Selene Ho, Deputy Director, Standard Setting, Hong Kong Institute of CPAs, and an Institute member
When providing a service to a client or working for an employer, a professional accountant may come across an act or suspected act of non-compliance with laws and regulations (NOCLAR) committed or about to be committed by the client or employer. Professional accountants therefore have an ethical responsibility not to turn a blind eye on such matters but – before revisions effective in July 2017 – were bound by the duty of confidentiality under the Institute’s Code of Ethics for Professional Accountants. The revised provisions in the code remove the duty of confidentiality for the specific purpose of reporting acts or suspected acts of NOCLAR. The provisions also provide a framework to guide professional accountants on deciding how best to act in the public interest when they become aware of suspected or actual NOCLAR.
Members of the Institute are expected to comply with the code. Prevention of NOCLAR is not solely the responsibility of professional accountants. All stakeholders in the financial reporting ecosystem – especially management and those charged with governance – have an important role to play in preventing and bringing to light potential acts of NOCLAR.
One of the desired outcomes of the provisions in the code is to stimulate professional accountants to take a proactive role in responding to NOCLAR. Professional accountants are often best placed to initiate the development of a sound whistle-blowing policy in their workplace. A good policy should make employees feel safe to report misconduct confidentially and state that there will be no retaliation against employees who blow the whistle in good faith.
Currently, there is no comprehensive law in Hong Kong requiring companies to implement a whistle-blowing policy and procedures. It is a best practice component to any compliance programme and an essential tool to combat internal misconduct and to ensure compliance with laws and regulations. Having a whistle-blowing channel available to all employees and third parties is vital because it is often the employees, vendors and business partners who would be aware of any misconduct happening on the ground. Obtaining whistle-blower information at the earliest opportunity enables companies to act promptly to investigate and remediate issues.
There is no one-size-fits-all whistle-blowing policy. The NOCLAR provisions in the code and the guidance in ICAC’s Anti-Corruption Programme provide useful guidance on what whistle-blowing policy should include. Guidance is also available on The Anti-Corruption Knowledge Hub, which is operated by Transparency International.
“Professional accountants are often best placed to initiate the development of a sound whistle-blowing policy in their workplace.”
Kenny Fok, Assistant Director, Corruption Prevention Department, Independent Commission Against Corruption
We all agree that whistle-blowing is a very essential tool in a company and an effective whistle-blowing policy can facilitate its internal personnel (e.g. employees) and relevant stakeholders (e.g. business counterparts, suppliers) to come forward and raise concerns in confidence. This enables companies or corporations to detect and remedy wrongdoings, including corruption, at an early stage before serious damage is caused.
Some findings from the ICAC Annual Survey 2019 may shed light on individuals’ reluctance to make a report, for example, their considerations on “whether the reporting would generate any outcome”, “worry about lack of evidence”, “whether the issue was too small to warrant any follow up” and “troublesome.” These suggest that an individual’s willingness to report wrongdoings would depend on his or her belief on whether the reports will be taken seriously, professionally and in strict confidence; the scope of wrongdoings that warrants reporting is clear; convenient reporting channels and protection from retaliation are available, vindicating our belief that these should form part of the core elements of effective whistle-blowing policies and procedures.
From the corruption prevention perspective, effective whistle-blowing policies and procedures should cover a corporate policy statement committing to high probity standards and pledge to handle the reports fairly and in strict confidence; scope of the concerns requiring reporting; clear description of the responsibilities of the handling personnel; provision of reporting channels; assurance of protection to bona-fide whistle-blowers against retaliation; pledge on timely handling of reports; conduct of internal enquiries with extra care to avoid jeopardizing subsequent investigation by relevant law enforcement agencies; effective communication and periodic review of the policies and procedures to ensure their continuous effectiveness.
ICAC advocates the importance of having in place an effective whistle-blowing mechanism especially for reporting corruption in companies and corporations. The Corruption Prevention Advisory Service of the Corruption Prevention Department will continue collaborating with relevant stakeholders, including professional bodies, to assist companies in establishing or strengthening their corporate policy and procedures on reporting corruption.
“An individual’s willingness to report wrongdoings would depend on his or her belief on whether the reports will be taken seriously, professionally and in strict confidence.”
Ricky Cheng, Director, Head of Risk Advisory, BDO, and an Institute member
Establishing a formal whistle-blowing framework within an organization can help to strengthen corporate governance and act as a useful anti-fraud control tool.
In order to have an effective whistle-blowing mechanism in place, an organization needs to deliver a strong anti-corruption message from the top, build a corporate culture of zero tolerance to fraudulent activities and hold fraudsters accountable for the legal consequences of their wrongdoings.
Organizations must alert their employees on how the mechanism works through disseminating clear policies and procedures, and arranging regular training, so that they know how to escalate the relevant unpleasant events to the appropriate level of management or those charged with governance with confidence. Besides, organizations should also extend their whistle-blowing policy to their stakeholders such as suppliers and customers as they are vital sources of information on organizational malpractices. This can be done through posting the organization’s whistle-blowing policy on its website or communication correspondence via email.
An organization should specify where or to whom a complaint should be raised, such as to an appointed ethics officer or audit committee (in case of a public company), hotline, and provide contact details. Depending on the nature or the seriousness of the concerns reported, the audit committee may recommend to the board to conduct a separate investigation by independent consultants to determine if fraudulent activities exist.
Some of the key elements of a whistle-blowing policy may include, but not limited to:
- Handling and dealing with the concerns of the whistle-blower seriously and appropriately.
- Maintaining the confidentiality of the whistle-blower’s identity. He or she will not be punished even though the concerns reported based on reasonable suspicion turns out to be untrue.
- Discouraging any malicious and unfounded grievances made by stakeholders who may be subject to legal or disciplinary consequences.
- Precise and concise details of the concern being reported.
“Organizations must alert their employees on how the mechanism works through disseminating clear policies and procedures, and arranging regular training.”
