So, nearly 2 years ago your organization applied for and received COVID-relief funds. The decision was not an easy one. On the one hand, government largesse invariably comes with strings and uncertainties, i.e., risk. On the other hand, your organization faced an unprecedented triple threat crisis: financial, operational, and health. Consumer spending plummeted and its consequences rippled through the economy threatening to trigger a global financial meltdown. You could not possibly have forecast how the global pandemic would affect your organization.

The government responded with uncharacteristic speed, flooding the economy with easy money. But, even in the midst of this crisis you understood that easy money was not the same as free money. You knew that any time the government spends money to meet a crisis, be it war, natural disaster, or recession, finger-pointing follows. The government, often pressured by the media, can be the Tom Brady of Monday morning quarterbacking, throwing money at a problem and then blaming the recipients for taking it. History has taught you that government enforcement follows government largesse as surely as higher taxes follow deficit spending.

The decision to accept pandemic relief funds in any of their various offerings was especially risky. In its rush to provide relief, the government offered scant guidance concerning eligibility or the application process. There was also an unprecedented level of public questioning about whether organizations should seek relief funds, even if they qualified for them. Large organizations were criticized publicly for seeking relief funds. This criticism was echoed in internal organizational discussions. Directors, managers, and employees questioned whether their organizations were truly intended to be beneficiaries of these emergency relief funds and even if so, whether they should accept them. But, the bottom line was that you were responsible for the financial health of your organization and it would have been irresponsible for your organization not to accept funds for which it was eligible in the face of unprecedented risk and uncertainty.

Now, 18 months later, the inevitable second-guessing has begun. We are witnessing the front-edge of what will undoubtedly become a wave of post COVID relief-fund media scrutiny, investigations, litigation, and prosecutions. Reporters and agency auditors will raise questions that will be passed on to investigators. The Government Accountability Office has established FraudNet, a hotline for reporting allegations of COVID relief fund fraud. Whistleblower lawyers are soliciting clients with the prospect of receiving 15 to 30% of any recovery by the government. The risk of whistleblower, or qui tam, lawsuits is especially acute in the healthcare and government contractor sectors because of the widespread familiarity with the False Claims Act and the potential awards available to qui tam complainants.

Apart from the legal risk, however, there is also a revival of questions, concerns, and complaints by employees about whether an organization was right in applying for, receiving, and administering COVID relief funds. Similar doubts and skepticism can trigger government investigations because enforcement officials frequently use their enforcement tools to attack conduct they view as normatively wrong. Government enforcement actions are often not limited to targeting alleged violations of the letter of the law but the government’s view of the spirit of the law. We regularly see this phenomenon in government investigations. Upon conceding that the theory of liability articulated to the company is not viable, rather than closing its investigation, the government simply adopts a new theory intended to achieve the same ultimate objective, forcing the company to pay for conduct the government agency or lawyer finds subjectively objectionable.

Pinpointing the source of source of employees’ questioning is difficult but, at the risk of engaging in arm-chair psychology, it appears to reflect a values clash. Crises force us to choose between competing values; self-interest versus the common good. In the aftermath of a hurricane, for example, we see hoarding and sharing, looting and heroism. The COVID-19 public health crisis presented prolonged examples of people and organizations sacrificing for the public good. Against the back-drop of this sacrifice, it is not surprising that employees ask whether their employer’s actions with respect to pandemic relief funds was not merely lawful but morally right and consistent with the organization’s mission, vision, and values, which are much more amorphous and subjective standards.

These questions can certainly generate legal risk, but they can also undermine trust in the organization. As observed in a Harvard Business Review article, “[c]andidates are seeking workplaces where they can intertwine their beliefs with those of the company, and work together on a common vision of purpose and success.” The same article reported a LinkedIn survey which found that “employees care about whether companies foster environments where employees can be themselves (47%) and have a positive impact on society (46%).” Similarly, a National Bureau of Economic Research survey found that 92% of CFOs believe a healthy corporate culture increases the business’s value and performance. Conversely, more than eight out of ten (85%) of CEOs and CFOs believe a poorly implemented, ineffective culture promotes unethical behavior. Thus, employee doubts about an organization’s response to the COVID-19 crises create not just legal risk but business and reputational risk as well. Responding effectively to these concerns is key to mitigating these risks. Here are some tips for how to respond effectively to questions about your organization’s response to the COVID-19 public health crises.

1. Create a trusting environment. Take actions that demonstrate to employees, as well as other organizational constituents such as business partners and customers, that questions or concerns they raise will be addressed, without risk of retaliation. These actions go beyond simply having an open-door policy with respect to questions and concerns but when appropriate proactively acknowledging and addressing concerns before they are brought to you. For example, if you become aware of media or governmental scrutiny of others in your industry that may be considered similar to actions your organization has taken consider raising those issues affirmatively and explaining how the organization addressed them and its reasoning. When it comes to subjective value choices, as distinguished from objective legal compliance, employees are likely to recognize that there may be more than one right answer and that the organization has multiple competing values to balance. The toughest decisions are often not between right and wrong but between different forms of right. We often advise that making the right decision is not a binary choice. Rather, there are often a range of right choices and management enjoys wide discretion within that range. We have found that employees respect decisions that reflect their organization’s attempt to live its values even if the employee would have made a different choice.

2. Respect your employees’ concerns. Hearing an employee question a decision or course of action that may well be outside their area of responsibility can be frustrating. It can be tempting to immediately dismiss the concerns because the employee does not have all the facts (or because your to do list is already too long and getting longer). But you should appreciate that your employee has come to you. It is a demonstration of their trust that the organization will do the right thing when given the chance (even if “the right thing” is not immediately apparent). How you respond will determine whether you affirm or weaken that trust. After all, your employee could have called FraudNet, a qui tam lawyer, or the New York Times. Indeed a majority of whistleblowers report that they first presented their concerns to the company. You want your employees to come to you first, not just this time, but the next time and even the time after that¾in other words, every time.

3. Understand the concern. While your focus may be on whether the concerns implicate legal compliance risk, the employee’s concern may be broader and more subjective. They may be concerned about whether the company’s conduct is consistent with its stated mission, vision, and values. In other words, they may be seeking assurance that the company has done the “right” thing. Try to have the employee articulate as precisely as they can the nature and source of the concerns, the facts underlying their concerns, and what they want the company to address. Their answers will be your roadmap for how to respond.

4. Address the concerns. Although this tip may seem obvious, it is surprising how many companies fail to follow it, not out of ill intent or indifference but because, despite the best of intentions, the next fire and then the next one breaks out and the concerns fall to the bottom of the to do list. Reminder, employees often become whistleblowers only after they conclude that the company ignored their concerns. Assure the employee that the concern will be investigated and addressed and that they will be informed of the outcome (to the extent appropriate).

5. Conduct a thorough, objective, and independent investigation. Even though an employee may have sufficient trust in the organization to raise their concern,they likely also possess a degree of skepticism concerning whether their concerns will be fairly and impartially investigated. While this is often the reason to bring in outside counsel, that is not always necessary. Many complaints can be investigated appropriately using internal resources. But, internal investigations should satisfy certain criteria. The individual conducting or leading the investigation must have appropriate investigative experience and ability. This should include the ability to engage empathetically with the complainant and other witnesses in order to grasp and address the broader values frame that spawned the concern. The investigator must also have sufficient stature within in the organization to ask tough questions and deliver unwelcome messages. As a corollary to sufficient stature, they also must enjoy a reputation of trust within the organization so that their findings are credible. Not to be overlooked, the individual assigned to conduct the investigation must also be given the time and resources necessary to conduct a timely yet thorough investigation and to document their findings. (See Tip 8 Document, Document, Document.)

6. Understand the importance of diversity in thought and values. Laws confer the values of clarity and precision. Although there can be subjectivity in the application of laws to facts, legal standards are generally clearly defined and objectively and consistently applied. Moral, cultural, and other higher values by contrast are broadly defined, amorphous, and subjectively viewed. Thus, whether specific conduct is legal can be answered by applying a well-defined analytic framework. But, whether conduct is right in a moral sense entails an appreciation of and respect for the breadth, complexity, and subtlety of competing normative values. The ability to understand, articulate, and appreciate the diversity of normative values can be critical to answering questions about whether conduct will be viewed as right or wrong. In this context, identity diversity, e.g., race, ethnicity, gender, and sexual orientation, can be valuable, but fundamentally, identity diversity is a means to the end of diversity in thought and values that facilitates your organization’s ability to forecast how its actions may be addressed by its diverse constituents, such as owners, employees, government regulators, and customers.

7. Keep the employee in the loop. One way to build trust, in appropriate circumstances, is to involve the employee in the ensuing investigation. For example, whomever is charged with conducting the investigation should consider starting with the complainant not simply to obtain information but also to ask them for their suggestions and recommendations concerning what facts would be relevant and whether there are related issues or concerns that should also be explored. Obviously, it is essential to do this in a manner that does not unduly expand the investigation’s scope or give the complainant a false sense that they are in charge of it. But, handled sensitively, making the employee feel part of the investigation can be powerfully trust enhancing. In protracted investigations, consider providing updates to the employee. Even if it is not appropriate to provide substantive updates, letting them know that the investigation is ongoing will be reassuring. At minimum, of course, honor your promise to apprise the employee of the outcome of the investigation, even if only at a high level.

8. Embrace the values questions. If the concern expressed was whether the company did the right thing, then that issue must be addressed. And, while as noted the “right” thing can be amorphous and subjective, its contours can nevertheless be discerned. In the context of COVID relief funds, for example, the right thing likely included ensuring operational continuity, avoiding layoffs, and honoring obligations to organizational constituents such as shareholders, customers, and business partners. How did the actions taken relate to the company’s mission, vision, and values? In answering these questions, it is important to answer them in the context of the risk and uncertainty that existed when the decisions were made and actions taken. It is essential to highlight that the decision-makers did not have the benefit of hindsight. Ultimately, embracing the values questions can serve to strengthen trust and reinforce your organizational values.

9. Document, document, document. Today’s complaint can be tomorrow’s (or even next year’s) investigation. Another, less trusting employee may go straight to law enforcement or a qui tam lawyer. Either way, the investigative process can be such that you will not become aware of the ensuing investigation until months or years later. It is critical that you be able then to demonstrate that you responded to the complaint in a timely manner and took appropriate remedial actions. Unfortunately, given that legal and compliance departments are often under-resourced, it becomes all too easy to ask the right questions, get the right answers, and implement the right remedial measures, but fail to document all that good, hard work. When and if the subpoena arrives, you find yourself forced to retrace your investigative steps (and likely retain outside counsel as well). Invariably, you will also find that your notes are not nearly as detailed and you recalled. Additionally, although time-consuming, the discipline of preparing interview memos, memorializing findings, and maintaining documents collected not only promotes a thorough investigation but enables the company to promptly respond to subsequent queries or investigations. These steps also evidence the quality of the company’s compliance program, which can be a persuasive consideration in the government’s exercise of its enforcement discretion.

The call and response quality to government spending followed by government investigations has long been a reality. The response to the call for government funding to combat the pandemic will undoubtedly follow this established pattern. As we are seeing, however, the nature of the COVID-19 crises is raising questions about how organizations responded, not just by enforcement agencies and officials, but by employees, the public, and other organizational constituents. These questions can present a risk equivalent to and perhaps even greater than the potential legal exposure. Unless responded to promptly and effectively, they can undermine the trust and sense of shared values that studies show are important to your employees and other important constituents. The tips presented in this blog should help you in your effort to manage not just legal risk but business and reputational risk as well.