Through the recently issued Paycheck Protection Program (PPP) Loan Forgiveness Application and Interim Final Rule on Loan Forgiveness, the Small Business Association (SBA) has once again demonstrated that the contours and requirements of the PPP program are constantly evolving. The SBA’s recent Interim Final Rule on SBA Loan Review Procedures provides some insights on how the SBA will enforce PPP qualification and forgiveness requirements. More agencies are getting involved in enforcement, as shown by the Securities and Exchange Commission (SEC) now reviewing quarterly disclosures to see if they align with representations made in applying for PPP loans. These ever-evolving standards, plus the possibility of Congress extending the time frame in which the PPP funds must be spent, all underscore the importance of effective PPP compliance programs. The outstanding ambiguities surrounding the program, such as what counts as the required necessity to qualify for a PPP loan, what expenditures qualify for forgiveness, and what documentation is required to support qualification and forgiveness, can result in good faith differences that lead to whistleblowers reporting potential issues.

Even before the current COVID-19 crisis, many federal statutes, such as the False Claims Act, contained whistleblower provisions and protection. The proposed Coronavirus Oversight and Recovery Ethics (CORE) Act would provide specific whistleblower protections for disclosing any information the whistleblower “reasonably believes is evidence of misconduct that violates, obstructs, or undermines any laws, rules, or regulation with respect to any Coronavirus pandemic-related program, project or activity.” With the likely upswing in enforcement inquiries associated with the PPP loans, whistleblower complaints will also likely increase. Even if the SBA does not challenge a particular PPP application, that does not preclude a relator from later bringing a False Claims action. Companies in all industries need to be aware of the anticipated growth in enforcement actions, the need for compliance policies to ensure complaints are properly addressed, and the need to emphasize anti-retaliation protections.

Whistleblower-Related Compliance Programs

As we previously recommendedforbusinesses receiving COVID-19 relief funds, it is essential that an effective compliance program tracks where those funds go and documents the financial need for the monies. Best cross-industry practices include:

• Risk-based due diligence on all vendors—especially new international vendors first contracted with during this crisis—to ensure compliance with anti-fraud and anti-bribery laws;
• Tracking the flow of all federal funds to ensure that they are being used solely for their assigned purposes; and
• Procedures for flagging and investigating suspicious orders, such as a marked increase from a standard order amount.
  
  

Other crucial pieces of an effective compliance program are robust procedures for evaluating and investigating whistleblower complaints and an anti-retaliation policy. A company’s policy must include a process and methodology for identifying meritorious complaints and determining whether to investigate them internally versus externally. The decision of when to turn an investigation over to outside counsel depends on various factors such as the amount of money involved, the level of the organization at which the alleged wrongdoing occurred, whether it is alleged that the wrongdoers were improperly supervised and whether the whistleblower alleges non-compliance with company policies. An effective compliance program shows the Government that the company is taking appropriate steps across the board, even if the inquiry starts with one transaction.

Whistleblower Retaliation Claims

The likelihood of increased whistleblower complaints reinforces the importance of having clear compliance policies against retaliation. Since a whistleblower can have a retaliation claim even when the investigation does not turn up any wrongdoing, best practices to avoid retaliation claims include:

• The inclusion of an anti-retaliation provision in the company’s internal complaint procedure
• Training (and re-training) supervisors and management personnel regarding the anti-retaliation policy
• Conducting separate investigations of alleged employee misconduct, and the substance of the whistleblower’s complaint, if the two are overlapping
• Requiring HR to be notified before any adverse employment action is taken against a whistleblower and then conducting a risk assessment analysis of the potential adverse action
• Ensuring that a target of a whistleblower complaint is not the sole and/or final decisionmaker with respect to any subsequent adverse action imposed on the whistleblower
  
  

Given the increased risk of whistleblower complaints related to COVID-19, especially those alleging an improper PPP necessity certification, now is the time for companies to review and, where necessary, reinforce their compliance programs and anti-retaliation policies.

If you have any questions, please contact Jonathan Feld (312-627-5680), Thomas Vaughn (313-568-6524), Alexis Schostak (248-203-0598), Jason Ross (214-462-6417), Melvin Muskovitz (734-214-7633), Andrew VanEgmond (734-214-7603), or your relationship contact at Dykema.