Despite everything you’ve read and heard about the applicability of the Sarbanes-Oxley Act (SOX) to nonprofit whistle-blowing, the 2002 law’s protections appear to offer flimsy protection from employer retaliation against nonprofit employees who identify misconduct. That’s why the creation of a corporate culture that values and protects nonprofit employee whistle-blowing—internal and external—is so important, because Sarbanes-Oxley falls far short of a whistle-blower’s suit of armor.

In the nonprofit, corporate, and even governmental realms today, the presumption is that Sarbanes-Oxley and various state laws protect whistle-blowers like Enron’s Sherron Watkins from legal retaliation, though not necessarily from vilification by colleagues and employers. SOX makes the firing of a whistle-blower a violation of federal law,

Whoever knowingly, with the intent to retaliate, takes any action harmful to any person, including interference with the lawful employment or livelihood of any person, for providing to a law enforcement officer any truthful information relating to the commission or possible commission of any Federal offense, shall be fined under this title or imprisoned not more than 10 years, or both.[1]

SOX intended the criminal penalty to prevent punitive whistle-blower firings, but what protections exist if an employee is fired anyway?

For federal government whistle-blowers covered by the Whistleblower Protection Act (WPA) and employees of publicly traded corporations “protected” under Sarbanes-Oxley, both laws contain defined avenues for aggrieved employees to take redress against retaliation. For nonprofit employees, where the SOX federal criminalization of whistle-blower retaliation covers nonprofit settings, the avenue for redress is less clear. That is, under SOX the nonprofit employee may have to take to federal court for protection, a high bar to jump that involves great expense, risk, and exposure. For many—and perhaps most potential nonprofit whistle-blowers—this is an effective barrier to action. No wonder so many of them opt for anonymous reporting.

Until Sarbanes-Oxley, whistle-blowers had to navigate their standing under various state whistle-blower protection laws, inconsistent from state to state and hardly ironclad. The typical trigger for protection of whistle-blowers from retaliation is reporting potential wrongdoing to an agency with some jurisdiction over the activity—and the whistle-blower’s reasonable belief that the reported wrongdoing is illegal. Whistle-blowing isn’t about complaining about a dislikable boss and his crummy management. It’s pointing out something that could reasonably be considered wrong and illegal.

For federal government whistle-blowers such as the FBI’s Colleen Rowley (who tried to warn her superiors about potential 9/11 terrorists), protection is supposed to come from the Whistle-blower Protection Act, plus an array of other laws. For the U.S. Office of Special Counsel to intervene in federal whistle-blowing retaliation cases, the law requires that a whistle-blower identify a violation of laws or regulation, abuse of authority, gross mismanagement, or danger to public health and safety (beyond the Sarbanes-Oxley focus on reporting illegalities, fraud, and factors that would adversely affect the interests of public corporation investors).

Sarbanes-Oxley not only invented a national standard of sorts for whistle-blowing in private-sector venues but also the criminalization of employer retaliation against whistle-blowers (replete with fines and imprisonment for corporate violators). However, the courts have narrowed definitions and coverage even in the short time since the enactment of SOX in 2002.

“Reasonable belief” that the wrongdoing is a crime is the whistle-blower’s first line of defense under Sarbanes-Oxley. It doesn’t require that the whistle-blower can cite the precise paragraph and subparagraph of the law that he believes has been violated or, in fact, that an actual crime has been committed; it requires only that the whistle-blower make the complaint in good faith with a reasonable belief that the wrongdoing is a violation of the law.

Given the lead-up to Sarbanes-Oxley involving Enron’s fraudulent financial systems, protected whistle-blowing includes pointing out serious deficiencies in internal financial controls, which can undermine investor interests. But if the conduct amounts simply to misspending that doesn’t adversely affect investors’ interests, that might not count as protected whistle-blowing. This question emerged recently in Welch v. Cardinal Bankshares Corporation,2 where the court held that the whistle-blowing CFO of a bank holding company “could not have reasonably believed” that the financial irregularities he pointed out constituted sufficient misinformation to misrepresent the firm’s financial condition to investors.

Nonetheless, an ill-motivated employer might still demote or terminate a legitimate whistle-blower. What happens then? The whistle-blower has to demonstrate that the employer knew (or should have known) that the whistle-blower was engaged in protected activity and that the employee’s whistle-blowing was a “contributing” component in the employer’s retaliation. This daunting hurdle puts the burden of proof on the whistle-blower and pits him against an employer’s deeper pockets and lawyers.

Whistle-blowing protections are especially tough for “at will” employees, who know that employers use lots of avenues to get rid of staff who aren’t covered by union or labor contracts or strong personnel policies. Remember, however, that at-will employees are protected against being fired in violation of civil rights provisions and in theory, whistle-blowing, though that requires reporting an employer’s fraudulent or illegal activities to the appropriate authorities, not simply complaining to friends, coworkers or even the press about employer misconduct.

Sarbanes-Oxley makes retaliation against whistle-blowers a federal crime, whether the venues are publicly traded corporations, smaller private companies, or private nonprofits. Despite occasional restrictions by Department of Labor administrative law judges and appellate courts on what gets protected in the corporate world and despite sometimes lackluster protections afforded by the Office of Special Counsel in the federal government, protected whistle-blowing is alive and well post-SOX.

Although, unlike whistle-blowing by employees in publicly traded corporations, there isn’t a specifically mandated review procedure applicable to nonprofit whistle-blowing. If nonprofit whistle-blowers are fired, they can report their allegations to the FBI and the U.S. Attorney’s Office, and they can sue an employer for improper termination. The case law has yet to fully interpret which nonprofit circumstances and employee whistle-blowing Sarbanes-Oxley covers. Consequently, you might be heartened by the application of SOX whistle-blowing coverage to nonprofit work settings, but your best redress against employer retaliation might be employment law protections.

Notwithstanding SOX, WPA, and various other state and federal statutes that reference whistle-blowing protections, a clearly stated whistle-blowing policy—adopted and enforced by a nonprofit organization’s board of directors—is crucial.

Ever wonder why Deep Throat, the Watergate whistle-blower, chose dark corners of underground parking garages for his meetings with Bernstein and Woodward? It took until nearly his death, when Deep Throat (aka Mark Felt) was suffering from Alzheimer’s, for his family to believe itself secure enough to reveal his identity. Some potential nonprofit whistle-blowers may believe that—despite the instituted protections like SOX and WPA—they need the crannies of murky garages to expose wrongdoing. To be sure, it’s still a tough world for the plucky whistle-blower.

1. Section 1107, “Retaliation Against Informants,” the Sarbanes-Oxley Act of 2002.
2. ‘For more on Welch v. Cardinal Bankshares Corporation, see and