April 2, 2025

Why Do Public Biotechs Need Whistleblower Hotlines? (And What are Best Practices in Maintaining One?)

Third party-hosted whistleblower hotlines are now standard for newly public biotechs. Indeed, they are often included in the “subsidized IR infrastructure packages” that currently accompany listings on either NASDAQ or the NYSE.

As such, it’s worth taking a moment to think about why they are commonplace, and what best practice is in setting up and maintaining them.  

Why do I need a whistleblower hotline?

Many executives question why a public company needs a whistleblower hotline when they have already established an internal infrastructure (typically utilizing human resources, open-door policies and semi-annual/annual employee reviews, to name just a few) for reporting unethical or potentially unlawful activity.

One answer is that such systems can be ineffective because they fail to bring the issue to the very top of the company’s hierarchy, and that legitimate concerns might otherwise be inappropriately quashed or badly handled within the company’s lower ranks.

There is an even better answer however to the question posed – your employees have another, more nuclear option for reporting financial or otherwise inappropriate behavior within your organization: they can go straight to the SEC.

The SEC’s whistleblower program was established by Congress to incentivize individuals (not just employees) to share credible information about potential securities laws violations (or in other words fraud). Furthermore, Congress authorized the SEC to pay awards to people whose information leads to a fine of more than $1 million – with individuals receiving 10-30% for themselves.

How has that played out in the real world? Well, in 2024, the SEC awarded over $255 million (the third highest annual amount since the program was established in 2011) to 47 whistleblowers. Two of those whistleblowers shared an award of approximately $98 million. Since it began, the program has cumulatively paid out more than $2.2 billion to tipsters. So, the examples of fraud and the financial incentives to report them are very real.

Of course, no Board of Directors, C-suite, shareholders or employees ever think that illegal conduct or fraud can happen at their company. Until it does.

Thus, the biggest reason for biotechs having their own whistleblower hotline is to provide an alternative to the SEC’s version, which may give a company a chance to internally confirm, address and remedy suspected wrongdoing before it has the chance to escalate (and become material and thus reportable).

How do company whistleblower hotlines work?

• Whistleblower hotlines are typically visible to stakeholders on a biotech’s public website (with contact details often included in the company’s Corporate Governance charter on the IR portion of their website), via the company’s intranet, and in the company’s human resources handbook/materials.
• The hotline typically allows for a wWhy Doeb-form typed complaint or enables individuals to leave a recorded message (their voice is then masked, or the complaint is transcribed when the message is then forwarded), or both.
• Even though retaliation against whistleblowers is protected by law, corporate whistleblower hotlines offer anonymity to the tipster, providing them instead with a reference number for their complaint, which they can then check back on at a later date should they wish to do so.
• Once a complaint is made it is then forwarded to (typically) two individuals within a company that have a fiduciary duty – a legal and ethical obligation to act in the best interests of the company/shareholders. In practice, this typically means they go to the company’s CFO and a member of the company’s Board of Directors (often the Audit Chair). Over the years however, I’ve also seen Chief People Officers, a company’s General Counsel, and even external legal counsel be set up as recipients for complaints.

How often should whistleblower hotlines be tested?

In my experience, a lot of biotechs set their whistleblower hotline up before/at IPO and forget about it. They go about their new life as a public company and simply assume their whistleblower hotline is working because, well, complaints are rare, right? I mean, you wouldn’t expect to hear anything.

This is not good practice.

Best practice is to conduct four tests per year:

• For three out of the year’s four quarters, a company should send a test whistleblower complaint both via the company’s online web-form and via the dedicated telephone number provided. This should ensure that the system is working and provide practice for the two (or more) designated recipients of complaints.  
• Furthermore, once a year a company should conduct a test complaint via both web-form and telephone and have the two (or more) designated recipients for complaints log in to the online whistleblower portal to ensure they know their logins and passwords. They can then analyze and attest to summary statistics for the program for the year.

Common mistakes by biotechs relating to whistleblower hotlines

The most common mistakes relating to whistleblower hotlines typically involve personnel changes that make the program redundant:

• Complaint recipients forget their passwords for the online whistleblower portal.
• Complaint recipients leave the company and aren’t replaced, meaning that complaints only go to one person (which is suboptimal) or none at all if both leave (which is dire).
• Complaint recipients’ email addresses change (sometimes after a rebranding).
• Not publicizing the whistleblower program sufficiently internally, so that employees know and appreciate that they have an alternative to going straight to the SEC.

All of the above may seem like a hassle, but it is infinitely preferable to the alternative of an SEC investigation, which would likely have to be disclosed publicly, even if that investigation ended up concluding that no wrongdoing took place. By then the company’s reputation may already have been damaged, possibly beyond repair.

Lastly, academics argue that companies should match the SEC’s financial rewards for whistleblowers, so that employees aren’t financially disincentivized from using a company’s own hotline. In practice, I have never seen this used. Encouraging employees to behave ethically and be good corporate citizens is usually the better (and cheaper) route.