Sarbanes-Oxley in Offshore Outsourcing:
Whistleblower Issues 

©William B. Bierce 2006.  All rights reserved

The Sarbanes-Oxley Act is increasingly pervasive in the supply chain contracts of U.S. publicly-traded companies. The typical outsourcing contract addresses the "Sarbanes-Oxley" compliance issues by requiring appropriate audit rights and imposing certain "rules of the road" upon the service provider.  What should be done about "employee whistleblower protection," as contemplated in SOX?  How does the extraterritorial extension of U.S. laws to foreign service providers and foreign captives (shared service providers) affect the rights and liabilities of the U.S. enterprise customer and the foreign service provider under U.S. and foreign law?  

Whistleblowers.   Sections 806 and 1107 of the Sarbanes-Oxley Act of 2002 ("SOX") protect employees of U.S.-publicly traded companies from retaliation by their employers for complaining to senior management, the Audit Committee or the company's legal counsel about violations of the SOX Act.   This protection mirrors U.S. federal and state civil rights legislation protecting "whistleblowers" asserting the rights of employees who have a protected employment attribute such as race, religion, age over 40 or disability.

Shared Services and the Foreign Captive Service Provider.   A decision by the U.S. Court of Appeals for the First Circuit held that SOX does not extend to foreign workers in the foreign subsidiaries of U.S. publicly-listed companies.  Carnero v. Boston Scientific Corp., No. 04-1801.   Judge Levin H. Campbell concluded that the extraterritorial extension of SOX whistleblower protections would embroil the U.S. Department of Labor and U.S. courts in the adjudication of foreign labor relationships.   He reasoned that Congress never intended such an extension.  As a result, a foreign employee of a foreign subsidiary of a U.S. publicly-traded company is at risk of retaliation for attempting to rectify U.S. accounting or corporate control deficiencies by seeking enforcement action.  The court noted that the statute is silent on extraterritorial application, that legislative history focused on other issues and did not identify a strong public policy for such extraterritorial action.   In short, the foreign employees of U.S. shared services organizations have no U.S. protection for their efforts to protect their shareholders.

Offshore Outsourcing.   SOX does not apply directly to offshore service providers, or their U.S. sales affiliates that might sign an offshore-based business process outsourcing contract with U.S. publicly-traded companies.   SOX applies to the public company and its employees, and to the "audit and control" functions that the CEO and CFO must certify under SOX Sections 302 and 906.   To date, the "best practices" in offshore outsourcing do not appear to require any whistleblower protection for any employees (such as account managers, project managers or liaisons) of the service provider. 

The Carnero decision raises the question whether and how to protect the legitimate interests of the foreign employees of the offshore service provider, and of the offshore service provider itself, if one of them identifies some material breach in legal compliance or ethics by the U.S. enterprise customer.    For now, this issue remains unresolved even for the most experienced outsourcing practitioners, so the "form contract" does not include any provisions on the subject.

Code of Conduct, Code of Ethics.  As a result of the revised Federal Criminal Sentencing Guidelines, in effect as from November 1, 2004, under SOX, virtually all U.S.-publicly traded companies have adopted codes of conduct or codes of ethics.   Not surprisingly, they have attempted to flow them down to their supply chains through outsourcing, sales and service contracts.  The extension of U.S. rules of conduct governing the employment relationship can create new problems under foreign law.

If SOX-type whistleblower protections were extended to the employees of foreign service providers, the flowdown of a U.S. Code of Conduct or Code of Ethics could result in a violation by the foreign service provider of foreign privacy laws or foreign labor laws.  

In the European Union, the Data Protection Directive and implementing national legislation in Member States prevents the disclosure of personal information to third parties without the consent of the data subject (the employee).   A whistleblower could be either the discloser or recipient of confidential personal information relating to another employee or a third party, which could violate such privacy rules.  

Further, adoption of a separate regime of employee discipline, based on whistleblower protection, could deprive either the accused co-employee or third party of the protections of local employment dispute procedures or local "due process" of law or local "public policy."   

Towards a New Code of Ethics in Offshore Outsourcing?   U.S. enterprises that are considering the imposing their Codes of Conduct and Codes of Ethics upon their suppliers may be running some legal risks in the field of employment law and privacy law.  The benefits and risks of such an approach should be considered before the Request for Proposals ("RFP") is submitted to prospective bidders.

This raises a number of public policy issues that impact decisions by global enterprises, whether acting as enterprise customers or service providers.

Why to Adopt Extraterritorial Extension

Extension of U.S. law to foreign business operations via a flowdown of a Code of Conduct may be good practice for U.S. purposes. 

• Sentencing Guidelines.  It demonstrates a culture of ethics and compliance that is necessary to obtain mitigation of any criminal sentences upon U.S. directors and officers convicted of a white-collar crime under SOX and the federal Sentencing Guidelines.

• Risk Allocation.  It may shift risk to the foreign service provider or supplier for errors that the U.S. enterprise might miss

• Audit and Control.  It supports the audit and control functions mandated under SOX Section 404 and related auditing rules of the Public Company Accounting Oversight Board (PCAOB).

• Focus on Enforceability.  When carefully and narrowly delineated, certain flowdown of extraterritorial laws should never violate foreign public policy and therefore never yield any conflict of laws.  For example, it is quite probable that foreign laws prohibit the bribing of foreign public officials, which is also prohibited to U.S. persons and their agents under the U.S. Foreign Corrupt Practices Act.

If this approach becomes widely adopted, offshore service providers will have to adopt, by contractual flowdown, the very rules that the Carnero court rejected.   Such an approach could have several consequences, which prudent enterprise customers and service providers would need to discuss at the bargaining table as well as in the board room:      

• Extraterritoriality.  U.S. legal compliance and procedures concepts would extend to foreign operations, as if the foreign operations were a branch or division of the U.S. enterprise.  This could create conflicts with local employment or civil rights laws.

• Infinity in Flowdowns.  The selection of foreign subcontractors by the foreign service provider would require an infinite extension of such compliance concepts and procedures throughout the foreign economy.

• Third Party Beneficiaries.  By adopting a U.S. code of conduct, would the foreign service provider be granting direct rights to its employees, and would the employees have any rights as intended third party beneficiaries of the outsourcing contract?   This would restructure the general concept that outsourcing contracts do not contemplate such third party rights.

• Local Lawsuits.  Service providers would need to express their reservations about the flowdown in order to avoid becoming subject lawsuits by foreign employees who, while protected in the U.S. , might consider "reasonable" or "appropriate" employer follow-up as a violation of local laws.

• Discussions for Narrowing the Flowdown.  Service providers might wish to consider whether any flowdown could be limited to matters regarding a contract, and not matters regarding violation of laws (which could include foreign laws for which no "whistleblower" protection might be applicable under foreign law).

Why to Avoid Extraterritorial Extension

• ·     Unnecessary Extension.  The Carnero decision teaches that it is not necessary for a U.S. enterprise to require its suppliers and service providers outside the United States to grant to foreign employees any "corporate policy" or "corporate governance" protection that is intended to support the integrity and legal compliance functions of the U.S. enterprise under the SOX whistleblower provisions.   Indeed, some would argue that it is good policy to avoid contractual flowdown of any laws that are not expressly required under U.S. law to be extraterritorial.    
  

• ·     Force Majeure Excuse for Non-Compliance.   Any contractual flowdown to the service provider of an extraterritorial law of the enterprise customer's home country should be carefully weighed so as to avoid generating a conflict of law that could lead to either a force majeure  excuse for non-compliance.   Thus, if foreign law conflicts with extraterritorial U.S. law, the foreign service provider may be excused from complying with the extraterritorial mandate.   Suitable drafting in the force majeure, business continuity/disaster planning and "savings" clauses of the outsourcing agreement would be necessary.  Notifications, legal opinions, disputes and delays could result from the extraterritorial extension.  
  

• ·     Indemnification by the Enterprise Customer.   Extension of U.S. legal norms to foreign soil could result in a demand by the service provider for indemnification from the [U.S.] enterprise customer for losses or liabilities incurred by implement such extension of U.S. law to its foreign operations.

The Carnero decision invites legal advisors, sourcing consultants and sourcing participants to re-open the dialogue on audits and codes of conduct.

Further reading:

Sarbanes-Oxley Act in Outsourcing  
Sarbanes-Whistleblower Statute 
EU Data Protection Directive

1040