According to the Dodd-Frank Act, "No employer may discharge, demote, suspend, threaten, harass, directly or indirectly, or in any other manner discriminate against, a whistleblower in the terms and conditions of employment."
So, while you may be angry enough to fire the guy that turned you in to the SEC, don't. You could be setting yourself and your business up for even more legal troubles and monetary sanctions.
Here are some do's and don'ts to help you avoid a whistleblower retaliation claim:
Create an Anti-Retaliation Policy -- Your business should have a clear written anti-retaliation policy. Set out what conduct is prohibited as retaliation, and what reporting conduct is encouraged. This policy should be included in your company's code of conduct and displayed prominently.
Encourage reporting -- If you fix an issue internally first, then there's less reason for the SEC or any of the other alphabet soup government agency to get involved. But, how are you going to fix an issue if you don't know about it? Encourage communication. Make your employees feel comfortable about reporting suspected wrongdoing. Facilitate reports by creating a clear process or assigning a designated person to take and investigate such reports.
Document, Document, Document -- Write everything down. Document the report. Document your investigation. Document the actions you took and didn't take, and your justifications. Should there be a retaliation claim later on, you'll have plenty of evidence to substantiate your decisions.
"Pretaliate" -- While you may take steps to encourage employees to report issues in-house first, you cannot prohibit reports directly to outside agencies. Confidentiality agreements that prohibit reports or require only in-house reports to "impede an individual from communicating directly" with the SEC are illegal and violate Dodd-Frank's Rule 21F-17.
Ignore reports -- You should make an effort to investigate or address every report. Don't ignore the reports and hope the issue goes away. Ignoring a report will look like you're trying to cover something up.
Forget to train -- Just because you don't take any retaliatory actions against whistleblowers, doesn't mean your managers and supervisors will know not to do so too Provide anti-retaliation training to managers and supervisors. Make sure they know what to do in case of a report, what actions constitute retaliation, and what not to do.
If an employee ever does bring a whistleblower retaliation claim against you, contact an experienced business attorney for help.