3-2 Rite Aid Inventory Surplus Fraud

Occupational Fraud comes in many shapes and sizes. The fraud at Rite Aid is one such case. On February 10^th, 2015, the US Attorney?s Office for the Middle District of Pennsylvania announced that a former Rite Aid vice president, Jay Findling, pleaded guilty to charges in connection with a $29.1 million dollar surplus inventory sales/kickback scheme. Another vice president, Timothy P. Foster, pleaded guilty to the same charges and making false statements to the authorities. Both charges are punishable by up to five years? imprisonment and a $250,000 fine.

The charges relate to a nine-year conspiracy to defraud Rite Aid by lying to the company about the sale of surplus inventory to a company owned by Findling when it was sold to third parties for greater amounts. Findling would then kick back a portion of his profits to Foster.

Findling admitted he established a bank account under the name ?Rite Aid Salvage Liquidation? and used it to collect payments from the real buyers of the surplus Rite Aid inventory. After the payments were received, Findling would send lesser amounts dictated by Foster to Rite Aid for the goods, thus inducing Rite Aid to believe the inventory had been purchased by J. Finn Industries, not the real buyers. The government alleged Findling received at least $127.7 million from the real buyers of the surplus inventory but, with Foster?s help, only provided $98.6 million of that amount to Rite Aid, leaving Findling approximately $29.1 million in profits from the scheme. The government also alleged that Findling kicked back approximately $5.7 million of the $29.1 million to Foster.

Foster admitted his role during the guilty plea stage of the trial. He voluntarily surrendered $2.9 million in cash he had received from Findling over the life of the conspiracy. Foster had stored the cash in three 5-gallon paint containers in his garage in Phoenix, AZ.

Assume you are the director if the internal auditing at Rite Aid and discover the surplus inventory scheme. You know that Rite aid has a comprehensive corporate governance system that complies with the requirements of Sarbanes-Oxley and the company has a strong ethics foundation. Moreover, the internal controls are consistent with the COSO framework. Explain the steps you would take to determine whether you would blow the whistle on the scheme applying the requirements of AICPA interpretation 102-4 that are depicted in Exhibit 3.13 (separate document attached herein depicted as Exhibit 1 within the attached article). In that regard, answer the following questions.

Questions

1. What steps might you take to be eligible to blow the whistle to the SEC under the Dodd-Frank Financial Reform Act?

2. Would you inform the external auditors about the fraud? Explain.

3. Assume you met all the requirements to blow the whistle under Dodd-Frank. Would you do so? Why or why not?

Requirements: Paper needs to be at least 500 words written in APA format with all resources cited. Demonstrate critical thinking skills throughout your paper.

R E S P O N S I B I L I T I E S & L E A D E R S H I P ethics Maintaining Integrity and Objectivity Avoiding Subordination of Judgment when Threats Exist By Steven Mintz A ccording to Rule 102 of the AICPA Code of Professional Conduct, \"in the performance of any professional service, a member shall maintain objectivity and integrity, shall be free of conflicts of interest, and shall not knowingly misrepresent facts or subordinate his or her judgment to others.\" Rule 102 prohibits a member from knowingly misrepresenting facts or subordinating judgment when performing professional services for a client and employer. Interpretation 102-4, \"Subordination of Judgment by a Member,\" was revised (effective August 31, 2013) to provide additional guidance on the scope and appli- cation of Rule 102, with respect to extend- ing the subordination of judgment provi- sion. Interpretation 102-4 now includes guidelines for situations where differ- ences of opinion exist between a CPA and a supervisor or other individual. (This is in addition to, and separate from, the independence requirements of Rule 102.) Integrity is a fundamental character trait that enables a CPA to prevail in the face of a client or superior's influence, which might otherwise lead to the subor- dination of individual judgment. A person of integrity will act out of moral principle and will reject acting for the sake of expediency. In some circumstances, refusing to suborn one's judgment could result in the loss of a client; the loss of a promotion; or the loss of employment. OCTOBER 2014 / THE CPA JOURNAL But CPAs should always place the public inter- est (i.e., that of investors and creditors) ahead of their own self-interest or the inter- ests of others, including superiors or clients. In accounting, \"integrity\" means that a per- son acts on principlethat is, a conviction that there is a right way to act when faced with an ethical dilemmaand maintains the public trust. Threats to Integrity and Objectivity A common challenge to integrity occurs when CPAs, whether working in public practice or performing internal accounting or auditing services, are pressured by a supervisor (internal accountant) or a client (external auditor) to concur with potentially materially misstated financial statements. Common explanations for such coercion include meeting financial analysts' earnings expectations, meeting or exceeding budgeted amounts, or increasing earnings over a prior period. In some cases, bonuses and stock option values depend upon a higher level of earnings each reporting period. The rationalization that it is a \"one-time request\" is typically given by 1 superiors to convince an accountant to go along with the fraud, but rarely does it actually work that way. Once a company starts to manipulate its earnings, it begins the slide down the proverbial ethical slippery slope, and often there is no turning back. A misstatement of earnings in one year cre- ates pressure to maintain the illusion of 2 higher earnings the next year, and so on, until the bubble bursts. The WorldCom fraud represents a good example of financial fraud resulting from subordinating professional judgment to a superior in violation of the integrity rule. In that case, Betty Vinson was a midlevel internal accountant pressured by her superiors to record expenditures for annual costs to access telecommunications capacity from other providers as capital costs and to amortize them over a period of years, rather than expense them annually, which would have reduced earnings in full each year. In its investigation of Vinson, the SEC found that she and other WorldCom employees caused the company to materially overstate its earnings in violation of GAAP [Accounting and Auditing Enforcement Release (AAER) 1686, http://www.sec.gov/litigation/ admin/33-8158.htm]. Integrity can also be compromised when providing nonattest services. For example, assume that a taxpayer fails to inform a tax OCTOBER 2014 / THE CPA JOURNAL preparer of an amount of earned income for the current year. The tax preparer confronts the client on this issue, based on the fact a similar item was included in taxable income in the previous year. The client tells the tax preparer not to record it this year because of the excessively high level of earned income and reminds the preparer there is no Form W-2 or Form 1099 evidencing the earnings. The taxpayer adds that the advisor will not get to audit the company's books anymore if she does not give in to the client's wish- es. To avoid subordination of judgment, the tax preparer should not allow the client to dictate how the tax rules will be applied. A tax professional should never lose sight of the integrity standard or allow pressure to compromise objective judgment. Clarification of Scope: Rule 102 and Interpretation 102-4 Prior to August 31, 2013, most people believed that Interpretation 102-4 applied only to internal accountants and auditors and did not provide specific guidance for external auditors in client-service situations. But the Interpretation has been broadened in scope to include external auditor-client disagreements, as well as differences of opinion within the external auditor CPA firm over proper accounting. In addition, the integrity and objectivity standard now includes considerations of self-interest, familiarity, and undue influence threats to compliance with Rule 102. A violation of integrity and objectivity would occur even when there is no internal disagreement (i.e., the external auditor CPA firm unanimously supports a client position because the CPA firm subordinated its collective judgment). Interpretation 102-4 provides express guidance to minimize or avoid subordination of judgment when differences exist on accounting matters that would be material information to users of the financial statements. Such differences of opinion could arise 1) between subordinates and superiors in the company issuing financial state- ments, 2) within the external auditor CPA firm, or 3) between the company's man- agement and the external auditor. This rule applies to CPAs employed as accountants or internal auditors in industry as well as those serving in an external audit function at CPA firms. This discussion will explain the rules under revised Interpretation 102-4 and explore the recommended safeguards to avoid or reduce to an acceptable level subordination of judgment in violation of the integrity rule. CPAs should be aware of these changes because they require new considerations that go beyond previous guidance. Confidentiality Considerations When contentious differences of opinion with management occur and management refuses to make the required adjustments, the CPA should consider whether safeguards exist, similar to the original Interpretation 102-4, in order to ensure that threats to compliance with Rule 102 are eliminated or reduced to an acceptable level. In doing so, a CPA should determine whether internal reporting requirements exist to report differences of opinion (i.e., the audit committee) and any responsibilities that might exist to communicate with third parties, such as regulatory authorities or the employer's (former employer's) external accountant. These are important steps because of the implications of such actions for any possible violation of the confidentiality rule (Rule 301) of the AICPA Code of Professional Conduct. CPAs should seek legal advice with regard to this matter. If a CPA concludes that safeguards cannot eliminate or reduce the threats to integrity and objectivity to an acceptable level, or if other appropriate action has not been taken, then the CPA should consider whether the relationship should be terminated, including possible resignation. These steps are necessary to eliminate exposure to subordination. CPAs' Obligations to Third Parties Nothing in Interpretation 102-4 precludes an individual from resigning from a CPA firm or other employer; however, resignation does not negate a CPA's disclosure responsibilities to third parties. Although Rule 301 states that \"a member in public practice shall not disclose any confidential client information without the specific consent of the client,\" it also provides that the confidentiality requirement should not be construed to prohibit a member's \"compliance with applicable laws and government regulations.\" Application of the exception to Rule 301's disclosure prohibition provisions is appropriate when, for example, an auditor reports an illegal act, such as fraudulent financial statements, to client management and man- agement takes no action. The auditor should then report the matter to the board of directors; if the board fails to inform the SEC within the prescribed time period (one day from notification), the auditor must report its conclusions directly to the SEC as required by section 10A of the Securities Exchange Act of 1934. Responsibilities under the Dodd-Frank Act The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 describes conditions pursuant to which CPAs employed by an independent audi- tor of a public company can make a whistleblower submission, alleging that 1) the auditor/audit firm failed to assess, investigate, or report wrongdoing in accor- dance with section 10A of the Securities Exchange Act of 1934, or 2) that the auditor failed to comply with other pro- fessional standards. Although the provi- sions of the DoddFrank Act are beyond the scope of the article, it is worth men- tioning that action taken under the act by an employee of an external audit CPA firm would fall within the exception to the con- fidentiality provisions of Rule 301, per- mitting disclosures when required by appli- cable laws and government regulations. Expanded Requirements Revised Interpretation 102-4 under Applicability to external auditors. Revised Interpretation 102-4 now applies to external CPA auditors, as well as internal CPA accountants and auditors, when differences of opinion exist between external auditors and senior client management or between subordinate internal accountants or auditors and senior management on material accounting issues. The revision recognizes that such differences, previously restricted to internal client matters, might lead to pressures imposed by accounting firm superiors on an engage- ment team member because firm man- agement is unwilling to reexamine its own conclusions regarding an accounting posi- tion that would result in a materially dif- ferent result. The following are other provisions of Interpretation 102-4 that expand the requirements to external auditor-CPA firm differences. (Most were applicable to inter- nal accountants and auditors prior to the revision of Interpretation 102-4.) n Requirement to document understanding of the facts, accounting principles, auditing or other professional standards, applicable laws and regulations, and discussions with relevant parties on differences of opinion n Inclusion of auditing standards and other relevant professional standards applicable to tax and consulting services and applicable laws or regulations, in addition to consideration of differences on accounting and financial reporting matters n Consideration of threats to integrity and objectivity, including those resulting from self- interest, familiarity, and undue influence Application of appropriate safeguards to avoid subordination of judgment when a CPA concludes that the difference of opinion creates significant threats to integrity and objectivity n Assessment of the significance of identified threats that occur as a result of a posi- tion taken by a supervisor or other memn EXHIBIT 1 Ethical Responsibilities of CPAs to Avoid Subordination of Judgment Does the supervisor's opinion at the reporting entity or external audit firm fail to comply with professional standards, create a material misrepresentation of fact, or violate applicable laws or regulations? No No action required yes Discuss concerns with supervisor about the significant threats to integrity and objectivity Adjustment made Still No Adjustment Bring concerns to higher levels of management of reporting entity (i.e., senior management/board of directors) or audit firm Consider the following safeguards to ensure that threats to compliance with Rule 102 are eliminated or reduced to an acceptable level: n Determine whether internal reporting requirements exist to report differences of opinion n Determine whether any responsibilities exist to communicate with third parties (i.e., regulatory authorities, employer's or former employer's external accountant) n Seek legal advice No safeguards exist to eliminate or reduce the threats to an acceptable level or appropriate action was not taken n Consider continuing relationship with organization n Take appropriate steps to eliminate exposure to subordination of judgment End process Document understanding of the facts, accounting principles, auditing standards, and applicable laws and regulations n Consider resigning position (this may not negate disclosure responsibilities to regulatory authorities or external accountant) Note: Exhibit 1 was developed by the author from revised Interpretation 102-4. ber of management (whether at the client company or external auditor) with respect to applicable standards, laws, or regulations n Evaluation of whether such a position results in a material misrepresentation of fact or violation of applicable laws and reg- ulations; if so, the internal accountant or staff external auditor should seek to resolve the significant threat by discussing concerns with a supervisor or relevant member of management or with those charged with governance n Documentation of the CPA's conclusion on whether appropriate action was taken to resolve the concern and, if not, whether con- sideration of safeguards was given to ensure that threats to integrity and objectivity are eliminated or reduced to an acceptable level n Determination of any additional steps required under the internal policies and pro- cedures of the client company or the exter- nal auditor to report differences of opinion n Determination of reporting responsibilities to third parties, if applicable, and whether any communication of confidentiality to the internal accountant/auditor or external accountant is required n Determination of whether conduct, absent express communications, constitutes acts discreditable to the profession or \"unprofessional conduct\" (see, for example, section 29.10 of the New York State Board of Regents' rules) n Consider whether to continue the relationship with the organization n Take appropriate steps to eliminate exposure to subordination of judgment n Consider resigning position; this may not negate disclosure responsibilities to regulatory authorities or the external accountant. Applicability to nonattest services. The differences of opinion identified in Interpretation 102-4 go beyond accounting and auditing services and include tax and consulting services. As previously mentioned, when there is a difference of opinion between a tax advisor and a client (notwithstanding the realistic possibility of success standard in Interpretation 1-1 of the Statements on Standards for Tax Services), a CPA should consider whether threats to integrity and objectivity might exist because of undue influence by a client who threatens to replace the audit firm unless the firm reports the tax item as desired. Consider a consulting engagement where a CPA is asked to evaluate the suitability of a new software package for a client, and one of the choices includes the firm's own package. If only nonattest services are performed for the client, the CPA firm can make such an evaluation but must adhere to the AICPA rules of conduct, including integrity, objectivity, and due care. For example, CPA selects a competitor's package but is pressured by supervisors to select the CPA firm's package, even though it ranked lower on technical aspects and support services. If superior supervisor informs the CPA that firm management is trying to promote its own product, this could represent a threat to the integrity and objectivity of the process. The CPA might be expected to be a team player and go along with the firm's position. The appropriate safeguard is to have an independent process in place to review software recommendations when the CPA firm's package is involved in the final selection. Evaluating Threats and Safeguards The conceptual framework for AICPA independence standards provides a riskbased approach to considerations of whether independence has been impaired (ET section 100-1). Interpretation 102-4 follows the same approach to evaluate threats and safeguards related to integrity and objectivity; therefore, the basics of the approach are important to ensure the accountant or auditor does not subordinate judgment. Exhibit 1 depicts the decision-making process under revised Interpretation 102-4 in order to assist CPAs in understanding and applying the complexities of the guidance. The approach involves the following steps. Identify and evaluate threats to integrity and objectivity. When threats are identified, the first step should be to evaluate whether the threats would materially compromise the CPA's professional judgment if they were not addressed. If the threat is at an acceptable level, then consideration of safeguards by the CPA staff is not necessary. Safeguards are considered to be at an acceptable level if it is not reasonable to expect that the threats would compromise professional judgment; if threats might compromise professional judg- ment, safeguards should be implemented. Determine whether safeguards already eliminate or sufficiently mitigate identified threats. If sufficient safeguards exist to mitigate the potential effects of threats to integrity and objectivity, then these threats are not considered a potential influ- ence on the ability of a CPA to act with integrity and objectivity, even in situa- tions when legitimate differences of pro- fessional judgment and interpretation exist on an accounting, auditing, or other matter of professional standards. Determine whether threats that have not yet been mitigated can be eliminated or sufficiently mitigated by safeguards. Threats that exist and are not mitigated by existing procedures require additional safeguards to deal with the possible impairment of integri- ty and objectivity. Such safeguards are not enumerated in the AICPA's conceptual frame- work or Interpretation 102-4, but could include an anonymous hotline to report differences of opinion that might be resolved internally. These threats have been sufficiently mitigat- ed if, after application of the safeguards, it is reasonable to expect that they would not com- promise professional judgment. If no safe- guards are available or if appropriate safe- guards cannot be applied to eliminate an unac- ceptable threat or reduce it to an acceptable level, integrity and objectivity would be impaired. Self-Interest, Familiarity, and Undue Influence Threats Under Interpretation 102-4, if differences of opinion on accounting, auditing, or regulatory matters exist between a CPA and a supervisor, member of top management at the reporting organization, or member of senior management at the CPA firm, the CPA should consider whether threats exist that might compromise integrity and objectivity. Although threats can materialize in many forms, those recognized in Interpretation 102- 4 are generally characterized as self-interest, familiarity, and undue influence. Relationship of threats to integrity and objectivity to independence. Threats to independence are recognized in the con- ceptual framework for AICPA indepen- dence standards (ET section 100-1). The framework uses a risk-based approach to assess whether a relationship between the CPA and client management imposes an unacceptable risk to independence in vio- lation of Rule 101. The framework also helps to evaluate whether differences of opinion that relate to the application of accounting principles, auditing standards, or other relevant professional standards (including standards applicable to tax and consulting services or applicable laws or regulations) create a threat to the CPA's compliance with Rule 102. Interpretation 102-4 extends the notion of threats to inde- pendence to integrity and objectivity. This makes sense, because if integrity and objectivity are impaired, it is virtually impossible to be independent at least in appearance, if not substance. Similar to the independence standard, the assessment of whether integrity and objectivity are impaired depends upon the nature of the threat; whether it would be reasonable to expect that the threat would compromise the CPA's professional judgment; and, if so, whether the specific safeguards applied and their effectiveness reduce or eliminate the threat. The threats to integrity and objectivity have one common element: the attempt by a superior to influence the professional judgment of subordinates. For example, if a difference of opinion exists between a CPA (controller) and her supervisor (CFO), then it is possible that the CFO will threat- EXHIBIT 2 Examples of Threats to Integrity and Objectivity Threat Example Self-Interest Threat The CPA or CPA firm might be influenced by a business relationship that exists with the client that creates a mutuality of interests. Familiarity Threat The CPA or CPA firm might be influenced by a close personal relationship with the client, for example, if a member of the engagement team has an immediate family member who serves in a financial reporting role with the client entity. Undue Influence Threat The CPA is coerced by the client or senior management of the CPA firm to accept the client's position on an accounting, auditing, or regulatory matter. EXHIBIT 3 Examples of Safeguards that Eliminate or Reduce Threats to an Acceptable Level Created by the profession/legislation/regulation External review of a CPA firm's quality control system. Implemented by the attest client A governance structure (i.e., audit committee) to ensure appropriate decision mak- ing, oversight, and communications regarding a CPA firm's services. Implemented by the firm Documented independence policies regarding the identification of threats, evaluation of their significance, and identification and application of safeguards to eliminate the threats or reduce them to an acceptable en to withhold the bonus allocated for the controller unless she defers to the CFO's desired accounting treatment. Interpretation 102-4 would characterize this threat as a self-interest threat. The CFO might go further and try to coerce the controller into compromising her integrity by threatening to fire her if she refuses to defer to his proposed accountingan undue influence threat to integrity and objectivity. Examples of threats to integrity and objectivity. Exhibit 2 characterizes differing hypothetical examples of threats to integrity and objectivity that can result from differences of opinion between a subordinate CPA and a superior. The examples, derived from ET section 100-1, could apply to internal accountants and auditors, as well as to external auditors. Safeguards to Protect against Subordination of Judgment The AICPA's conceptual framework identifies safeguards that might help mitigate threats to independence. Because such threats can compromise independence, it makes sense for CPAs to consider some of the same safeguards that exist when there is a difference of opinion on an account- ing matter and when threats exist to integri- ty and objectivity. According to the conceptual framework in ET section 101-1, safeguards are controls that eliminate or reduce threats to independence. To be effective, safeguards should eliminate the threatening behavior or reduce the threat's potential to impair independence and, by extension, integrity and objectivity, to an acceptable level. The conceptual framework indicates that a variety of factors should be considered when assessing the effectiveness of safeguards. While Interpretation 102-4 does not expressly extend the independence safeguards to integrity and objectivity threats, the application of the safeguards to issues of integrity and objectivity enable a CPA or CPA firm to consider whether a safeguard sufficiently reduces or eliminates the potential for the threat to lead to a subordination of judgment. According to the conceptual framework, the effectiveness of a safeguard depends upon many factors, including the following: The facts and circumstances specific to a particular situation n The proper identification of threats n Whether the safeguard is suitably designed to meet its objectives n The parties that will be subject to the safeguard n How the safeguard is applied n The consistency with which the safeguard is applied n Who applies the safeguard (i.e., by professional standard, legislation, or regulation; by the attest client; or by the CPA firm). The appropriateness of safeguards identified in ET section 101-1 depends upon the facts and circumstances. Safeguards are implemented by three sources: 1) the profession, legislation, or regulation; 2) the attest client; and 3) the CPA firm, all of which provide policies and procedures to imple- ment professional and regulatory require- ments. Exhibit 3 provides an example of a safeguard in each category. The safeguards most appropriate when evaluating threats to independence are those instituted by the company itself and the ones adopted by the CPA firm. ET section 101-1 builds on AICPA Statement on Quality Control Standards (SQCS) 8, A Firm's System of Quality Control, which addresses engagement quality control review criteria and that is identified as a safeguard. SQCS 8 requires a procedure to resolve differences within the engagement team; with those consulted; and, when applicable, between the engagement partner and the engagement quality reviewer. The procedures should enable a CPA to document disagreements, conclusions reached and their implementation, and the release of the audit report only after the matter has been resolved. The safeguards that can be implemented by the firm, as identified in ET section 101-1, include policies and procedures designed to implement and monitor quality control in an attest engagement and the designation of some- one from senior management to oversee adequate functioning of the firm's quality control system. n The effectiveness of a safeguard depends upon the internal controls and corporate governance system in place. When differences exist between a controller and CFO, internal controls should provide a mechanism to deal with such situations for example, taking the matter to the audit ment), quality controls should be in place to handle the matter, such as by taking it to a reviewing partner. A \"Threats and Safeguards\" Approach The AICPA's Professional Ethics Executive Committee (PEEC) revised the AICPA Code of Professional Conduct in March 2013, effective for attest engagements covering periods beginning on December 15, 2014. The revised code uses a \"threats and safeguards\" approachthe conceptual framework approach discussed above. The revised code sections also are separated into two conceptual frameworks one for members in public practice and one for members in industry. The conceptual framework approach included in these two frameworks is a way of identifying, evaluating, and addressing threats to compliance with the rules that result from a specific relationship or circumstance that is not otherwise addressed in the code. The threats and safeguards approach helps to identify, evaluate, and address threats to compliance, with ethics rules that result from specific relationships between CPAs and their superiors, whether in public practice or industry. This approach can serve as a foundation for making ethical decisions, when possible threats to independence and integrity and objectivi- ty exist, in cases where there are differ- ences of opinion on an accounting or finan- cial reporting matter. Upholding Ethics Integrity and objectivity go hand and hand. CPAs lose their objectivity when they allow threats imposed by a superior to influence them to go along with accounting and financial reporting treatments that do not conform to GAAP. Integrity and objectivity represent the backbones of CPAs' ethical value systems and enable them to withstand the pressure to acquiesce against their better judgment. Interpretation 102-4 now provides the guid- ance necessary to help CPAs identify threats to integrity and objectivity, as well committee. When the difference is between an individual CPA and firm management (i.e., partner in charge of the engage- as to apply safeguards to eliminate or reduce such threats to acceptable levels. q Steven Mintz, DBA, is a professor of accounting in the Orfalea College of Business, California Polytechnic State University, San Luis Obispo, Calif. SECURITIES AND EXCHANGE COMMISSION 17 CFR Parts 240 and 249 [Release No. 34-64545; File No. S7-33-10] RIN 3235-AK78 Implementation of the Whistleblower Provisions of Section 21F of the Securities Exchange Act of 1934 AGENCY: Securities and Exchange Commission (\"Commission\"). ACTION: Final rule. SUMMARY: The Commission is adopting rules and forms to implement Section 21F of the Securities Exchange Act of 1934 (\"Exchange Act\") entitled \"Securities Whistleblower Incentives and Protection.\" The Dodd-Frank Wall Street Reform and Consumer Protection Act, enacted on July 21, 2010 (\"Dodd-Frank\"), established a whistleblower program that requires the Commission to pay an award, under regulations prescribed by the Commission and subject to certain limitations, to eligible whistleblowers who voluntarily provide the Commission with original information about a violation of the federal securities laws that leads to the successful enforcement of a covered judicial or administrative action, or a related action. Dodd-Frank also prohibits retaliation by employers against individuals who provide the Commission with information about possible securities violations. EFFECTIVE DATE: August 12, 2011 FOR FURTHER INFORMATION CONTACT: Sean X. McKessy, Securities and Exchange Commission, Division of Enforcement, 100 F Street NE, Washington, DC 20549, Tel. (202) 551-4790, Fax (703) 813-9322. SUPPLEMENTARY INFORMATION: We are adopting new rules 21F-1 through 21F17, and new Forms TCR and WB-APP, under the Securities Exchange Act of 1934. TABLE OF CONTENTS I. II. Background and Summary Description of the Rules A. Rule 21F-1 -- General B. Rule 21F-2 -- Definition of a Whistleblower C. Rule 21F-3 -- Payment of Award D. Rule 21F-4 -- Other Definitions 1. Voluntary submission of information 2. Original information 3. Definition of independent knowledge 4. Definition of independent analysis 5. Rule 21F-4(b)(i) through (vi) -- Exclusions from Independent Knowledge and Independent Analysis (a.) Attorney-client privilege and other attorney conduct (b.) Responsible company personnel, compliance processes and independent public accountants (i) Proposed Rule 21F-4(b)(4)(iii) (ii) Proposed Rules 21F-4(b)(iv) and (v) (iii) Final Rules 21F-4(b)(4)(iii) and (v) a. Rules 21F-4(b)(4)(iii)(A) through (C) b. Rule 21F-4(b)(4)(iii)(D) c. Rule 21F-4(b)(4)(v) (c.) Conviction for Violations of Law (d.) Rule 21F-4(b)(4)(vi) - Information Obtained from Excluded Persons 6. Original source 7. Original source; additional information 8. Original source: Lookback 9. Information that Leads to a Successful Enforcement 10. Action 11. Monetary Sanctions 12. Appropriate Regulatory Agency 13. Appropriate Regulatory Authority 14. SRO E. Rule 21F-5 -- Amount of Award -2- F. G. H. I. J. III. IV. V. VI. I. Rule 21F-6 -- Criteria for Determining Amount of Award Rule 21F-7 -- Confidentiality of Submissions Rule 21F-8 -- Eligibility Rule 21F-9 -- Procedures for Submitting Original Information Rule 21F-10 -- Procedures for Making a Claim Based on a Successful Commission Action K. Rule 21F-11 -- Procedure for Making a Claim Based on a Successful Related Action L. Rule 21F-12 & 13 -- Materials that May be Used as the Basis for an Award Determination and that May Comprise the Record on Appeal; Right of Appeal M. Rule 21F-14 -- Procedures Applicable to Payment of Awards N. Rule 21F-15 -- No Amnesty O. Rule 21F-16 -- Awards to Whistleblowers who Engage in Culpable Conduct P. Rule 21F- 17 -- Staff Communications with Whistleblowers Paperwork Reduction Act Economic Analysis Regulatory Flexibility Act Certification Statutory Authority Background and Summary Section 922 of Dodd-Frank added new Section 21F to the Exchange Act, entitled \"Securities Whistleblower Incentives and Protection.\" 1 Section 21F directs that the Commission pay awards, subject to certain limitations and conditions, to whistleblowers who voluntarily provide the Commission with original information about a violation of the securities laws that leads to the successful enforcement of an action brought by the Commission that results in monetary sanctions exceeding $1,000,000. On November 3, 2010, we proposed Regulation 21F to implement new Section 21F. 2 The rules contained in proposed Regulation 21F defined certain terms critical to the operation of the whistleblower program, outlined the procedures for applying for 1 Pub. L. No. 111-203, 922(a), 124 Stat 1841 (2010). 2 Proposed Rules for Implementing the Whistleblower Provisions of Section 21F of the Securities and Exchange Act of 1934, Release No. 34-63237 (\"Proposing Release\"). -3- awards and the Commission's procedures for making decisions on claims, and generally explained the scope of the whistleblower program to the public and to potential whistleblowers. We received more than 240 comment letters and approximately 1300 form letters on the proposal. 3 Commenters included individuals, whistleblower advocacy groups, public companies, corporate compliance personnel, law firms and individual lawyers, academics, professional associations, nonprofit organizations and audit firms. The comments addressed a wide range of issues. Many commenters provided views on an issue we highlighted in the proposing release - the interplay of the whistleblower program and company internal compliance processes. Commenters also expressed a range of views on other significant issues, including the proposed exclusions from award eligibility for certain categories of individuals or types of information, the availability of awards to culpable whistleblowers, the procedures for submitting information and making a claim for an award, and the application of the statutory antiretaliation provision. As discussed in more detail below, we have carefully considered the comments received on the proposed rules in fashioning the final rules we adopt today. We have made a number of revisions and refinements to the proposed rules. Taken together, we believe these changes will better achieve the goals of the statutory whistleblower program and advance effective enforcement of the federal securities laws. The 3 The public comments we received are available at http://www.sec.gov/comments/s7-33-10/s73310.shtml. In addition, to facilitate public input on the DoddFrank Act, the Commission provided a series of e-mail links, organized by topic, on its website at http://www.sec.gov/spotlight/regreformcomments.shtml. -4- revisions of each proposed rule are described in more detail throughout this release, but the following are among the most significant: Internal Compliance: A significant issue discussed in the Proposing Release was the impact of the whistleblower program on companies' internal compliance processes. While we did not propose a requirement that whistleblowers report through internal compliance processes as a prerequisite to eligibility for an award, we requested comment on this topic, and we included in the proposed rules several other elements designed to encourage potential whistleblowers to utilize internal compliance. Commenters were sharply divided on the issues raised by this topic. After considering these different viewpoints, we have determined not to include a requirement that whistleblowers report violations internally, but we have made additional changes to the rules to further incentivize whistleblowers to utilize their companies' internal compliance and reporting systems when appropriate. o With respect to the criteria for determining the amount of an award, the final rules expressly provide: first, that a whistleblower's voluntary participation in an entity's internal compliance and reporting systems is a factor that can increase the amount of an award; and, second, that a whistleblower's interference with internal compliance and reporting is a factor that can decrease the amount of an award. o The final rules contain a provision under which a whistleblower can receive an award for reporting original information to an entity's internal compliance and reporting systems, if the entity reports information to the -5- Commission that leads to a successful Commission action. Under this provision, all the information provided by the entity to the Commission will be attributed to the whistleblower, which means that the whistleblower will get credit -- and potentially a greater award -- for any additional information generated by the entity in its investigation. o The final rule extends the time for a whistleblower to report to the Commission after first reporting internally and still be treated as if he or she had reported to the Commission at the earlier reporting date. We proposed a \"lookback period\" of 90 days after the whistleblower's internal report, but in response to comments, we are extending this period to 120 days in the final rules. Procedures for Submitting Information and Claims: The proposed rules set forth a two-step process for submitting information, which required the submission of two different forms. In response to comments that urged us to streamline the procedures for submitting information, we have adopted a simpler process, combining the two proposed forms into a single Form TCR that would be submitted by a whistleblower under penalty of perjury. With respect to the claims application process, we have made one section of that form optional to make the form less burdensome. We also describe in greater detail below several other features of the process to assist whistleblowers that we expect will become part of the Office of the Whistleblower's standard practice. Aggregation of smaller actions to meet the $1,000,000 threshold: The proposed rules stated that awards would be available only when the Commission -6- had successfully brought a single judicial or administrative action in which it obtained monetary sanctions of more than $1,000,000. In response to comments, we have provided in the final rules that, for purposes of making an award, we will aggregate two or more smaller actions that arise from the same nucleus of operative facts. This will make whistleblower awards available in more cases. Exclusions from award eligibility for certain persons and information: The proposed rules set forth a number of exclusions from eligibility for certain categories of persons and information. In response to comments suggesting that some of these exclusions were overly broad or unclear, we have revised a number of these provisions. Most notably, the final rules provide greater clarity and specificity about the scope of the exclusions applicable to senior officials within an entity who learn information about misconduct in connection with the entity's processes for identifying, reporting, and addressing possible violations of law. II. Description of the Rules A. Rule 21F-1 - General Rule 21F-1 provides a general, plain English description of Section 21F of the Exchange Act. It sets forth the purposes of the rules and states that the Commission's Office of the Whistleblower administers the whistleblower program. In addition, the rule states that, unless expressly provided for in the rules, no person is authorized to make any offer or promise, or otherwise to bind the Commission with respect to the payment of an award or the amount thereof. -7- B. Rule 21F-2 - Definition of a Whistleblower a. Proposed Rule As proposed, Rule 21F-2(a) defined a whistleblower as an individual who, alone or jointly with others, provides information to the Commission relating to a potential violation of the securities laws. Under the proposed rule, a company or another entity could not qualify as a whistleblower. Paragraph (b) of the proposed rule stated that the anti-retaliation protections set forth in Section 21F(h)(1) of the Exchange Act would apply irrespective of whether a whistleblower satisfied all the procedures and conditions to qualify for an award under the Commission's whistleblower program. Similarly, the protections against retaliation applied to any individual who provided information to the Commission about a potential violation of the securities laws. Paragraph (c) of the proposed rule stated that, to be eligible for an award, a whistleblower must submit original information to the Commission in accordance with all the procedures and conditions described in Proposed Rules 21F-4, 21F-8, and 21F-9. b. Comments Received Commenters advanced a number of suggestions to refine the definition of \"whistleblower.\" Many commenters agreed that the definition of \"whistleblower\" should not turn on whether a violation of the securities laws is ultimately adjudged to have occurred, 4 but expressed differing opinions on our proposal to use the term \"potential violation.\" One commenter agreed that the whistleblower definition should include the 4 See, e.g., letters from Committee on Federal Regulation of Securities, Section of Business Law, American Bar Association (\"ABA\"); Project of Government Oversight (\"POGO\"); Jones Day; Wells Fargo Advisors, LLC (\"Wells Fargo\"); and Society of Corporate Governance Professionals. -8- term \"potential violation\" because this would allow broad application of the antiretaliation measures in Section 21F. 5 Several other commenters recommended that the term \"potential violation\" should be coupled with a requirement that the individual have a \"reasonable belief\" or \"good faith belief\" that the information relates to a securities law violation. 6 Some commenters suggested instead of the term \"potential violation,\" we should use the terms \"probable violation,\" \"likely violation,\" or \"claimed violation.\" 7 On other aspects of the definition of whistleblower, one commenter recommended that we clarify that a \"violation of the securities laws\" relates only to the federal securities laws and not to violations of state or foreign securities laws. 8 A few commenters recommended that a whistleblower be limited to a person who provided information relating to a \"material\" violation of the securities laws. 9 Two commenters disagreed with the proposed rule's limiting whistleblower status to natural persons, 10 suggesting that non-governmental organizations and/or worker representatives, including labor unions, should be permitted to bring claims. 11 5 See letter from POGO. 6 See, e.g., letters from Jones Day; Wells Fargo; and Morgan Lewis. As discussed further below in the text, commenters asserted that a \"reasonable belief\" or \"good faith\" standard is necessary to prevent employees from making bad-faith allegations of retaliation. 7 See, e.g., letters from ABA; Goodwin Procter. 8 See letter from ABA. 9 See, e.g., letters from ABA; and Society of Corporate Secretaries and Governance Professionals (\"Society of Corporate Secretaries\"). 10 See, e.g., joint letter from Voices for Corporate Responsibility, Change to Win, National Employment Lawyers Association, Government Accountability Project (\"VOICES\"); and Mike G. McCluir. 11 See letter from VOICES. -9- A number of commenters responded to our request for comment on whether we should limit the definition of \"whistleblower\" to a person who provides information regarding violations of the securities laws \"by another person\"some favoring this, 12 others opposing it. 13 Several of the commenters recommended that we limit the whistleblower definition based on an individual's relative culpability for the reported violation. For example, some commenters stated that the definition of \"whistleblower\" should cover only individuals who report violations by another person, and who did not participate in or facilitate the violations. 14 Commenters made several suggestions relating specifically to the scope of the anti-retaliation protections. Among other things, commenters recommended that we expressly state in the rules that the anti-retaliation provisions do not apply to an individual if (1) he files a false, fraudulent, or bad faith and meritless submission; 15 (2) he lacks a good faith or reasonable belief of a violation; 16 or (3) the submission does not 12 See letters from Chris Barnard; Thompson Hine LLP; William A. Jacobson, Angel Prado, and Yaozhi Ye (\"Cornell Securities Law Clinic\"); Evolution Petroleum Corp.; Securities Industry and Financial Markets Association (\"SIFMA\"); The Washington Legal Foundation; Morgan Lewis; Continewity LLC; Davis Polk & Wardwell LLP (\"Davis Polk\"); Oppenheimer Funds. 13 See, e.g., letters from Grohovsky, Vogel, and Lambert (\"Grohovsky Group\"); Peter van Schaick. 14 See, e.g., joint letter from Americans for Limited Government; Ryder Systems, Inc.; Financial Services Institute, Inc.; U.S. Chamber of Commerce; Verizon; and White & Case, LLP (\"Chamber of Commerce Group\"). 15 See, e.g., letters from Connolly & Finkel; National Association of Corporate Directors (\"NACD\"); Investment Company Institute (\"ICI\"); Valspar; Auditing Standards Committee of the Auditing Section of the American Accounting Association (\"Auditing Standards Committee\"); U.S. Chamber of Commerce Center for Capital Markets Competitiveness and the U.S. Chamber of Institute for Legal Reform (\"CCMC\"); joint letter from General Electric Company, Google, Inc., Honeywell, Inc., JPMorgan Chase & Co., Microsoft Corporation and Northrop Grumman Corporation (\"GE Group\"); Jones Day; TECO Energy. Two commenters suggested that the Commission should consider \"whether it can apply additional sanctions\" to any person who uses the whistleblower process in bad faith.\" See joint letter from the Financial Services Roundtable and the American Bankers Association (\"Financial Services Roundtable\"); letter from TECO Energy. 16 See letters from Chris Barnard; Paul Hastings. - 10 - evince a \"reasonable likelihood of a violation of securities laws.\" 17 Another commenter suggested the anti-retaliation provisions should only apply to those who qualify for an award. 18 Several commenters proposed that the anti-retaliation provisions should categorically exempt a company's adverse action against an employee based on factors other than whistleblower status, 19 such as engaging in culpable conduct, 20 failing to comply with the reporting requirements of a company's internal compliance programs, 21 or violating a professional obligation to hold information in confidence.\" 22 One commenter explained that, without a categorical exemption, the broad anti-retaliation provisions of the statute could prompt a \"wave of litigation\" alleging retaliation in such circumstances. 23 17 See letter from Goodwin Proctor. 18 See letter from NACD (commenting that not limiting anti-retaliation protection to those who satisfy the conditions for an award \"opens the door for employees to submit fake allegations that may cause reputational harm to the company and/or unfairly embarrass corporate employees and leadership\"). 19 See letters from Thompson Hine; Americans for Limited Government (\"ALG\"); AT&T; Equal Employment Advisory Council (\"EEAC\"); Connolly & Finkel; ICI; GE Group; Society of Corporate Secretaries; Association of Corporate Counsel; Financial Services Roundtable; Davis Polk; ABA; joint letter from Allstate Insurance Company, American Institute of Certified Public Accountants, American Insurance Association, Americans for Limited Government, Association of Corporate Counsel, AT&T, Center for Business Ethics, Dover Corporation, FedEx Corporation, Financial Services Institute, Inc., Pharmaceutical Research and Manufacturers of America, Retail Industry Leaders Association, Royal Caribbean Cruises Ltd, Ryder Systems, Inc., UPS, U.S. Chamber of Commerce, U.S. Chamber of Commerce Institute for Legal Reform, Verizon and White & Case, LLP (\"Allstate Group\"). 20 See letters from ALG; Allstate Group; Morgan Lewis; Davis Polk; ABA. 21 See letters from Thompson Hine; see also letters from ALG; Allstate Group; Connolly & Finkel; NACD; TECO Energy; Association of Corporate Counsel. 22 See letter from the ABA. 23 See letter from ALG; see also letter from Allstate Group. - 11 - Commenters made a series of other suggestions related to the scope and enforceability of the anti-retaliation protections, including that we should: (1) clarify our authority to bring enforcement actions based on retaliation; 24 (2) provide that the antiretaliation remedies may not be waived by any agreement, policy, or condition of employment; 25 and (3) exclude from anti-retaliation protection employees whose submissions are based on information that is either publicly disseminated or which the employee should reasonably know is already known to the company's board of directors or chief compliance officer, a court, the Commission or another governmental entity. 26 c. Final Rule In response to the comments, we have made several changes to the definition of whistleblower in Rule 21F-2(a) and the application of the anti-retaliation provisions in Rule 21F-2(b) to more precisely track the scope of Section 21F(h)(1). We are adopting Rule 21F-2(c) as proposed, but have re-designated it as Rule 21F-2(a)(2). With respect to the definition of whistleblower, we agree with those commenters who suggested that the term \"potential violation\" may be imprecise, and thus in the final rule have changed this to \"possible violation\" that \"has occurred, is ongoing, or is about to occur.\" We believe that this modification provides greater clarity concerning when an individual who provides us with information about possible violations, including possible future violations, of the securities laws qualifies as a whistleblower. An individual would 24 Letter from Alex Hoover; see also letters from Bryan Maloney; National Coordinating Committee for Multiemployer Plans (\"NCCMP\"). 25 See letter from Kaiser Saurborn & Mair. 26 See letter from ABA. - 12 - meet the definition of whistleblower if he or she provides information about a \"possible violation\" that \"is about to occur.\" Although some commenters recommended that we use the terms \"probable violation\" or \"likely violation,\" we have decided to use the term \"possible violation.\" In our view, this requires that the information should indicate a facially plausible relationship to some securities law violationfrivolous submissions would not qualify for whistleblower status. We believe that a higher standard requiring a \"probable\" or \"likely\" violation is unnecessary, and would make it difficult for the staff to promptly assess whether to accord whistleblower status to a submission. In the final rule, the definition of whistleblower clarifies that the submission must relate to a violation of the federal securities laws, or a rule or regulation promulgated by the Commission. An individual who submits information that relates only to a state law or foreign law violation would not satisfy the whistleblower definition. The final rule also clarifies that, to qualify as a whistleblower eligible for the award program and the heightened confidentiality provisions of Section 21F(h)(2) of the Exchange Act, an individual must submit his or her information to the Commission in accordance with the procedures set forth in Rule 21F-9(a). 27 Rule 21F-9(a) establishes procedures for an individual to mail, fax, or electronically submit to us information relating to a possible securities law violation. As proposed, our definition could have been misconstrued to apply to any individuals who provide us with information relating to a securities law violation, including individuals whom we subpoena and law 27 The statutory definition of \"whistleblower\" in Section 21F(a)(6) of the Exchange Act provides that the Commission may \"establish by rule or regulation\" the \"manner\" in which an individual provides the Commission information so as to qualify as a whistleblower for purposes of the awards program. - 13 - enforcement personnel from other governmental authorities. This result would have been outside the intended scope of Section 21F. We have not added a requirement that the information relate to a \"material\" violation of the securities laws. We believe that, rather than use a materiality threshold barrier that might limit the number of submissions to us, it is preferable for individuals to provide us with any information they possess about possible securities violations (irrespective of whether it appears to relate to a material violation) and for us to evaluate whether the information warrants action. 28 To the extent that commenters advanced this suggestion as a way to prevent individuals from abusing the anti-retaliation protections afforded by Section 21F(h) of the Exchange Act, we believe this issue is sufficiently addressed by the revisions to Rule 21F-2(b), discussed further below. To the extent that commenters suggested this approach as a way to reduce frivolous submissions, we believe our use of the term \"possible violation\" sufficiently addresses this concern. We have decided not to extend the definition of whistleblower beyond natural persons because we believe that this is consistent with the statutory definition, which provides that a whistleblower must be an \"individual.\" The ordinary meaning of \"individual\" is \"natural person,\" 29 and nothing in the statutory text or legislative history suggests a different meaning here. Although one commenter identified a reference to \"individuals\" in the False Claims Act to argue that the term should be read to extend beyond natural persons, we note that the False Claims Act otherwise repeatedly refers 28 We do not expect potential whistleblowers to make a fact-dependent materiality assessment. 29 See, e.g., Jove Engineering, Inc. v. I.R.S., 92 F.3d 1539, 1550-51 (11th Cir. 1996) (quoting BLACK'S LAW DICTIONARY 773 (6th ed. 1996), and WEBSTER'S NEW COLLEGIATE DICTIONARY 581 (8th ed. 1979)). - 14 - to whistleblowers as \"persons\" (which ordinarily extends beyond natural persons), 30 and we believe this explains the different result under that Act. 31 We have modified proposed Rule 21F-2(b)'s anti-retaliation protections, which are now in Rule 21F-2(b)(1). We are also adding Rule 21F-2(b)(2), which expressly states that the Commission may enforce the anti-retaliation provisions of Section 21F(h)(1) of the Exchange Act and any rules promulgated thereunder. Rule 21F-2(b)(1) provides that, for purposes of the anti-retaliation protections afforded by Section 21F of the Exchange Act, an individual is a whistleblower if (i) he possesses a reasonable belief that the information he is providing relates to a possible securities law violation (or, where applicable, to a violation of the provisions set forth in 18 U.S.C. 1514A(a)) that has occurred, is ongoing, or is about to occur, and (ii) he reports that information in a manner described in Section 21F(h)(1)(A). With respect to the first prong of this standard, the employee must possess a \"reasonable belief that the information he is providing relates to a possible securities law violation (or, where applicable, to a violation of the provisions set forth in 18 U.S.C. 30 Compare 31 U.S.C. 3730(e)(4)(B) with id. 3730(b)(1) (\"A person may bring a civil action ....\"), and id. 3730(b)(4)(B)(5) (\"When a person brings an action ....\"). 31 The ABA made several additional recommendations to clarify and/or narrow the definition of whistleblower. See letter from ABA. Specifically, the ABA recommended that we: (1) exclude from the definition individuals who provide information that is \"clearly stale (e.g., flawed disclosure in a ten-year old proxy statement); (2) require as part of the definition that the individual have a non-speculative \"basis in fact or knowledge\" to support the potential securities law violation; and (3) exclude from the definition individuals who provide information that is \"either publicly disseminated [already] or which the employee should reasonably know is already known to the company's board of directors or chief compliance officer, a court or the Commission or another governmental entity.\" With respect to clearly stale information, we believe that this is already addressed by the requirement that the information relate to a \"possible violation,\" because we view this term as encompassing a requirement that the violation must be potentially actionable, which would preclude plainly stale violations. Similarly, we believe that the \"possible violation\" requirement excludes submissions that have no \"basis in fact or knowledge.\" Finally, rather than addressing in the threshold definition of whistleblower information that is already publicly known, we have addressed this issue in Rule 21F-4 in the definition of \"original information.\" - 15 - 1514A(a)) 32 that has occurred, is ongoing, or is about to occur.\" The \"reasonable belief\" standard requires that the employee hold a subjectively genuine belief that the information demonstrates a possible violation, and that this belief is one that a similarly situated employee might reasonably possess. 33 We believe that requiring a \"reasonable belief\" on the part of a whistleblower seeking anti-retaliation protection strikes the appropriate balance between encouraging individuals to provide us with high-quality tips without fear of retaliation, on the one hand, while not encouraging bad faith or frivolous reports, or permitting abuse of the anti-retaliation protections, on the other. 34 This approach is consistent with the approach followed by various courts that have construed the anti-retaliation provisions of other federal statutes, including the False Claims Act, 35 to require that a whistleblower have a reasonable belief that he or 32 This parenthetical reflects the fact that the anti-retaliation protection afforded by Section 21F(h)(1)(A)(iii) includes not only reports of securities law violations, but also various other violations of federal law (e.g., 18 U.S.C. 1341, 1343, 1344, and 1348). 33 See, e.g., Livingston v. Wyeth, Inc., 520 F.3d 344, 352 (4th Cir. 2008); Clover v. Total Sys. Servs., Inc., 176 F.3d 1346, 1351 (11th Cir.1999). 34 See, e.g., Parker v. B&O R. Co., 652 F.2d 1012, 1020 (D.C. Cir. 1981) (holding, in Title VII retaliation case, that \"[t]he employer is sufficiently protected against malicious accusations and frivolous claims by a requirement that an employee seeking the protection of the opposition clause demonstrate a good faith, reasonable belief that the challenged practice violates Title VII\"); McDonnell v. Cisneros, 84 F.3d 256, 259 (7th Cir.1996) (\"There is nothing wrong with disciplining an employee for filing frivolous complaints\"); Hindsman v. Delta Airlines, 2010 DOL Ad. Rev. Bd. 58 LEXIS at *10 (ARB Jun. 30, 2010) (interpreting the anti-retaliation provisions of the Wendell H. Ford Aviation Investment and Reform Act, which explicitly excludes frivolous complaints and those brought in bad faith, as requiring a \"reasonable belief\" by the whistleblower that the violation of the statute has occurred). 35 See Fanslow v. Chi. Mfg, Ctr., 384 F.3d 469, 480 (7th Cir. 2004) (noting that several circuits had held that the relevant inquiry to determine whether an employee's actions are protected under the False Claims Act is whether \"(1) the employee in good faith believes, and (2) a reasonable employee in the same or similar circumstances might believe, that the employer is committing fraud against the government\") (citing Moore v. Cal. Inst. of Tech., Jet Propulsion Lab, 275 F.3d 838, 845 (9th Cir. 2002); Wilkins v. St. Louis, 314 F.3d 927, 933 (8th Cir. 2002), and McNeil v. Empl. Sec. Dep't, 2002 Wash. App. LEXIS 1900, at *15-*16 (Wash. Ct. App. Aug. 9, 2002) (same)). - 16 - she is reporting a violation of that statute even where the statute does not expressly require such a showing. 36 The second prong of the Rule 21F-2(b)(1) standard provides that, for purposes of the anti-retaliation protections, an individual must provide the information in a manner described in Section 21F(h)(1)(A). This change to the rule reflects the fact that the statutory anti-retaliation protections apply to three different categories of whistleblowers, and the third category includes individuals who report to persons or governmental authorities other than the Commission. Specifically, Section 21F(h)(1)(A)(iii) - which incorporate the anti-retaliation protections specified in Section 806 of the SarbanesOxley Act, 18 U.S.C. 1514A(a)(1)(C) - provides anti-retaliation protections for employees of public companies, subsidiaries whose financial information is included in the consolidated financial statements of public companies, and nationally recognized statistical rating organizations 37 when these employees report to (i) a federal regulatory or law enforcement agency, (ii) any member of Congress or committee of Congress, or (iii) a person with supervisory authority over the employee or such other person working 36 See, e.g., Calhoun v. United States Dep't of Labor (\"US DOL\"), 576 F.3d 201, 212 (4th Cir. 2009) (antiretaliation provisions of the Surface Assistance Transportation Act); Knox v. US DOL, 232 Fed. App. 255, 258-59 (4th Cir. 2007) (Clean Air