • Scope may need to expand as investigation progresses and more information about possible conduct is developed. • Follow the evidence wherever it leads.

27. Defining the Scope of the Investigation • In some situations, the company will want to take a preliminary look at the allegations. • Company can use the preliminary assessment to help make quick decisions about: • whether full-scale investigation is warranted • whether to self-report • Such a preliminary review should not take more than a week or two. • Threshold for further inquiry must be low. • Should not prejudge outcomes based on gut-reaction credibility assessments or whistleblower’s supposed motives. • “How Will This Look?” Rule