An effective employee hotline is a must-have, for public and private organizations alike. This guide provides an overview of the most prominent reporting channel requirements to ensure your hotline complies with these rigorous standards and serves as a reliable way to root out, minimize and address misconduct.

1. Reconciling the various expectations and standards for
hotlines, whistleblowers and non-retaliation.
ANSWERING THE CALL:
REQUIREMENTS FOR
REPORTING CHANNELS
©2014 Convercent. All rights reserved.

2. 2 www.convercent.com
©2014 Convercent. All rights reserved.
REQUIREMENTS FOR REPORTING CHANNELS
INTRODUCTION
These days, an effective employee hotline isn’t a nice-to-have—it’s a must-have, for public and private
organizations alike. In fact, it’s oftentimes one of the first compliance program initiatives companies will
put in place, and for good reason: The government has been very explicit about its expectations for
organizational reporting mechanisms and whistleblower protections. Adding to this are the implications
when an employee reports to the government instead of internally—which may result in monetary awards
to the whistleblower and earn the company less leniency from enforcement officials.
This reference guide provides a brief overview of some of the most prominent reporting channel
requirements facing companies today, along with a few reminders on how to ensure your hotline complies
with these rigorous standards and serves as a reliable way to root out, minimize and address misconduct.

3. Establish procedures and channels for
employees to file whistleblower complaints
both anonymously and non-anonymously.
Receive, review, treat and even
solicit reports of misconduct.
Put procedures in place to protect the
confidentiality of employees who file complaints.
Establish internal and independent audit
committees to oversee reported issues.
3
Sarbanes-Oxley
REQUIREMENTS FOR REPORTING CHANNELS RE-
www.convercent.com
©2014 Convercent. All rights reserved.
Administered by the Securities Exchange Commission (SEC), SOX was enacted in
2002—in the wake of the scandals at Enron, Worldcom and others—to regulate a
range of corporate and securities issues at publicly traded companies, though certain
whistleblower protection provisions apply to private organizations as well.

4. 4
Sarbanes-Oxley
REQUIREMENTS FOR REPORTING CHANNELS
www.convercent.com
©2014 Convercent. All rights reserved.
Public accountants who audit the company’s
financial statements cannot perform independent
forensic work on whistleblower cases.
Whistleblowers who experience harassment,
discrimination or threatening action may file a civil
suit against the company.*
*This protection was recently extended to private contractors of public companies
Retaliating against a whistleblower who reports
a federal offense to law enforcement may carry
criminal and civil penalties for companies and
individuals.*
*This provision is extremely broad and applies to private companies and non-profits as well

5. Establish and promote a system, “which may
include mechanisms that allow for anonymity
or confidentiality,” for employees and agents
to report or seek guidance about potential or
actual misconduct “without fear of retaliation.”
Periodically assess the effectiveness of compliance
program, including monitoring and reviewing
the effectiveness of the employee hotline.
5
Federal Sentencing Guidelines
REQUIREMENTS FOR REPORTING CHANNELS
www.convercent.com
©2014 Convercent. All rights reserved.
Chapter 8 of the U.S. Sentencing Commission’s Federal Sentencing Guidelines, in its instructions to
prosecutors to consider the presence and effectiveness of an organizational compliance program
when making charging decisions, set forth the elements of an “effective” compliance program.

6. Employers cannot “discharge, demote,
suspend, threaten, harass, directly
or in directly, or in any other manner
discriminate against” a whistleblower.
Whistleblowers who volunteer information to
the SEC that leads to successful enforcement
actions with sanctions greater than $1,000,000
can collect up to 30% of the settlement.
Some recent court cases have applied
Dodd-Frank whistleblower protections
to internal reports, regardless of whether
the disclosure was made to the SEC.
6
Dodd-Frank
REQUIREMENTS FOR REPORTING CHANNELS
www.convercent.com
©2014 Convercent. All rights reserved.
The most sweeping piece of financial reform legislation enacted since the Great Depression,
the Dodd-Frank Wall Street Reform and Consumer Protection Act is enforced by the SEC.
Though Dodd-Frank does apply to private companies and non-profits, its focus is restricted to
violations of securities laws, effectively limiting its reach to public and financial companies.

7. Reporting channel must be made available
to employees to report workplace
hazards, injuries or illnesses.
Organizations must display OSHA hotline poster.
Whistleblowers cannot be retaliated against as
a result of their “participating in an inspection
or talking to an inspector, seeking access to
employer exposure and injury records or raising
a safety or health complaint with the employer.”
In addition to general anti-retaliation
provisions, OSHA has more than 20 statues
that protect against retaliation for reports
connected to specific health and safety acts.
7
OSHA & Related Statutes
REQUIREMENTS FOR REPORTING CHANNELS
www.convercent.com
©2014 Convercent. All rights reserved.
The Occupational Safety and Health Act of 1970 governs
U.S. workplace health and safety standards.

8. Employers are prohibited from
retaliating against whistleblowers.
Qui tam whistleblowers can collect up to 30%
of the award if the government wins or settles.
While FCA doesn’t specifically mandate the
use of a hotline, guidance from the OIG and
others have deferred to the FSG’s hotline
provision as a means of detecting fraud
before it’s reported to the government.
8
False Claims Act
REQUIREMENTS FOR REPORTING CHANNELS
www.convercent.com
©2014 Convercent. All rights reserved.
FCA sets criminal and civil penalties for defrauding the U.S. government as a
result of action by the DOJ or private individuals in qui tam proceedings.

9. Hotline awareness posters must be
displayed in common work areas.
FAR protects contractors who report an issue
not only via a hotline but also directly to:
- The board
- An Inspector General
- The Comptroller General
- Members of Congress
- State or Federal regulators or enforcement officials
- A manager or other person with at the company
with the authority to pursue the matter
- A court or grand jury
9
Federal Acquisition Regulation
REQUIREMENTS FOR REPORTING CHANNELS
www.convercent.com
©2014 Convercent. All rights reserved.
The 2009 Ethics Compliance Program Rule of the Federal Acquisition Regulation
(FAR) significantly expanded the compliance obligations of government
contractors—both prime and subcontractors—to detect and report misconduct.

10. Companies should provide a mechanism for
reporting suspected or actual misconduct
or violations of the company’s policies.
Whistleblowers should be able to report
confidentially without fear of reprisal.
Reaffirmed whistleblower provisions and
protections under SOX and Dodd-Frank.
10
FCPA
REQUIREMENTS FOR REPORTING CHANNELS
www.convercent.com
©2014 Convercent. All rights reserved.
In 2012, the DOJ and SEC jointly released A Resource Guide to the U.S. Foreign Corrupt
Practices Act. Chapter 8 outlines the elements of an effective FCPA compliance program.

11. ADDITIONAL CONSIDERATIONS
More than half the states in the U.S. have their own individual whistleblower laws:
Alabama
Alaska
California
Colorado
Connecticut
Delaware
Florida
Hawaii
Illinois
Indiana
Iowa
Kansas
Kentucky
Louisiana
Maine
Massachusetts
Michigan
Minnesota
Missouri
Nebraska
New Hampshire
New Jersey
New York
North Dakota
Ohio
Oklahoma
Oregon
Pennsylvania
Rhode Island
South Carolina
Tennessee
Utah
Washington
West Virginia
Some of these pertain only to public sector workers, while other states extend protections to
private sector employees as well. When instituting a compliance hotline, make sure it
complies with the specific requirements in each state you operate.
Industry-specific standards should also be accounted for when implementing and
assessing your hotline and investigation processes. Certain industries—such as financial
services and healthcare—have enhanced and nuanced requirements for hotlines,
self-disclosure and non-retaliation and will require more attention than usual.
11 www.convercent.com
©2014 Convercent. All rights reserved.
REQUIREMENTS FOR REPORTING CHANNELS

12. INTERNATIONAL COMPLIANCE
U.S. companies operating in foreign jurisdictions must comply with the previously mentioned standards
in addition to specific regional requirements. Businesses operating in the UK, for example, will be subject
to the provisions of the UK Bribery Act. Reconciling these disparate expectations and putting them into
practice can prove challenging. Most notably, hotlines compliant with U.S. standards can very easily run
afoul of EU privacy standards and data protection laws.
Again, it is extremely important to research local laws to ensure you do not inadvertently violate applicable
standards for your reporting channels.
12 www.convercent.com
©2014 Convercent. All rights reserved.
REQUIREMENTS FOR REPORTING CHANNELS

13. COMMITMENT TO NON-RETALIATION
Non-retaliation provisions are present in several laws and standards, including Sarbanes-Oxley, Dodd-Frank
and OSHA. While you can’t bake anti-retaliation into a phone or web-based system, it is an exceptionally
important consideration when implementing your overall compliance program and assessing its
effectiveness.
Your organization’s commitment to whistleblower confidentiality and anti-retaliation should be explicitly
and persistently communicated to your employees to ensure their comfort and confidence in using your
reporting channels. Managers, executives and anyone involved employee conduct oversight, monitoring
and discipline should undergo thorough training to ensure they understand anti-retaliation expectations
and implications. More than that, if you’ve fostered an open-door culture, or your employees aren’t aware
of or don’t have access to a hotline, your managers will be the ones receiving reports and should be well
prepared to handle them.
Many organizations contract with independent third parties to
manage the hotline services and/or conduct workplace investigations
to avoid the possibility of workplace retaliation—intentional
or inadvertent.
13 www.convercent.com
©2014 Convercent. All rights reserved.
REQUIREMENTS FOR REPORTING CHANNELS

14. 14 www.convercent.com
©2014 Convercent. All rights reserved.
REQUIREMENTS FOR REPORTING CHANNELS
Hotlines should be open and available 24/7, every day of the year
Support local languages
Provide mutiple channels for reports to be filed, including phone, web and in person
Companies should make the existence of hotlines broadly known and encourage
employees to use the hotline for reports of misconduct
Have clear and persistent statements to non-retaliation in corporate policies and training
Leverage culture surveys to verify employees’ confidence that reports are confidential,
taken seriously and not subject to retaliation
Consider engaging third parties for hotlines and investigations to avoid potential liability
from retaliation
ENSURING SUCCESS
While the legal requirements largely cover the availability of a hotline, there are additional
considerations to help ensure that your reporting structure effective and to encourage
employees to report internally—instead of going straight to the authorities.

15. Convercent’s solution operationalizes and
integrates compliance functions across
key compliance risk areas, enabling a
cohesive approach to managing, mitigating
and monitoring compliance risks. Pairing
a refreshingly intuitive user interface
with natively integrated reporting and
analytics, Convercent’s compliance program
management solution ultimately facilitates
the efficient, good-faith application of an
effective and defensible corporate compliance
program that safeguards the financial and
reputational health of your company.
www.convercent.com
ABOUT
CONVERCENT
©2014 Convercent. All rights reserved.
REQUIREMENTS FOR REPORTING CHANNELS
929 Broadway
Denver, CO 80203
info@convercent.com
Office: 303-526-7600
Toll-free: 1-800-650-7005