Summary. Retaliation is the most frequently alleged employment claim in the United States, and the claim that survives when the underlying complaint fails. This article covers the elements common to every retaliation theory, then the major federal regimes: Sarbanes-Oxley § 806 with its contributing-factor standard, the Dodd-Frank SEC program and the reporting requirement imposed in Digital Realty, the False Claims Act's qui tam mechanism and § 3730(h), and the twenty-plus statutes OSHA administers with filing periods as short as thirty days. It then covers state public policy wrongful discharge, protected activity and adverse action, causation standards, and program design.

A controller at a mid-sized manufacturer tells the CFO that she believes revenue is being recognized a quarter early on several distributor arrangements. The CFO disagrees. She raises it again in writing. Two months later she is placed on a performance improvement plan for the first time in nine years, and four months after that she is terminated in a reduction in force that eliminates two positions, one of which is hers.

The company has a genuine defense on the accounting: reasonable people disagree about the revenue treatment, and its auditors signed off.

That defense is close to irrelevant. Under Sarbanes-Oxley, the controller does not have to be right. She has to have had a reasonable belief that the conduct violated one of the enumerated provisions. And she does not have to prove the complaint caused her termination in the ordinary sense — she has to show it was a contributing factor, after which the burden shifts to the company to prove by clear and convincing evidence that it would have taken the same action anyway.

That burden allocation, not the merits of the accounting dispute, is what determines the outcome. It is also why retaliation claims outlast the complaints that generate them.

The short answer

Every retaliation claim has three elements:

  1. Protected activity — the employee did something the law protects.
  2. Adverse action — the employer did something that would dissuade a reasonable worker from engaging in that activity.
  3. Causation — a connection between the two, with a standard that varies dramatically by statute.

The causation standards, from most to least employee-friendly:

The filing deadlines are the trap. SOX: 180 days with OSHA. Most OSHA-administered statutes: 30 days. False Claims Act retaliation: 3 years. Title VII: 180 or 300 days with the EEOC. Dodd-Frank: 6 years in some circumstances. An employee who misses the short one may still have the long one, which is why plaintiffs plead everything.

Protected activity

The scope varies by statute, but three patterns recur.

Reporting suspected illegality. Internally to a supervisor or compliance function, or externally to a regulator. Most statutes protect both, though Dodd-Frank's anti-retaliation provision is the notable exception, discussed below.

Participating in a proceeding. Filing a charge, testifying, assisting, or participating in an investigation. Participation clauses are typically broader than opposition clauses and protect even unreasonable or mistaken participation.

Refusing to violate the law. Declining to falsify a record, sign a certification, or perform an act the employee reasonably believes is unlawful.

The reasonable belief standard. Nearly every statute protects a reasonable belief, assessed both subjectively (the employee actually believed it) and objectively (a reasonable person with the same training and experience could believe it). The employee need not be correct, need not identify the specific statute, and need not use the word "illegal." An employee who reports conduct that turns out to be entirely lawful is still protected if the belief was reasonable.

What is not protected: complaints about matters wholly unrelated to law compliance (a bad manager, an unfair schedule) unless another statute reaches them; knowingly false reports; and, in most circumstances, disclosures that themselves violate the law — though several statutes contain immunity provisions, including the Defend Trade Secrets Act's immunity, 18 U.S.C. § 1833(b), for confidential disclosure of trade secrets to a government official or attorney solely for the purpose of reporting a suspected violation. That provision also requires employers to include an immunity notice in agreements governing trade secrets, on pain of losing exemplary damages and fees against that employee.

Adverse action

Burlington Northern & Santa Fe Railway Co. v. White, 548 U.S. 53 (2006), set the standard for Title VII retaliation and has shaped the analysis broadly: an action is adverse if it would have dissuaded a reasonable worker from making or supporting a charge. It is not limited to ultimate employment decisions.

Actions courts have found adverse in retaliation cases include reassignment to a less desirable position with the same pay and title, a change in shift, exclusion from meetings and information flows, a negative performance review where none had occurred before, a lateral transfer to a less prestigious role, denial of training, increased scrutiny of work, a schedule change affecting childcare, and threats. Muldrow v. City of St. Louis, 601 U.S. 346 (2024), separately lowered the bar for discriminatory transfer claims under Title VII by rejecting a requirement of "significant" harm, which reinforces the direction of travel.

What is generally not adverse: trivial slights, petty annoyances, and a single rude remark. Ostracism by coworkers is usually not attributable to the employer absent supervisor involvement or acquiescence.

Post-employment retaliation counts — a negative reference, opposition to unemployment benefits pursued in bad faith, or a lawsuit filed to punish the complaint.

Sarbanes-Oxley Section 806

Coverage. Publicly traded companies, their officers, employees, contractors, subcontractors, and agents — and, after Lawson v. FMR LLC, 571 U.S. 429 (2014), employees of private contractors and subcontractors of public companies. That holding vastly expanded the statute's reach: an accountant at a private firm auditing a public company is covered, as are many private company employees whose work touches a public client.

Protected activity, 18 U.S.C. § 1514A(a)(1): providing information about conduct the employee reasonably believes violates the federal mail, wire, bank, or securities fraud statutes, any SEC rule or regulation, or any provision of federal law relating to fraud against shareholders — to a federal regulator or law enforcement agency, to a member of Congress, or to a person with supervisory authority over the employee or authority to investigate misconduct.

Internal reporting is squarely protected under SOX. That distinguishes it from Dodd-Frank and is the reason most whistleblower plaintiffs plead SOX for the internal complaint and Dodd-Frank for the external one.

Procedure. File with OSHA within 180 days of the violation or of learning of it. OSHA investigates and issues findings. Either party may object and request a hearing before a Department of Labor administrative law judge, with review by the Administrative Review Board. If the agency has not issued a final decision within 180 days of the complaint and the delay is not due to the complainant's bad faith, the complainant may file de novo in federal district court — a "kick-out" right that most SOX plaintiffs exercise.

Burden. The complainant must show protected activity was a contributing factor. Murray v. UBS Securities, LLC, 601 U.S. 23 (2024), resolved a circuit split by holding that no proof of retaliatory intent is required. The employer must then prove by clear and convincing evidence that it would have taken the same action absent the protected activity — a demanding standard that ordinary employment documentation frequently cannot meet.

Remedies, § 1514A(c): reinstatement with the same seniority, back pay with interest, and compensation for special damages including litigation costs, expert fees, and reasonable attorney's fees. Several decisions have permitted emotional distress damages. No punitive damages.

Waiver. Section 1514A(e) makes rights and remedies non-waivable by agreement, and predispute arbitration agreements are unenforceable as to SOX claims.

Dodd-Frank and the SEC whistleblower program

Dodd-Frank created two distinct things that are constantly confused: an award program and an anti-retaliation provision.

The award program, 15 U.S.C. § 78u-6. A whistleblower who voluntarily provides original information to the SEC that leads to a successful enforcement action with monetary sanctions over $1 million may receive 10 to 30 percent of amounts collected. Awards have reached hundreds of millions of dollars. Parallel programs exist at the CFTC, and the Anti-Money Laundering Act created one at Treasury.

Two features drive employer behavior. First, the SEC has aggressively enforced Rule 21F-17(a), which prohibits any action to impede an individual from communicating with the Commission — including through confidentiality agreements, severance agreements, employment agreements, and NDAs. Enforcement actions have targeted agreements that required employees to notify the company before contacting regulators, that required them to represent they had not filed a complaint, or that conditioned severance on waiving the right to an award. Every confidentiality, severance, and separation agreement should contain an express carve-out preserving the right to report to and communicate with government agencies and to receive awards.

Second, the program rewards external reporting, which is in tension with a compliance function's desire to hear about problems first. The SEC has said it considers internal reporting favorably in determining award amounts, which is the main lever a company has.

The anti-retaliation provision, § 78u-6(h). Digital Realty Trust, Inc. v. Somers, 583 U.S. 149 (2018), held that Dodd-Frank's anti-retaliation protection extends only to those who report to the SEC — the statutory definition of "whistleblower" controls. An employee who reports only internally is not protected by Dodd-Frank, though they may be protected by SOX and other statutes.

Where it applies, Dodd-Frank offers advantages over SOX: no administrative exhaustion, a longer limitations period, and double back pay.

The False Claims Act

Qui tam, 31 U.S.C. § 3730(b). A private relator may sue on behalf of the United States for false claims for payment of government money. The complaint is filed under seal, served on the government but not the defendant, and the government investigates and decides whether to intervene. Relators receive 15 to 25 percent of the recovery if the government intervenes, and 25 to 30 percent if it does not.

Because federal health care programs, defense procurement, grants, and federally backed lending all involve claims for government money, the Act reaches far beyond obvious government contractors.

Falsity and materiality. Universal Health Services, Inc. v. United States ex rel. Escobar, 579 U.S. 176 (2016), validated the implied false certification theory in defined circumstances and imposed a rigorous and demanding materiality standard, directing courts to consider whether the government continued paying with knowledge of the violation. United States ex rel. Schutte v. SuperValu Inc., 598 U.S. 739 (2023), held that scienter turns on the defendant's subjective knowledge and belief, not on whether an objectively reasonable interpretation of an ambiguous requirement existed.

Damages are treble the government's damages plus per-claim civil penalties, adjusted annually — which is why FCA exposure is frequently existential.

Retaliation, § 3730(h). A separate claim available to employees, contractors, and agents who suffer retaliation for lawful acts in furtherance of an FCA action or other efforts to stop a violation. No qui tam suit need be filed, and internal reporting is protected. Remedies: reinstatement with double back pay, interest, and special damages including attorney's fees. The limitations period is three years.

Practical point. FCA retaliation claims are often filed by employees who never file a qui tam action at all — the "other efforts to stop" language reaches ordinary internal compliance complaints in a regulated industry.

The OSHA-administered statutes

OSHA's Whistleblower Protection Program administers the anti-retaliation provisions of more than twenty federal statutes. The most frequently invoked:

  • OSH Act § 11(c) — 30 days, no private right of action.
  • Surface Transportation Assistance Act — commercial motor vehicle safety, 180 days.
  • Federal Railroad Safety Act — 180 days.
  • AIR21 — aviation safety, 90 days.
  • Consumer Product Safety Improvement Act — 180 days.
  • Affordable Care Act § 1558 — 180 days.
  • Consumer Financial Protection Act — 180 days.
  • Energy Reorganization Act, Clean Air Act, Safe Drinking Water Act, CERCLA, Toxic Substances Control Act, Solid Waste Disposal Act, FSMA, Seaman's Protection Act, and others.

Most use the contributing factor standard and the clear and convincing evidence rebuttal, and most include a kick-out to federal court after a defined period. The environmental statutes are notable outliers with 30-day filing periods and, in several, no kick-out right.

The practical lesson for employers: the filing deadline is short and the causation standard is employer-hostile. The window to build a defensible record closes before most companies know a complaint exists.

State law: public policy wrongful discharge and statutory protections

Nearly every state recognizes a common-law exception to at-will employment for discharge in violation of public policy. The typical formulation protects an employee discharged for:

  • Refusing to commit an unlawful act;
  • Performing a public duty (jury service, military service, testifying truthfully);
  • Exercising a statutory right (filing a workers' compensation claim, taking protected leave); or
  • Reporting a violation of law — though states differ sharply on whether internal reporting qualifies and on whether the public policy must be found in a statute or constitutional provision.

Some states restrict the tort where a statute already provides a remedy; others allow it in parallel. Damages are typically uncapped, and punitive damages are available in most, which is why the state claim is frequently worth more than the federal one.

Statutory state protections add layers: general whistleblower acts (California Labor Code § 1102.5 is the most litigated, protecting internal and external reporting of suspected violations and containing its own clear-and-convincing rebuttal standard), health care whistleblower statutes, state false claims acts with their own qui tam provisions, and anti-retaliation provisions embedded in wage, safety, leave, and discrimination statutes.

Practical consequence. An employee terminated after a complaint typically has a menu: one or more federal statutes, a state statute, a public policy tort, and often a contract or defamation theory. Defense counsel should map the menu at the outset, because the deadlines and standards differ and the earliest-filed claim usually sets the narrative.

Causation in practice

Temporal proximity is the workhorse. Close timing between protected activity and adverse action supports an inference of causation, and courts have found periods of a few weeks to a few months sufficient standing alone. Longer gaps require additional evidence — a pattern of escalating scrutiny, a change in treatment, or a decision-maker's statements.

The "cat's paw" theory. Staub v. Proctor Hospital, 562 U.S. 411 (2011), holds that an employer may be liable where a supervisor with retaliatory animus performs an act intended to cause an adverse action, and that act is a proximate cause of the ultimate decision — even if the ultimate decision-maker was unbiased. Independent investigation by the decision-maker can break the chain, but only if it is genuinely independent rather than a rubber stamp of the biased supervisor's account.

What defeats causation:

  • Documented performance problems predating the complaint. This is the single most valuable fact in the defense, and it either exists or it does not.
  • Consistency. Others who did the same thing were treated the same way.
  • Decision-maker ignorance. The person who decided did not know about the complaint — provable only if the information flow was actually controlled.
  • An intervening cause. A serious, independently documented event between the complaint and the action.

What manufactures causation:

  • A first-ever performance improvement plan shortly after a complaint.
  • Documentation created after the fact and backdated, which is detected routinely through metadata and destroys credibility on everything else.
  • Shifting explanations — the reason given to the employee, the reason given to the unemployment agency, and the reason given in the position statement should be the same reason.
  • Comments about the employee being "not a team player," "difficult," or "always raising issues."

Program design: preventing the claim

Reporting channels. Multiple, including at least one that bypasses the direct supervisor, and at least one anonymous. Publicize them.

Anti-retaliation policy. Explicit, with examples of prohibited conduct, an express statement that it applies to good-faith reports that turn out to be mistaken, and a defined complaint path for retaliation itself.

Intake and triage. Every report logged, assessed for severity, routed to a trained investigator, and tracked to closure. A report that disappears into a manager's inbox is the origin of most claims.

Investigation. Prompt, impartial, and documented. Where the report concerns senior management, accounting, or legal exposure, conduct it under counsel with a written scope. See the internal investigation checklist for the privilege mechanics.

Close the loop. Tell the reporter that the matter was reviewed and resolved, to the extent confidentiality permits. Reporters who hear nothing go external.

Protect the reporter affirmatively. Notify the reporter's management chain in writing that no adverse action may be taken without HR and legal review, and place a hold on performance actions, transfers, and schedule changes for a defined period — not to immunize the employee, but to ensure any action is reviewed before it is taken.

Audit for retaliation. Ninety days and one hundred eighty days after a report, review the reporter's performance ratings, compensation, assignments, and any discipline against a comparator group. This single practice catches most retaliation before it becomes a claim.

Fix the agreements. Every confidentiality, severance, employment, and separation agreement needs an express carve-out preserving the right to report to and communicate with government agencies, participate in investigations, and receive awards — and, for agreements governing trade secrets, the DTSA immunity notice.

Train managers on the one rule that matters: a complaint does not immunize anyone, but every action affecting a complainant must be reviewed first, and must be supported by documentation that predates the complaint.

A worked example

Return to the controller.

What the company actually did. The CFO discussed the complaint with the CEO and the VP of HR. Two months later HR issued the first performance improvement plan of the controller's tenure, citing "communication style" and "collaboration." Four months after that, a reduction in force eliminated her role and one other, selected by the CFO.

What the record showed in litigation. Nine years of "exceeds expectations" reviews. A performance improvement plan drafted by HR at the CFO's request, with no supporting incidents documented before the complaint. A reduction-in-force analysis prepared by the CFO — the same person whose accounting judgment she had questioned. Email from the CFO to HR: "she keeps relitigating this."

Outcome. The contributing-factor showing was straightforward. The company then had to prove by clear and convincing evidence that it would have terminated her anyway. With no pre-complaint documentation, a selection process controlled by the accused, and that email, it could not. The case settled.

What a defensible version looks like. The complaint is escalated to the audit committee, not resolved by the person accused. Outside counsel reviews the revenue treatment. The controller is told the outcome. Her management chain is notified in writing that no personnel action may proceed without legal review. The reduction in force, when it comes eight months later, is designed by HR with documented criteria, reviewed for disparate impact under privilege, and executed by someone other than the CFO — and the controller is retained, or is separated with a documented, criteria-based rationale that a neutral person applied.

The accounting question is the same in both versions. Only the process differs, and the process is the case.

An investigation and response checklist

  1. Log the report on receipt with date, channel, and substance.
  2. Assess urgency — safety, ongoing fraud, and destruction of evidence require immediate action.
  3. Issue a litigation hold if a claim is reasonably foreseeable.
  4. Determine who investigates. Never the subject of the complaint, and never their direct report. Escalate to counsel and, where appropriate, to the audit committee.
  5. Scope it in writing, under privilege where the purpose is legal advice.
  6. Give Upjohn warnings where counsel interviews employees.
  7. Interview the reporter first and ask what outcome they are seeking.
  8. Preserve documents before interviewing anyone likely to delete them.
  9. Reach a conclusion and document the basis.
  10. Notify the reporter of closure.
  11. Place a review hold on personnel actions affecting the reporter.
  12. Audit at 90 and 180 days for adverse treatment.
  13. Remediate the underlying issue and document the remediation — the strongest evidence that a report was taken seriously.
  14. Review agreements for regulator-communication carve-outs.

Frequently asked questions

Does the employee have to be right about the violation? No. A reasonable belief suffices under nearly every statute.

They only complained internally. Are they protected? Under SOX, the FCA, most OSHA-administered statutes, and most state laws, yes. Under Dodd-Frank's anti-retaliation provision, no — Digital Realty requires reporting to the SEC.

Can we require employees to report internally first? You may encourage it. You may not require it as a condition of protection, and any agreement impeding communication with a regulator risks an SEC enforcement action under Rule 21F-17.

Can we still discipline a poor performer who complained? Yes, if you can prove you would have done it anyway. Under SOX and similar statutes, that proof must be clear and convincing, which effectively requires documentation predating the complaint.

How long do they have to file? It depends entirely on the statute: 30 days under OSH Act § 11(c) and several environmental statutes; 90 days under AIR21; 180 days under SOX and many others; three years under the FCA; and longer under some state laws.

What is the exposure? Reinstatement and back pay everywhere; double back pay under the FCA and Dodd-Frank; uncapped compensatory and punitive damages under many state laws; and attorney's fees under nearly all of them.

Should our severance agreement prohibit contacting regulators? No, and it should say so affirmatively. Include a carve-out preserving agency reporting and award rights, plus the DTSA immunity notice where trade secrets are addressed.

An anonymous hotline report named our CEO. Who investigates? Not management. Escalate to the board or audit committee, and retain outside counsel.

Conclusion

Retaliation claims are the most survivable claims in employment law because they do not depend on the merits of the underlying complaint. A company can be entirely right about the accounting, the safety issue, or the billing practice and still lose, because the question the jury answers is about what happened to the person who raised it.

Two facts decide most of these cases. The first is whether documentation of the employee's performance problems predates the complaint. The second is whether the person accused of the underlying misconduct had any role in the decision that followed.

Both are controllable, and both are usually determined within a week of the complaint arriving — long before anyone is thinking about litigation.

The arbitration question

Whether a retaliation claim can be compelled to arbitration varies by statute and has changed materially in recent years.

SOX is carved out. Section 1514A(e)(2) provides that no predispute arbitration agreement is valid or enforceable as to a SOX whistleblower claim. An employer with an otherwise comprehensive arbitration program cannot compel a SOX claim.

Dodd-Frank contains a similar bar for its own anti-retaliation provision and for CFTC whistleblower claims.

The False Claims Act contains no such carve-out, and courts have generally compelled § 3730(h) retaliation claims to arbitration where a valid agreement exists — while the qui tam claim itself, brought on behalf of the United States, is not the relator's to arbitrate.

Title VII and ADA retaliation claims are arbitrable under Gilmer v. Interstate/Johnson Lane Corp., 500 U.S. 20 (1991), and Epic Systems Corp. v. Lewis, 584 U.S. 497 (2018), subject to two important limits: the Ending Forced Arbitration of Sexual Assault and Sexual Harassment Act, 9 U.S.C. §§ 401-402, gives a claimant the unilateral right to void a predispute arbitration agreement as to a sexual assault or sexual harassment dispute; and an agreement that a reasonable employee would read as barring an agency charge is independently unlawful.

State-law claims follow the FAA where the agreement is valid, but state efforts to restrict employment arbitration continue to generate preemption litigation, and unconscionability challenges succeed where the agreement imposes cost-splitting, shortens limitations periods, or limits statutory remedies.

The practical consequence. A single complaint often produces some claims that must be arbitrated and some that cannot. Piecemeal proceedings favor nobody, and an employer whose program cannot capture the highest-exposure claim should ask what the program is actually buying.

Cross-border reporting and the compliance overlay

Multinational employers face a further layer. The EU Whistleblower Directive and its national implementations require internal reporting channels for employers above defined headcount thresholds, set acknowledgment and feedback deadlines, protect a broad category of reporting persons including contractors and job applicants, prohibit retaliation, and in several member states impose administrative penalties for non-compliance and for breaching a reporter's confidentiality.

Two features cause friction with US practice. First, several jurisdictions restrict anonymous reporting or limit the scope of matters a hotline may accept, on data protection grounds. Second, processing a report involves personal data about both the reporter and the accused, which triggers GDPR obligations — lawful basis, data minimization, retention limits, and information rights of the accused, subject to carve-outs protecting the investigation.

A global hotline built to US expectations and rolled out unchanged into the EU, the UK, and Latin America is a recurring compliance failure. The workable approach is a single global policy with jurisdictional annexes covering permitted scope, anonymity, notice, retention, and works council consultation where required.

Advising the employee considering a report

Most writing on this subject addresses employers. The person deciding whether to speak up faces a different and harder set of questions, and a lawyer advising them should cover the following.

Understand what you are protected for, and what you are not. Protection attaches to a reasonable belief that specified conduct is unlawful. It does not attach to a general grievance about management, and it does not attach to how you gather evidence. Which leads to the next point.

Do not take documents. The instinct to build a file by forwarding company emails to a personal account, copying databases, or photographing screens is nearly universal and frequently disastrous. It can violate the Computer Fraud and Abuse Act, state computer crime statutes, trade secret law, and the employee's own confidentiality agreement, and it gives the employer an independent, non-retaliatory ground for termination. The DTSA immunity in 18 U.S.C. § 1833(b) protects confidential disclosure of a trade secret to a government official or an attorney solely for the purpose of reporting a suspected violation — it is narrower than most people assume and does not authorize wholesale self-help discovery. Take notes about what you observed; do not take the underlying documents without counsel.

Report in a way that creates a record. A verbal complaint that the employer later denies receiving is worth much less than a short, factual email. Describe what you observed, why you believe it may violate the law, and what you are asking for. Avoid characterizing motives and avoid accusations you cannot support.

Understand the deadlines. Thirty days under some statutes, one hundred eighty under others. An employee who waits to see whether things improve can forfeit the strongest claim while preserving only the weakest.

Consider the sequencing of internal and external reporting. Internal reporting is protected by most statutes and is viewed favorably by the SEC in setting award amounts; it also gives the employer the opportunity to fix the problem, which is often the outcome the employee actually wants. External reporting is required for Dodd-Frank anti-retaliation protection and is necessary to be eligible for an award. Doing both, in a considered order, is common.

Anticipate the response. The most likely sequence is not immediate termination. It is a subtle change in assignments, a performance review that differs from prior ones, exclusion from meetings, and an eventual separation packaged as a restructuring. Keep a contemporaneous, dated personal record of what changes and when — written from home, on personal equipment, describing events rather than reproducing company documents.

Read the agreements before signing anything. A severance agreement that purports to bar communication with regulators is unlawful under SEC Rule 21F-17 and unenforceable to that extent, but signing it complicates matters. Any release should carve out the right to report, participate, and receive awards.

Know the value of the claim. Reinstatement and back pay under every statute; double back pay under the FCA and Dodd-Frank; uncapped compensatory and punitive damages under many state laws; a share of recovery under qui tam and the SEC program. Attorney's fees are available under nearly all of them, which is why competent counsel is usually accessible on a contingency basis.

Related articles

This article is provided for general informational purposes and does not constitute legal advice. Filing deadlines under these statutes are short and vary widely, and state protections differ substantially. Consult qualified employment counsel immediately upon receiving a report or before taking action affecting a person who has made one.