Whistleblowing Policy and Corporate Governance Strategy

"In a work contract, the employee makes his labour power available to the employer, but not his individual freedom”

Jean Rivero, Civil liberties in the enterprise, Social Rights, 1982, p.423

“No one can impose restrictions on a person’s individual and collective rights to freedom that are not proportional to the aim and that cannot be justified by the task at hand “

Art. L 120-2 French Labour Law Code

No organization is immune to the risk of fraud. A PWC study (2014) revealed that 55% of French companies have been victims of fraud in the past 24 months: collaborators diverting funds, cybercrime acts, a Financial Director of a subsidiary falsifying financial results, a Sales Director resorting to corruption in order to gain access to the market, production process pillaging, misappropriation of corporate actions with the participation of employees and unscrupulous accountants. Banks, insurers, the police, magistrates, fraud examiners, forensic accountants, Court Auditors, TRACFIN and AMF, not to mention the employees. Colleen Rowley the FBI agent, Stéphanie Gibaud the Director of Communication at UBS-France and of course Edward Snowden the Computer Scientist for the CIA and NSA fully disclosed world famous scandals. All of them rang the alarm to stop the actions of a company that could harm others: the so-called whistle-blowers. They claim their loyalty to institutions and their intention to act within the law (Lochak, 2014).

Professional fraud has a negative impact on the company: the average loss is 325 000 USD in 2014 (AFCE, 2014) with an average fraud duration of 32 months (over a million dollars of fraud detected by the legal obligation of denunciation).

The AFCE study indicates that the most effective detection methods are monitoring, information system checks, internal audits, and management that has traditional and proactive methods. In theoretical terms, the financial vision for fraud detection expresses the agency theory (Jensen and Meckling 1976). According to this theory, corporate governance is intended to reduce asymmetric information between the principals and their agents, thus limiting fraud and thereby loss of wealth for shareholders. If we use the Charreaux governance definition (1997), we refer to all “organisational arrangements which have the effect of limiting power and influencing the decisions of leaders, in other words, regulating their behaviour and defining their discretionary power”. Governance thus plays a traditional role in the detection of fraud.

Across the Atlantic, remaining silent about an offence makes you an accomplice or an accessory after the fact, while it is a law of silence that takes priority in The Hexagone (Lesniak 2012) The Vichy regime and Catholicism have been marred by the vilification of denunciation. The denunciation of illegal acts by whistle-blowers, class action and lobbying, strongly anchored in Anglo-Saxon countries, has been met with reluctance from the French due to historical, cultural and sociological reasons. The progressive integration of these weapons of attack into the French Law via European Laws provides new opportunities in the service of global economic governance. Employees, consumers and citizens now have the tools to reveal information that could jeopardise essential values threatened by crimes or offences, miscarriages of justice, abuse of power, illegal use of public funds, abusive behaviour, financial and accounting fraud, in-house fraud, malpractice in security and stock market law, money laundering, tax evasion, acts of unlawful competition (price-fixing, misleading sales techniques), corruption, harassment, damage caused to health or to the environment and discrimination at work. They are subsequently granted compensation for damages that resulted in depleted savings, laid-off employees, ruined shareholders, or bankrupt suppliers.

Denunciation is becoming legitimate, it’s a mode of social regulation and that has detached itself from its very negative connotation that was previously attached to it in French culture. It has joined the whistle-blowing conduct of the United States: the denunciation of conduct that is contrary to the rules or social values shared within the company. Indeed, beyond the direct financial prejudice generated by fraud, a lack of response raises a sense of exemption from punishment. Various terms are used to translate the word "whistleblowing"(literally "blow a whistle"): denunciation, ethical alert, professional alert, duty reporting, trigger alert, internal warning, or disclosure. In all cases, reporting these illegal behaviours are aimed at strengthening compliance with laws and regulations, integrity, loyalty, honesty and respect for others. The expected benefits of these mechanisms are therefore the detection of fraud, the protection of shareholders and corporate interests and a committing to the responsibility of the leaders.

Whistle-blowing origins lie especially in the False Claim Act (US, 1863), the Whistle-blower Protection Act (US, 1989), the Public Interest Disclosure Act (UK, 1998), the Sarbanes-Oxley Act (SOX, 2002) and the Dodd Frank Act (US 2010). Other sources, from international conventions or the European Council are also relevant, as well as the European Union laws, including article 29 of the Group Work. In France, in the private sector, whistleblowing rights result from several sections of legal sources creating protection levels according to areas of activity (corruption, health...). They are intended to be rights of expression, not duties (as opposed to the public sector with the obligation to denounce criminal acts except for any crime committed in the context of article 434-1 CPP or enterprises subject to the extraterritorial laws of the USA and the UK). Denunciation is the result of a legal obligation (especially in the banking sector) or being bound by contract (the existence of an in-house company chart or code of conduct).

The mosaic of texts adopted by French Law after 2002 reflect American whistleblowing to which we can add the legal texts imposed on auditors, banks, lawyers, employees, media, accountants and investors to denounce certain criminal acts that they know about. This new logic of transparency is therefore particularly significant. It can be concluded that these people, just like all employees in the company, are components of corporate governance as they fight against the abuse committed by leaders. Therefore, although denunciation is intended for a wrongful act, it plays an important role for the shareholders managers, employees and company in general. Detrimental effects can arise for the informer (the risk of retaliation, up to and including termination of employment), and for the person denounced (defamation), for the company (regarding their reputation) and for the shareholders (the share price goes down).

International labour law speaks of whistle-blowing in these terms: “whistleblowing by employees or former employees of illegal, irregular, dangerous or morally reprehensible practices”. Several definitions are proposed in international and French law, and they have the following features in common: 1 / revealing illegal acts committed in the workplace, 2 / a dimension of public interest and not of individual grievance and 3 /the revealing of these facts by specific channels. The informant may be an internal or external part of the company (employee, firm, competitor, media...) whereby he discloses information to an internal company source (internal auditor, audit committee and compliance officer) or an external source (media, financial authority, and sector or government authority). His motivation is his sense of loyalty and fidelity towards his employer, other stakeholders or the company at large. Conditions for denunciation vary: anonymity, confidentiality, evidence or suspicion. Whistle-blowing is a tool to detect risks.

Whistle-blowing is therefore a mechanism intended to counteract deviant practices and represents a complement to the conventional instruments of governance (laws and codes of governance). The convergence of the American, German, English and French mechanisms in accordance with the core values of each legal system, contributes to the neutralization of "legislative shopping" corporate strategies that exploit regulatory variations that exist from one State to the other, and that escape rules which aren’t in their interest (this is also the case in tax matters and procedural matters). A globalized economic governance was and is the ultimate limit on economic stakeholders’ freedom (Albiol, 2010). Is whistle-blowing the prerogative of the traitors or heroes, or is it rather an accessible channel of regulation and control? Does the transparency it provides (I) really strengthen the responsibility of leaders (II)?

Whistle-blowing is an original and powerful anti-fraud mechanism that complements the traditional governance mechanisms of combating fraud (A). As part of reforms that strengthen the quality of financial information, legislators and international regulators have recognized the success of whistleblowing as a means of detecting fraud (B).

The role of trust in organisations. In companies there are multiple alert routes available to an employee who wishes to report a problem that can seriously affect the company activity or make it liable (hierarchical route, external auditor, audit and internal compliance, staff representatives, labour inspector). The whistle-blowing measure is therefore optional. To maintain trust, the facts to be reported must have clearly stated characteristics: serious facts linked to accounts or finances, the fight against corruption or related to a breach in competition law (http://www.cnrs.fr/aquitaine/IMG/pdf/CC07D21.pdf). This is not a question of aiming at all legislative or regulatory provisions. The information about the existence and terms of the alert also plays an important role in this relationship of trust: Who is responsible for the mechanism? What are the consequences for the user of this mechanism? Is there a right of access and rectification to the benefit of the persons identified within this framework? Conversely, the misuse of whistleblowing rights may give rise to disciplinary penalties as well as lawsuits. The fact that the whistle-blower is not anonymous strengthens accountability and limits the risk of accusation. In principle, professional alerts are not anonymous: the perpetrator of the alert must identify himself, this will both facilitate the processing of the alert (possibility of requesting additional information) as well as protection in the event of possible retaliation. Whistle-blowing also allows companies communicate values through a standard of conduct. It is the perfect medium to generate risk awareness that must be identified: it is to preserve the reputation and integrity of the company by adopting the appropriate behaviour.

2.1.1 Anti-fraud mechanisms within the company

Restoring confidence by limiting the risk of fraud is the desired objective of multiple prevention, detection and investigation mechanisms within the company. The tools that can be implemented in the company are as follows (Bensadoun and Celaire-Chaumont, 2013 and Bitra, 2014):

2.1.2 The audit committee

It keeps track of issues relating to the control and development of accounting and financial information and deals with: the financial reporting process and the efficiency of internal control and risk management systems. Its duty is to regularly report to the collegial authorities responsible for administration or monitoring and to immediately report any difficulties encountered (art. L823-19 C.Com). This authority committee, which is an offshoot of the Council, must be composed of at least one independent Director in order to reduce financial fraud. As guarantor of the directors’ fiduciary duties of loyalty, diligence and vigilance to the shareholders, the audit committee is first line to detect fraud (Vera-Munoz, 2005). In Canada, the procedure lies with an Audit Committee mechanism "regarding the confidential sending of questionable issues relating to accounting points or auditory matters, under employee anonymity”. The process of denunciation is based entirely on the Audit Committee, in other words it is purely internal, which means it has a certain independence, which doesn't seem to be the case with Hunton and Rose (2011). It can be concluded that unless the members of the Audit Committee have enough independence to provide certain powers, this body alone cannot fight effectively against fraud. By comparison, the United States encourages more whistle- blowing to a financial authority (external alert). In Italy, all listed companies are covered and the extension of the mechanism to all companies has been proposed.

2.1.3 The proven efficiency of whistle-blowing to detect fraud

Empirical studies show that the presence of independent administrators limit the occurrence of fraud for executives (Beasley, 1996); the accumulation of CEO responsibilities increases the likelihood of fraud (Farber 2005 and Dechow, 1996). The usual tools of governance have a more clearly defined legal framework than whistleblowing but are often ineffective in detecting fraud (Dyck, Morse, and Zingales 2007), whereas the less common mechanisms such as the media and whistle-blowing are the most effective: according to the Association of Certified Fraud Examiners, external audit, although used in 80% of the companies that fall victim to fraud, only manage to detect 5% of fraud, while 45% of cases of fraud have been discovered thanks to employees. Ethical alert is therefore an effective informal governance mechanism.

2.1.4 French sectoral laws

French law does not include any general obligation to adopt professional warning systems but there are at least 5 sectoral laws on wrongful termination.

These laws represent the interests of public power for whistle-blowers in specific fields:

Crimes and offences, corruption, health and environmental safety and conflict of interest involving public officials. But the result is a lack of operability for whistle-blowers. Understanding whistle-blowing mechanisms remains difficult for the lawyer and the company. How can the company effectively collect information? How can it minimise false alerts? Already, the need to establish a whistle-blowing system was highlighted by Paul-Henri Antonmattei, Dean of the Law Faculty of Montpellier and Philippe Vivien, HRD of Areva, in 2007 in their report on ethical charters, whistleblowing and labour law submitted to the Minister of Employment delegate for labour and youth employment.

2.1.5 Whistle-blowing in business speeches about ethics

There are 4 dimensions in a charter: internal managerial type of use, financial goal for external commercial type of use, internal heritage type of use and complete external type of use, where whistleblowing mechanisms (Archer, 2012) are often in response to the U.S. Sarbanes-Oxley Act which requires companies listed on the NYSE to put in place a system that transmits the treatment of concerns that employees may have, strictly concerning accounting, financial and stock exchange issues (Art. 301-4). Thus, for foreign affiliated companies, this legal obligation becomes a simple ethical charter, voluntary in nature, where French companies can shape their own rules on ethical alerts in a charter or code of conduct, which thus falls within CSR. This automatically generates a significant heterogeneity of sources that are not subject to any obligation of convergence, so is the real intention to combat fraud or is it a marketing tool intended for the image of the company? At L'Oréal, the ethical charter is considered to be a genuine constitution: every employee receives a printed copy when hired (it’s available in 45 languages and in braille). The scope of these documents appears very limited as a management tool. In making such claims, the company creates responsibilities (or restrictions), and voluntarily duties by involving the concerns of its stakeholders.

These are fashion tools that are an alternative to general rules and correspond to the objectives of corporate social responsibility such as those described in the international standard ISO 26000. From soft law, however, they have as a legal force, something close to a gentlemen’s agreement: a non-punishable commitment by the courts that a company respects for fear of a spontaneous, non-State penalties (customer boycotts, employee strikes, loss of contracts, etc.) This is especially the case in Common Law countries, but in France the CSR tools remain legally non-binding (Ganguly, 2009). They also reflects "the ambiguity of the relationship between legislation and the self-regulation of business ethics" (Riffard, 2014).

The spread of whistle-blowing in a business results in regulatory obligations like those sustained by companies listed abroad (USA, Japan...) or a voluntary approach which is CSR. In both cases, the choice of the tool for transmitting the alert and its internal or external treatment remain at the discretion of the company. Therefore a variety of mechanisms have been put into place.

2.2.1 Implementing whistle-blowing within the company

Whistle-blowing is a means or technique for control over the activity of the employees in the same way as video protection, badges, geolocation or even biometrics. Thus, it must be submitted to the Enterprise Committee (information and prior consultation, art. L2323 - 32 C. Trav.). When the warning contains provisions that fall within the scope of the rules of procedure (see art.L1321 - 1 C.trav.) it is described as adding to the rules of procedure and is therefore subject to the provisions related to the implementation of the rules of procedure. Specifically, the project is forwarded to the labour inspector, there is consultation with the Enterprise Committee if there is there is an absence of staff delegates, and it is subject to the CHSCT for matters within its jurisdiction (art. L1321 – 4C. Trav., Merle, 2007). Then, if the CNIL gives its agreement, the procedure is implemented by management.

2.2.2 Employee information.

The mechanism is brought to the attention of all employees on an individual basis since "any information concerning an employee personally, cannot be collected by a mechanism that was not previously brought to his knowledge” (art. L1222 - 4 C.Trav.). Collective and individual employee information includes: who is in charge, whistle-blowing objectives, the areas concerned and its optional nature, the absence of consequences for employees who don’t use this mechanism, whistle-blowing recipients, the existence of access rights, audits, opposition and the possible transfer of data outside the European Union (EU).

It should be clearly indicated that "misuse of the mechanism may expose the initiator to disciplinary penalties as well as lawsuits but, in contrast, the use of the mechanism in good faith, even if the facts are subsequently inaccurate, or give rise to no further follow-up, exposes its initiator to no disciplinary sanctions" (Marguerite, 2012 and Flament, 2005 and 2013). It is therefore the unilateral initiative of leaders to inform employees of this, without imposing its use. Provisions may also be included in the employment contract. The employee is therefore an initiator and not a real stakeholder in the mechanism, whether it's at the stage of conception (what is the subject of the whistle-blowing?) or execution (whistle-blowing system followed its aftermath, Vercher, 2011).

The means implemented can be a phone number (ethical line), an online form or an e-mail address. The employer has complete freedom to choose the best collecting tool.

2.2.3 The validity conditions of whistle-blowing and role of the CNIL

Once the alert gives rise to the automated processing of personal data, or non-automated processing of personal data contained in or referred to as included in files, its implementation is through a conformity declaration on the CNIL website.

Whistle-blowing shall "respond to legislative or regulatory French laws aimed at the establishment of internal control procedures in respect to finances, accounting, and banking, and the fight against corruption relating to breaches in competition rights, the fight against discrimination and harassment in the workplace, health protection, hygiene and safety at work and the protection of the environment" and refer to the rights of the person denounced to have access to the data and be able to correct it. Thus, if the company wants to implement a whistleblowing procedure outside of legal assumptions, it must obtain prior permission from the CNIL, failing which the company will incur civil, criminal and administrative penalties provided by law. In France, the judicial judge is given the freedom to assess professional alert features and codes of conduct even if these fall within the control of the CNIL (ALBIOL et al...2010).

2.2.4 Anonymity

The person who emits the alert must identify himself and his identity must be treated as confidential: the employee shall suffer no prejudice for his actions. Anonymity isn’t unusual. It avoids any accusations and allows the person involved to benefit from basic rights of defence. The person who is the subject of the alert cannot obtain the identity of the person who emits the alert.

2.2.5 Conservation period

If the data doesn’t enter the field of the alert, it must be destroyed or archived without delay . Those that have ultimately resulted in no disciplinary or judicial proceedings are destroyed within a period of 2 months from the date of the closing of the audit operations. Otherwise, the elements are kept until the end of the procedure.

2.2.6 The whistle-blowing system selected

The information obtained is verified in a confidential way and then forwarded to the employer who then decides which measures to take. This information must be entrusted to a service or an organization specifically set up to deal with it. The CNIL recommends that the people responsible for handling alerts be limited in numbers, specially trained and subject to an enhanced confidentiality obligation defined in their contracts. The company chooses if it wants to treat the alert internally or externally via a responsible provider for the collection and processing of the alert. This choice is still at the discretion of the employer: either it is considered as a tool or a means of freedom of expression within the company, or it is considered that resorting to an external provider strengthens confidentiality and the independence of the origin of the alert. In Anglo-Saxon countries, there are many whistle-blowing processing companies.

When put into practice in France, the operation is often placed under the authority of a specialized Committee, (Compliance Committee, and Ethics Committee). If in doubt, the employee must apply to his hierarchy, his compliance manager or the legal service on which action to take.

2.2.7 Processing the internal or external whistle-blowing

The internal processing of an alert can be done by the Audit Committee or any other Committee specialising in administration: the Administrative Council itself or an individual himself, provided he is clearly identified (but this is not a recommended route to take, the defined management of the alert is preferable, Merle, 2007).

The independence of the whistle-blowing management authority is based on the composition of the committee (independent administrator, union representatives, management representatives and an outsider) and only a detailed analysis of these structures can establish their clout.

In the event of an appeal to an external provider (subcontractor), the contract with the company must include respect for data protection (security, privacy, storage, and destruction), respect for the purpose of the process (using data in the strict framework of the

whistle-blower’s instructions) and the return of the data at the end of procedure. If the procedure is established outside the European Union in a State offering adequate safeguards or enjoying a Safe Harbour Agreement (example: the USA) then permission for the process will be continued (Ledieu, 2006).

There are significant differences in national regulations between the approaches taken regarding denunciation: whistle-blower and recipient of the complaint, type of information, whistle-blower protection, truthfulness, etc... All of these elements affect the effectiveness of the whistle-blowing in terms of corporate governance. Does a managerial ethical whistle-blowing mechanism, which is located at the other end of the compliance chain, and the opposite extreme of the code of governance, strengthen the responsibility of leaders?

The leaders are responsible for the protection of assets and the continuity of the operation. Whistle-blowing provides a disciplinary lever against employees, executives, and malicious leaders who are at the origin of fraud for an estimated 630 000 USD (AFCE, 2014) (A). Whistle-blowing is also a potential support for “multi-channel” governance, with the advantage of the agency theory. Opening the alert to stakeholders, strengthening the protection of the whistle-blower and strengthening the system for SMEs would enhance its effectiveness (B).

Professional alert strategies adopted by companies are a reflection of their desire for transparency and ethics. Studying examples of current whistle-blowing mechanisms demonstrates their composite character which indicates an initial resistance to the impact of the desired advantage. Other elements in the process of whistle-blowing indicate the limits of this strategy.

The Group AXA’s (2011) code of professional conduct, specifies that whistle-blowing is optional. It also dismisses the group companies’ local laws. Thus, chapter 6 “Denunciation of breaches" does not apply in France because of certain legal obligations: a contributor who wishes to make a report must connect with the ethical or legal department of HR if he works for an AXA company in France. At SANOFI, whistle-blowing mechanisms are available at the French head office and in the USA (green line, fax, email). The procedure is placed under the responsibility of the Global Compliance / Conformity group who make the reporting statement with the assistance of the entire company management, including internal audit management. They are reminded of whistle-blower protection and the human rights of the person being reported. At Société Générale, the internal rules of procedure of the Governing Council imposes the duty of vigilance and alert (art 18: secret) on the directors. The right to alert the staff is meanwhile in the Code of conduct (2013). Several internal routes are available to the employee: hierarchical path, referral to the compliance management or the Secretary General of the group. However, no concrete tool is included in the code (telephone, fax or email) and the procedure is not described, it is merely mentioned that “he who receives the alert will ensure to conduct the necessary investigations”. Whistle-blower protection rights and the human rights applicable to the recipient of the alert are not mentioned. In France, the Whistle-blowing Charter applicable for the companies of the German group Bosh is, on the contrary, very comprehensive. This four-page document annexed to the code of ethics includes: a definition of the collaborators in a broad sense (maintained for interns), a reminder of the French legal framework (legislative and regulatory), a description of the operative scope (optional and must be revealed ahead of the procedure), anonymity, the collection of information (people and data), the organization of the operative feature. It has the special feature of letting employees choose between a classic internal reporting track and an external one (green line). The rights of the employee subject to the whistle-blowing are explained, as well as the security and confidentiality of the mechanism. There is also a conservation period, the terms and conditions of data transfer outside the EU, the assessment of the warning, reporting formalities to the CNIL, the date it came into effect and the email address of the Compliance Officer. Finally, in an extreme case, the ethical code of Schindler imposes that employees inform the HRD of any situation in which their spouse or a member of their family is involved!

All reporting is subject to preliminarily evaluation in order to determine if it falls within the scope of the procedure. The effectiveness of the system lies in the ability of the company to treat all relevant whistle-blowing and to conduct an immediate internal investigation based on the information disclosed. To avoid any malicious accusations, the whistle-blower is identified, which offers him better protection against any risk linked to his actions. His identity is confidential, as well as the subject of the denunciation and the condemned person's name: it is up to the employer to ensure this privacy, failing which the initiator of the alert and the condemned person have the right to take liability action against the employer.

The common requirement definitions of denunciation of illegal practices is the good faith of the whistle-blower. The onus is on the defendant to demonstrate the bad faith of the whistle-blower. This allows the benefit of the protection afforded to the whistle-blower to be modelled on the one offered in the event of denunciation for acts of harassment. "In good faith" means that at the time the contributor had given the information, he thought that he was honest and accurate, even if it is later proved that this was an error. The protection of the whistle-blower is played in good faith even if the reality of the harassment is not established, just as the bad faith of the whistle-blower is not established. The informer in bad faith is liable for the penalties applicable to the accused.

The authority that receives the alert should find out if the alleged facts can be established. A bit like an investigating judge, searching for the truth objectively, retaining and discarding information and preserving the evidence. One of the jurisprudential conditions of whistle-blowing being compatible with French rights is the respect for the defence rights of the condemned person. We can clearly see, therefore, the ties with human rights laws and criminal procedure. If the facts are established, for example, through an internal audit, the whistle-blowing management authority must be able to take protective measures to prevent any destruction of evidence. Evidence of the disclosed information may come into conflict with a secret business or confidentiality clause or the duty of confidentiality, which binds the individual (respect for fundamental rights and individual freedom, art.L1121 - 1 C.Trav.). In these cases, internal denunciation is difficult. Evidence may be electronically written provided that the person from whom it emanates is clearly identified (the offending fact of accountability must be established by an identification system), knowing that the opening of files outside the presence of the employee is inadmissible. The employer may not personally consult the files being identified (Bensadoun, 2013).

The DSI can be approached to provide fair evidence of the acts in question. If the Court of Cassation recognizes the right of the employer to control and monitor the activity of his employees during their work time, he requires respect for the loyalty of the evidence: the existence of the monitoring and control device must have been brought to the knowledge of the employees (Griger, 2012).

Any person identified through whistle-blowing has rights of access, rectification, and data deletion (the right to digital oblivion). These rights may be exercised after the outcome of the investigation Whistle-blowing is awkward since it involves the revelation of the identity of the initiator of the alert.

3.6.1 The prosecution of the employee by the company at the end of the disclosure

The procedure is initially in the hands of the employer. Once the wrongful conduct of the employee is proven, he may initiate civil and/or criminal prosecution in addition to disciplinary penalties (art. L122-40 C.Trav.). Civil liability will be possible in the case of gross employee negligence, that is, if the intention of harming the company has been established.

3.6.2 Applicable penalties

Criminal penalties have been strengthened by the laws on the fight against tax evasion and the large number of economic and financial crimes: punishment for the abuse of social rights is increased when the offence is committed by means of a financial package and the penalties are increased dramatically for offences and breaches in the duty of probity (extortion offences and illegal interest taking, 500,000 euros instead of 75,000 euros; smuggling committed by an individual; a penalty fine for active and passive bribery offences and the offence of favouritism). Penalties are also extended for the act of general confiscation of heritage and for the accepted moral standards of money laundering (art. 131 - 21 C Pén) which carries an additional penalty of an increase of 15 years to the length of the additional punishment, thereby temporarily banning criminally prohibited ethical breaches and preventing their renewal.

The importance of an organisational culture. Whistle-blowing can only come into play if multiple factors converge: individual vigilance, allowing detection of the violation of a norm, the involvement of the owner in the values brought to the company, the credibility of the company to manage the whistle-blowing, the empowerment of the whistle-blower, his courage and the options available to him to exercise this freedom of whistle-blowing (Berry, 2004). Thus, if a company does not have an internal alert system, it runs the risk of an external disclosure. For example, in the USA and the UK, the informant of the fraud who is not heard internally, may take external action on behalf of the government, against the company initiating the wrongful acts (Yeoh 2014 b). However, the risk of external alert is lower when there is an internal whistle-blowing system (Barnett, 1993) Whistle-blowing is therefore a means for shareholders and stakeholders to create value. Indeed, this feature organises societal conformity to its standard environment which avoids the destruction of values. It may even be a real competitive advantage.

3.6.3 Whistle-blowing axes of progress

Whistle-blowing could become a universal instrument, a true “whistle-blowing in the interest of the public”. It will require the creation of a whistle-blower status, an independent National Agency, a receiver of the alert who will verify the information disclosed. Other elements are likely to reinforce the existing mechanisms.

Extend the range of the whistle-blowing initiators. The main source of the alert is mostly the employees (49% of the cases, 21% customers, 4% shareholders, AFCE, 2014). Whistle-blowing allows employees to denounce a wrongful act. Indeed, their position in the company facilitates access to information compared with other traditional stakeholders in governance (external auditor and financial authorities). The informant, "the white knight denouncing the unscrupulous" faces the real risk of retaliation.

It is therefore appropriate for the company to retain a variety of information sources with an internal policy, a hotline and information distributors for customers and shareholders about the hypotheses of fraud and how to detect it.

Can third parties in contact with the company be affected by whistle-blowing? Afep and the Medef are in favour because it isn’t appropriate to exclude whistle-blowing from third parties such as customers and suppliers. The employed administrator may apply on the basis of the company charter meanwhile the other directors must do so on the basis of their legal monitoring duty (art. L225 - us C.Com 35.). So, the denunciation can be done through shareholders, customers, suppliers, stakeholders: this exceeds the financial perspective of this feature, towards an Omni canal governance. Having all citizens on the lookout guarantees the protection of social integrity.

Such a prospect requires one to open an access channel to denunciation through an outside organization to society. Since 2009 the Danone Corporation has opened a whistle-blowing mechanism to suppliers with a specific access code which, at regular intervals, informs the SSD purchases management so that they can privately communicate any business violation according the Principles of Business Conduct which they have been made aware of.

Motivation. An ethical alert places greater responsibility on the shoulders of the employees which leads to an interpretation of this mechanism as not only a way for the whistle-blower to exercise his freedom of expression and his loyalty but also to protect himself, unlike traditional governance mechanisms whose motivation is based on reputation or legal obligation. Hence, to the employees, this “connection” is only one step: can they become the eyes and ears of the shareholders? Such a prospect would limit the function of whistle-blowing to the protection of the share value and would transfer responsibility from the managers to the employees. However, as the CNIL might remind you, paid employees don’t have to comply with whistle-blowing regulations, they must remain optional.

Powerful psychological factors come into account, firstly the whistle-blower’s profile.

Seeking to identify a potential whistle-blower at the recruitment stage is impossible but an arguably decisive element from a moral point of view is the whistle-blower’s conception of justice, his ethics and his utilitarian view of whistle-blowing.

The capability of the organisation to respond is especially important to the employee: the organisation by itself can make or break whistle-blowing (Henik, 2015), the higher the risk of reprisals, the less the likelihood of there being whistle-blowing (Liyanarachchi and Newdick, 2009). Thus, disclosure will occur when certain conditions are met, failing which, the stakes will be too high for the employee. It is possible to use whistle-blower’s compensation to offset the risks. This is the case with the Dood Frank Act where the informer receives between 10% and 30% of the amount of the fine paid by the company that is guilty of fraud beyond 1 M USD (art.922) or the benefit of immunity. These practices exist in European competition law leniency programmes, and within French rights (art. L464-2, IV. C.com, American law speaks of a “leniency program”). Xu and Zeigenfuss (2003) demonstrated that internal auditors would be more likely to sound the alarm for a fee. Compensation allowance encourages whistle-blowers in the US (Dych, 2010 and Barrier 2011), while the moral values of business life should be the purpose of the whistle-blowing thereby leading to reservations on whistle-blower remuneration according to Professor Vincent Rebeyrol (2012). In the US the rewards are enormous: 51 million USD for whistle-blowing against Pfizer in 2009 (marketing of Bextra methods); 3.6 million for Jerry Brown in 2012 (overbilling of American forces in Iraq and Afghanistan by the Maersk Group).

Reducing personal costs for the whistle-blower. Disclosure devices have a limited scope due to employee self-censorship or his fear of personal liability at the end of inquiry, for example for subtracting data, violating bank secrets or defamation. The risk of ostracism exists even if the organisation is sincere: the whistle-blower is often misjudged by honest people (Summers and Nowicki, 2003, Reuben, 2013). The knowledge of a dismissal by the CPH is hardly a relief for the whistle-blower. In the UBS case, Stéphanie Gibaud was harassed at her workplace, marginalised and then laid off in 2012. In March 2015 she won against the condemnation of her employer for professional harassment and received compensation in the amount of 30000 euros which is minimal compared to the amounts of tax fraud organized by UBS (2.6% of the requested € 1.7 million). The transfer of risk management to whistle-blowers therefore requires that strong protection measures are put in place.

Strengthening the protection of the whistle-blower. After the Civil Convention law against the corruption of the European Council "Within domestic law, each party must provide the appropriate protection against any unjustified penalty" against whistle-blowers (art. 9). It is based on confidentiality, and the nullity of individual retaliation measures. To avoid any risk of employee stigmatisation, confidentiality is guaranteed by the organisation, except for extremely serious offences. With regard to the protection of the whistle-blowers against any individual action taken in retaliation or reprisals, protection covers periods of recruitment, internship placements and training, and takes the form of a prohibition of discrimination; and is accompanied by penalties (nullity of the individual decision) but the protection against dismissal is not routine. The recent recommendation of the European Council calls for:

Protection against retaliation in a broad sense: dismissal, suspension, demotion, loss of promotion opportunity, transferred as a penalty, reduction in salary, or withheld wages, harassment or any other form of penalty or discriminatory treatment.

Let the whistle-blower opt for either external denunciation or for denunciation through steps taken within the company. If information is collected and reviewed by an authority outside the company, the fear of retaliation is reduced. Both internal and external denunciation are subject to a supervisory authority such as the Central Service for the Prevention of Corruption (art. 40-6 CPP), the High Authority for the transparency of public life (2013 laws) or the National Commission of Ethics and Alerts for public health and the environmental matters (2013 laws). Mr. Lionel Benaiche, Secretary General of the Central Service of Corruption Prevention, envisages the creation of an association or a foundation in charge of informing the whistle-blower of his rights, guaranteeing the confidentiality of his identity, advising, ensuring respect for his rights and accompanying him during the judicial procedure if is there is one.

The whistle-blower would also choose whether to move to the next level within the company, as is the case with the Public Interest Disclosure Act (UK).

3.6.4 Training employees and shareholders.

Lack of clarity on the circumstances of whistle-blowing has been identified as a significant barrier to raising the alert (Yeoh, 2014a) Communicating whistle-blowing procedure to employees and stakeholders is essential:

Training, real life situations, practical guides... the diffusion of the standard which prescribes a behaviour must be used to instruct all employees on the values to comply with, irrespective of the countries where they operate. The company must, above all, communicate about ethics and its anti-fraud policy and management must demonstrate by example. All the people in the company must be made aware of fraud. A significant lack of fraud awareness, and a fortiori in its legal framework, has been identified as an obstacle in triggering alerts (Yeoh 2014a). The effectiveness of the whistle-blwoing procedure is subject to the manner in which the people of the organization receive the information and its content. Support can take the form of a booklet, a note by the Board of Directors, a memo from management or a briefing from the superior hierarchy and should include a description of the acts to be reported, the people who may receive the alert and the procedure to be followed (Near and Dworkin, 1998). Working groups may be set up within the company to promote the efficiency of the organization, social responsibility and commitment to employees, it's also a way to eliminate tensions and manage the situation collaboratively so that it doesn’t become an individual dilemma (Callaghan, 2002).

Facilitating ethical alerts in SMEs. Both financial and human resources limit SMEs thereby making them particularly susceptible to fraud as they can easily be ruined (the median loss for SMEs is 154000 USD, AFCE, 2014). Audit inspections often involve significant investment, but the drafting of a code of conduct, an anti-fraud policy, management revision procedures and anti-fraud programs can be implemented with relatively few resources.

Whistle-blowing effectiveness in terms of corporate governance systems is based on three pillars: a legal framework, individual responsibility, and corporate culture. The absence of a clear legal framework and whistleblowing protection currently prevents its use as a tool for corporate governance. The transition to the Whistleblowing Act could be promoted through what I would call a whistle-blowing triangle: motivation, opportunity and means. Individual motivation cannot only be based on loyalty, fidelity, or a legal obligation to disclose the illegal act, but must also be enhanced by the existence of financial incentive and isomorphic factors such as the organisation’s ability to accommodate the whistle-blowing (opportunity and means). The opportunity should also be given to the whistle-blower: ethics and the corporate anti-fraud policies must be known: the company must define what is meant by fraud and communicate this definition to the staff. Whistle-blowing is often effective with audit firms, however it must not be confined to a group of individuals but applied individually to be really effective (Alleyne, 2013 and Greenwood, 2015). Finally, the means must surpass the internal procedure of the company and be open to external authorities. Otherwise, there is a risk of confusing the alert. The national framework should promote whistle-blowing in order to develop a positive attitude among the general public and within professional circles.