After last year’s award of more than $30 million to a foreign whistleblower who provided key information leading to a successful SEC enforcement action, it’s clear that whistleblowers don’t need to be in the home country to reap the rewards of their actions. Last year’s award was the largest by the SEC to date and the fourth award to a whistleblower living in a foreign country. Considering the possible implications of a complaint that goes to the SEC or DOJ, it’s in every company’s best interest to handle internal whistleblower complaints effectively, no matter where they come from.

1. Handling Whistleblower Complaints:
A Global Perspective for North American Companies
Shannon Walker, CEO, Whistleblower Security

2. Shannon Walker is the founder and CEO of Whistleblower
Security Inc., an ethics and risk management company with
clients worldwide, that protects and shelters organizations by
allowing employees to anonymously report fraud,
embezzlement, harassment, and other workplace misconduct
and ethics violations.
Shannon founded WhistleBlower Security to assist
organizations in creating a more transparent and accountable
environment for their employees and other stakeholders.
WhistleBlower Security delivers anonymous ethics hotline and
risk reporting services on a global basis meeting regulatory
and compliance needs and improving an organization's culture
and commitment to long-term sustainability and growth.
Shannon Walker

3. Key Highlights
 Challenges of receiving whistleblower complaints from foreign
countries (language, time zones, cultural differences…)
 Most common complaints received by North American companies
from foreign subsidiaries or branches
 Regulatory issues surrounding the receiving and investigation of
complaints that come from outside North America
 Common pitfalls of investigating foreign whistleblower complaints
 Best practices for following up with foreign complainant

4. Global Corruption
 Bribery affects one-quarter of the world’s population
 More than 50% of global compliance executives in the 2014 Kroll
Anti-Bribery and Corruption Benchmarking Survey anticipate the
bribery and corruption risks to their companies will increase
 75% have no oversight of cyber security
 58% never train third parties
 Only 43% monitor compliance after a third-party relationship begins
 Only 48% of compliance officers automate their anti-corruption
program is some way

5. FCPA Fallacies
1. Our Foreign Sales are too immaterial to create FCPA Risk. The FCPA
applies to US residents, citizens and most organizations in the US or
subject to US securities laws and reporting requirements – no matter the
size or revenue. Even the smallest improper payment or benefit can
violate the FCPA, causing an investigation for your firm and potential fines
and penalties.
2. Our Foreign Customers are not government departments/agencies
3. Our Employees never interact directly with anyone from foreign
governments
4. We’re better off not knowing what our foreign personnel and agents do to
get business done
5. Everybody else does it and never gets caught

6. Challenges
 Rapidly changing landscape in global regulations regarding whistleblower
protections, policies, data privacy and transfers
 Lack of coherent interpretation and enforcement of the various regulations
 Cultural perspectives on concept of whistleblowing
 Intake of information – limitations of what and how
 Language challenges – nuances and meaning
 Investigatory issues – local investigators key
 Employee consent and interaction regulations and protections vary greatly

7. Regulatory Issues and Conflicts
 Numerous regulatory issues surrounding the receiving and investigation of
complaints that come from outside North America
 Establish rules and protocols prior to receiving a complaint
 Understand various restrictions on data transfers of the countries you do
business in
 EU, Canada, Australia, New Zealand, Mexico, Russia, India, South Africa,
Philippines, Colombia and Costa Rica all have higher levels of data privacy and
protection legislation
 CEE/SEE countries including Romania, Bulgaria, Hungary, Slovakia, Serbia,
Czech Republic recently enacted whistleblower protections for both public and
private companies
 Turkey does not have whistleblower protections but does have whistleblower
regulations on rewards to be paid on anti-smuggling cases

8. Data Protection
 Ensure you are aware of local regulations regarding privacy and data
protection
 What types of information can be shared across borders
 How was the report made? Hotline vs. In person
 Access to personal information must be strictly controlled
 In EU, some anonymous reports must be limited to a controlled variety of
issues
 Ensure compliancy with local DPAs
 Ensure you have local investigators
 BYOD issues

9. Foreign Data Privacy Laws
 Foreign Data Privacy Law pose some of the greatest challenges
because of restrictions on the kids of data that can be collected and
transferred out of the jurisdiction.
 Many countries have enacted laws that place a high priority on
protecting personal data, including establishing a fundamental legal
right on the privacy of personal data, even if such data are contained
on employer’s system or computer
 46% of respondents in KPMG’s survey reported that their greatest
challenge in conducting cross-border investigations is handling data
privacy issues

10. Key Triggers to Engage in Cross-Border
Investigation

11. Most common complaints received by North
American companies from foreign subsidiaries
 Bribes and corruption
 Embezzlement or misappropriation
 Conflict of interest
 Fraudulent financial reporting
 Data breach
 Industry specific regulatory issues

12. Common pitfalls of investigating
foreign whistleblower complaints
 Language challenges
 Body Language - looking someone in the eye could be considered
offensive
 Cultural differences
 Data protection issues
 Loyalty sensitivities
 Employee counsel/Legal counsel rights
 BYOD issues
 Privacy issues

13. 4 Key Issues for Cross-Border
Investigations
 Attorney-Client Privilege
 Can be significantly less in foreign countries or non-existent
 Best practice to engage local counsel before initiating an international investigation
 Data Privacy Restrictions
 Employee consent, proof of necessity, wildly fluctuating between jurisdictions
 Blocking Statutes
 EU, Canada, Australia, UK & France restrict production of documents or other
evidence intended for use in a foreign proceeding unless pursuant to a treaty or
international agreement
 Employment & Labour Laws
 Some jurisdictions require consultation with employee representatives (work
counsels)

14. Best practices for following up with
foreign complainants
 Identify investigation team quickly after receiving complaint
 Address data protection issues at every step during the investigation and data
collection process
 Understand and remediate cultural differences and legal nuances
 Be aware and cognizant of data retention and destruction protocols of foreign data
 Impart a strong E&C program to help mitigate risk
 Assessment and assistance from external and local resources to ensure you are not
violating any local laws
 Reexamine and refine internal controls annually
 Increase due diligence to establish consistent review process
 Educate your employees regarding consent

15. Key Trends
 Tough environment
 Small companies and large multinationals can be targeted
 Increasing regulation globally
 Increasing enforcement
 Internal controls are key as regulators are focusing on extent of
them, including training and corporate culture
 Increasing use of hotlines

16. Anti-Corruption Compliance
Program Considerations
 DOJ/SEC sophistication and expectations are increasing when
reviewing ethics and compliance programs
 DOJ/SEC consider level of commitment regarding the E&C program
 Executive management and cultural commitment examined
 Internal controls are key when evaluating fines and penalties
 E&C programs must be re-examined, re-trained, tested
 Dedicated oversight regarding changing regulatory status globally

17. Risk Management
 Dig deep into backgrounds of employees and reputation of third party
vendors
 Conduct thorough due diligence prior to entering contracts, joint ventures
and other foreign transactions
 Ensure segregation of responsibilities
 Implementation of financial and internal controls
 Conduct periodic ethics training of employees and third party providers
 Develop, distribute and promote a financial and operational code of conduct
 Perform a risk assessment and ensure to do follow-ups
 Be vigilant – avoid complacency

18. Risk Management
 Outsource routine activities
 Remain aware of lifestyle changes of employees
 Ensure a culture of integrity and transparency
 Be aware of political connections of third party vendors
 Verify truth about potentially damaging rumors
 Be aware of exposure to corruption via local relevant regulations
 Reexamine compliance procedures in all major areas of concern
 Ensure customized local codes of conducts and policies are distributed
 Ensure North American management is aware of potential flags when
initiating investigation

19. Summary
 Fluid regulatory environment requires diligence for North American
organizations conducting business globally
 Ensure E&C program is re-examined annually to meet any changing
regulatory requirements
 Train, retrain employees on consent, protocols and local regulations
 Encourage and nurture a culture of integrity and expectation of
behaviours
 Establish rules of conduct if an incident does occur
 Ensure all information is documented in one case management
system immediately and that all pertinent information is stored and
disposed of according to the regulations of the local authority

20. Questions?
Get in Touch:
Shannon Walker
WhistleBlower Security
www.whistleblowersecurity.com
604.921.6875
shannon@whistleblowersecurity.com
Questions about i-Sight?
Joe Gerard, j.gerard@i-sight.com