After the “Freeh Report” related to the Penn State trial was released on July 12th, it got me thinking about whistleblower policies, specifically the one at Penn State University. Whistleblower Policies are mandated by the Sarbanes-Oxley Law (SOX). Although this law does not apply to not-for-profit organizations, the creation of a Whistleblower Policy by nonprofits has become a standard policy for most organizations. There is even a question on the IRS Form 990 asking organizations whether they have a Whistleblower Policy in effect.

Essentially, a Whistleblower Policy is part of the code of ethics or code of conduct for an organization. The policy provides a mechanism for individuals (employees, board members or anyone) to report potential violations of the organizations policies or other issues without fear of retaliation. A re-occurring comment in the Penn State trial was that those who had incriminating information dating back to 1998, were fearful for their jobs if they reported the situation.

My search of the Penn State website led me to a link to the “New Whistleblower Policy” which turned out to be a policy instituted on June 22, 2010. I was somewhat surprised that in the 8 months since this case first broke, the University did not seek to revise this policy. I found the policy cumbersome and confusing. I had to click through three other pages before I found a list of 10 people to whom whistleblower issues can be reported with instructions to provide information to one of the 10 for questions in those specific areas (athletics, development, finance, human resources, etc.) Needless to say, this is not a user-friendly whistleblower policy.

An effective whistleblower policy should be short, clear and concise. I also think that organizations should consider making the initial contact, for questions or issues, someone outside of the organization. This could be a board member, but I believe it would be better if the organization retained the services of their attorney or auditor for this purpose.

Both the attorney and auditor have an investigative background. They are qualified to determine in an initial conversation with the individual if there is sufficient evidence to go forward. They are also uniquely qualified to explain the facts to an individual if their issue is not a conflict with existing organizational policies.

I believe that the decision to move forward with an issue or hold back can be made within an hour or two of professional time. Therefore, naming one of these professionals as the recipient of initial complaints should not be an expensive effort.

If an issue appears to be one of potential substance, the attorney or auditor can then immediately contact the appropriate people at the organization so that a complete investigation can be made. If that initial contact is not the board, the professionals will also take responsibility for informing the board at the appropriate time.

Once each year, either the individual or professionals hired to manage the whistleblower complaints, should provide a report to the board of all of the issues raised during the past year. A summary of each issue, whether it was dismissed or is in the process of further investigation, should be included in the report.

Whistleblower issues are extremely important to every organization. The Penn State trial serves as a lesson learned and is reason enough for any organization to create an effective whistleblower policy. If you do not have or are working with an outdated policy, I urge you to create, re-examine and update it. A whistleblower policy is a key defensive act and the cornerstone of a system of risk management system.

As one of the largest CPA firms in Boston, KLR is unique because they service over 220 not-for-profit organizations with compliance and consulting services. We have extensive experience helping Nonprofit organizations regarding boards, and board responsibilities, charitable contributions, taxes and 990 filing requirements.