Lessons for employers and whistleblowing employees? Employer’s duty of care may extend to ensuring ethical and professional audits

In a recent judgment. the High Court extended the duty of care owed by an employer to its employee, in certain limited circumstances, to include a duty to "take reasonable steps" to prevent the employee's loss of earnings by a failure to perform an audit "in an ethical and professional manner".¹ We explore the background to the case, the basis of the Court's judgment, and the possible wider ramifications for employers and their employees – particularly in the context of whistleblowing scenarios.

Background

In 2013, the Claimant (an individual named Mr Rihan), who worked mainly in the Middle East for various entities within the Ernst & Young network ("EY"), participated in an "assurance" audit of a Dubai-based precious metals dealer, Kaloti Jewellery International DMCC ("Kaloti"), on behalf of EY's Dubai branch. Early on in the audit, the Claimant became aware of several serious irregularities that gave rise to a reasonable suspicion that Kaloti was involved in money laundering activities. This included Kaloti knowingly dealing in the export of gold bullion from Morocco disguised as silver (thereby avoiding certain restrictions on the export of gold from Morocco) which was then declared to be gold on arrival in Dubai.  Kaloti had also taken part in cash transactions in gold involving US$ 5.1 billion.²

In receipt of this information, the Claimant informed the relevant local regulatory body, the Dubai Metals and Commodities Centre ("DMCC"). According to the Claimant's claim, instead of investigating the allegations against Kaloti, the DMCC pressurised both him, and EY's Dubai office, to "reduce to vanishing point" the visibility of the gold and cash transactions the Claimant had discovered, such that readers of the relevant reporting documents would be misled into thinking that Kaloti's business practices were "essentially sound when, manifestly, they were not".³

The Claimant escalated his concerns about this state of affairs to senior individuals within EY who, the Claimant alleged, not only failed to support him, but also pressurised him to agree to a modified version of the audit report that "sanitised" the findings.  The Claimant informed his interlocutors at EY that that he feared for his safety if he remained in Dubai, as a result of these developments. Consequently he left Dubai with his family, requesting that he be given a role in a different part of EY's network and warning EY (via lawyers) that he would take his findings to mass media organisations and be forced to resign unless EY themselves fully reported the relevant misconduct. EY did not offer the Claimant an alternative role, nor did it report on the irregularities. The Claimant then resigned in January 2014 and reported publicly on Kaloti's prior conduct.⁴

The Claim

The Claimant brought a claim against four UK-based EY entities (the "Defendants") . Interestingly, the Claimant did not pursue either EY Dubai (for whom the Claimant acted in the audit) or EY MENA (of which the Claimant was a partner) on the basis, the Claimant asserted, that EY functions in practice as a global network, with common policies, practices, codes of conduct and a management structure that reports upwards to the EY Group.⁵  The Claimant's action was based upon alleged breaches of two separate duties of care (albeit both expressed as a duty not to cause the Claimant financial loss), which were as follows:

1. A duty to take reasonable steps to keep the Claimant safe (the "safety duty"): The Claimant submitted that the Defendants owed a duty to do what was reasonable to avoid or mitigate the risks to the Claimant's safety if he returned to Dubai after expressing his objections to the audit. This required the Defendants to take reasonable steps to relocate the Claimant or provide him with alternative work outside of Dubai⁶.
2. A duty to address appropriately the Claimant's concerns about the Kaloti audit findings and the reporting of those findings and to deal with the audit appropriately (the "audit duty"): The Claimant submitted that it became increasingly obvious that Kaloti and the DMCC required the audit to be conducted unethically and in contravention of international standards. The Defendants were consequently bound either to sign reports containing the truth (regardless of the displeasure this would cause Kaloti and the DMCC) or to dissociate themselves, the Claimant and the whole EY organisation from the Kaloti assurance audit engagement and to report the true findings to the proper authorities.⁷

No extension of rule in respect of the "safety duty"

In his judgment Mr Justice Kerr rejected the Claimant's argument that the Defendants owed the Claimant the "safety duty".  In particular, he stated that:

"…it would be an illegitimate extension of the law to make the leap from the standard employer's duty to safeguard its employees against personal injury, to a broad duty to safeguard them against pure economic loss incurred as a result of the claimant's need to cease working to avoid a threat to his physical safety".⁸

He added that the standard employer's duty in relation to the work environment of its employees included a duty to provide a safe place and a safe system of work; this safeguarded employees against personal injury and any lost earnings resulting from a breach of that duty. It did not however, create an avenue for employees to recover purely economic loss.⁹ 

Extension of rule in respect of “audit duty”

Turning to the "audit duty", Kerr J found – on the facts of the particular case – that the Defendants did owe such a duty to the Claimant.¹⁰  In extending the principle of a duty of care in this scenario (which was a permissible and incremental extension) Kerr J addressed the principles in Caparo v Dickman¹¹, making the following findings in respect of the three-part test for establishing a duty of care therein:

• Foreseeability. It was readily foreseeable by all the Defendants (to whom the knowledge of certain key individuals was attributed, and given that EY acted, at a global, regional and local level, in concert with and through its various subsidiaries¹² ) that the Claimant would suffer financial loss if the Kaloti audit was conducted and concluded in a manner the Claimant considered unethical and unacceptable. This was because it had become clear that the Claimant would feel bound to dissociate himself from the audit if his concerns were not acted upon; it "must have been obvious to [the relevant individuals] that this would self-evidently involve financial loss, namely the sacrifice of his career with EY".¹³
• Proximity. The requirement of proximity as between the Defendants and the Claimant was satisfied on the facts, but only in relation to the assurance audit of Kaloti (and other Dubai gold refiners) that the Claimant carried out, where he was the engagement partner. Notably, Kerr J rejected the Defendants' submission that that proximity was not present because the different EY entities were not part of a unified corporate structure; or because EY''s subsidiaries organised their accounts as separate businesses that charged one another for services rendered to each.¹⁴
• Fair, just and reasonable to impose a duty. Finally, Kerr J considered it to be fair, just and reasonable for the law to impose a duty in this scenario.¹⁵ In reaching this decision, Kerr J had regard to the lack of protection afforded to the Claimant by statutory whistleblowing regimes (including, in particular, the UK regime, given that he had been working outside of the UK).¹⁶ Kerr J commented that "the importance of upholding ethical standards might not of itself establish that it is fair, just and reasonable to impose the "audit duty" of care in this case" as professional standards are usually safeguarded by disciplinary regimes that exist in other countries (though they were not adequately safeguarded in this case).¹⁷

In addition to duty, the other necessary components of the claim were established, and the Claimant was awarded a combination of approximately US$ 10.8 million and £117,000 in damages¹⁸, incorporating the Claimant's loss of both previous and future earnings. EY have stated that they will appeal the decision.¹⁹

Analysis

This case turned on unique facts (and is, in any event, subject to appeal).  Nonetheless, it reflects a significant willingness of the courts – in certain limited circumstances – to impose a duty on employers to address employees' concerns regarding audit findings, and to deal with the audit appropriately, particularly where the individual may not be able to benefit from a statutory whistleblowing protection regime. 

Notwithstanding the case constituting, in the words of Kerr J, an "'outlier', with a factual basis that will rarely if ever occur", there are a number of key takeaways: 

• The Court may be prepared to impose a duty on businesses to address employees' concerns about audit findings and the reporting of those findings and to deal with the audit appropriately.
• Businesses should employ best practice when dealing with whistleblowers (particularly if legislative protection is limited or not available), including ensuring that whistleblowers are treated with care and via appropriate channels.
• Parent companies with global networks, common policies, practices and codes of conduct should be mindful of the actions of subsidiaries and the risks of liability for actions of regional subsidiary organisations being attributed to the group.
• Employers will also need to consider the impact that their decisions (or lack thereof) will have on employees' future earnings, particularly when those employees are senior executives who may be entitled to high rates of remuneration.

As noted, the Claimant’s case turned on unique facts.  Nonetheless, the approach, and findings, of the Court are instructive to businesses looking to ensure best practice with regard to whistleblowers within the corporate group.