Betz v. Fed. Home Loan Bank of Des Moines

644 F.Supp.3d 500

Linda BETZ, Plaintiff, v. FEDERAL HOME LOAN BANK OF DES MOINES,Zeeshan Kazmi, Sunil Mohandas, and Mike Wilson, Defendants.

4:21-cv-00022

United States District Court, S.D. Iowa, Central Division

Signed December 6, 2022

Megan C. Flynn, Michael J. Carroll, Coppola Carroll Hockenberg, P.C., West Des Moines, IA, for Plaintiff.

Haley Hermanson, Katie Lynn Graham, Nyemaster Goode PC, Des Moines, IA, for Defendant Federal Home Loan Bank of Des Moines.

Haley Hermanson, Nyemaster Goode PC, Des Moines, IA, for Defendants Zeeshan Kazmi, Sunil Mohandas, Mike Wilson.

ORDER

ROBERT W. PRATT, Judge

Before the Court is Defendants Federal Home Loan Bank of Des Moines, Zeeshan Kazmi, Sunil Mohandas, and Mike Wilson's Motion for Summary Judgment. ECF No. 107. Plaintiff Linda Betz resists Defendants' Motion. ECF No. 130. Defendant filed a Reply. ECF No. 133. The Court heard oral argument on the Motion on October 4, 2022. See ECF No. 141. The matter is fully submitted.

I. FACTUAL AND PROCEDURAL BACKGROUND

Defendant Federal Home Loan Bank of Des Moines (FHLB) is a federally chartered corporation organized under the Federal Home Loan Bank Act of 1932 (FHLBA), 12 U.S.C. §§ 1421-1449. ECF No. 132-2 ¶ 1. The Federal Housing Finance Authority (FHFA) oversees all Federal Home Loan Banks. Id. ¶ 13 (citing 12 U.S.C. § 4511). Congress has tasked the FHFA with ensuring that all Federal Home Loan Banks "operate[ ] in a safe and sound manner" by "maint[aining] . . . adequate capital and internal controls" and by "foster[ing] liquid, efficient, competitive, and resilient national housing finance markets" all in a manner "consistent with the [applicable statutes and the] public interest." 12 U.S.C. § 4513(a)(1)(B). To ensure compliance, the FHFA conducts annual on-site examinations of each Federal Home Loan Bank. ECF No. 132-2 ¶ 15 (citing 12 U.S.C. §§ 1440, 4517). During these examinations, the FHFA examiners review a bank's "internal controls and information systems[;] . . . audit systems; . . . interest rate risk exposure; . . . market risk[;] . . . liquidity and reserves; . . . asset and investment portfolio growth; . . . investments and acquisitions of assets[;] . . . overall risk management processes[;] . . . credit and counterparty risk"; record-keeping; and "such other operational and management standards as the [FHFA] determines to be appropriate." § 4513b(a)(1)-(11).

The FHFA has published Prudential Management and Operations Standards. ECF No. 132-2 ¶ 17. Standard 1, entitled "Internal Controls and Information Systems," provides:

Responsibilities of Senior Management

2. Regarding internal controls and information systems, senior management should implement strategies and policies approved by the board of directors, establish appropriate policies, monitor the adequacy and effectiveness of this function, and ensure personnel are appropriately trained and competent. The organizational structure should clearly assign responsibility, authority, and reporting relationships.

12 C.F.R. pt. 1236, app. Pursuant to FHLB's bylaws, the President may remove any officer at any time with or without cause. Id. ¶ 64.

Defendant Wilson was President and Chief Executive Officer (CEO) of Defendant FHLB at all relevant times. Id. ¶ 2. Wilson announced his intent to retire in April 2019 and retired on February 7, 2020. Id. ¶¶ 2, 3. Defendant Mohandas was the Executive Vice President Chief Risk and Compliance Officer at all relevant times and reported directly to Defendant Wilson. Id. ¶ 4. Wilson's other direct reports included Executive Vice President Chief Operating Officer Dusan Stojanovic and Senior Vice President Chief Human Resources (HR) and Administrative Officer Nancy Betz.¹ Id.

In March 2018, FHLB's Information Technology (IT) Department was overseen by Senior Vice President Chief Business Technology Officer Shawn Laird. Id. ¶ 6. The IT Department was responsible for FHLB's computer systems' structure, management, and operations. Id. On March 19, 2018, FHLB hired Plaintiff as its Senior Vice President Chief Information Security Officer to oversee FHLB's Information Security (IS) Department. Id. ¶ 8. The IS Department's purpose was to protect the availability, integrity, and confidentiality of FHLB's computer systems data; to protect sensitive information from being altered, changed, or transferred without authorization; and to protect against internal and external threats. Id. ¶ 7. Both Plaintiff and Laird reported directly to Stojanovic who oversaw FHLB's IT and IS Departments. Id. ¶¶ 5, 11.

Plaintiff had three employees directly report to her, including Manager of Information Security Rebecca Mathisen. ECF No. 132-2 ¶ 23. Plaintiff's team was responsible for ensuring FHLB complied with required Sarbanes-Oxley Act (SOX) controls. Id. ¶ 24. The team performed SOX controls utilizing access control solution SailPoint IIQ software. Id. ¶ 25. In May 2019, FHLB hired independent contractor Paul Crosthwaite as an Information Security Consultant to assist Plaintiff's team. Id. ¶ 26. On July 21, 2019, Crosthwaite and Mathisen informed Plaintiff that certain SOX controls were not being performed, others were not effective, and there was a breakdown in management understanding of the controls. Id. ¶ 30. Crosthwaite e-mailed Plaintiff advising her: "[D]o not attest to these controls being in place and effective . . . ." ECF No. 132-2 ¶ 29. Plaintiff, Crosthwaite, and Mathisen then discussed putting in place some controls that were not already in place. Id. ¶ 30. Crosthwaite explained the problem as follows:

In SOX, there are evaluations of both design, does it do what it's intended to do? And effectiveness, is it being done well? The issues that we were finding were not we have processes in place and they're not so great. It was we legit don't have controls that have previously been reported to be in place in place. So that has-that means management had been working off of incorrect information previously. So that kind of information is important to disclose. Whether the SOX committee decides it's material is a whole different conversation.

Id. ¶ 31.

On August 5, 2019, Mathisen had a conversation with Mike Masiello, who was FHLB's Vice President Manager of Financial Controls, in which she interpreted him as instructing her to change certain controls to "effective" in the certification report. Id. ¶ 33. Mathisen similarly interpreted a note left by Plaintiff as Plaintiff asking Mathisen to change the internal control certification. Id. ¶ 34. On August 7, Plaintiff suggested to Mathisen that Crosthwaite's employment contract should be terminated. Id. ¶ 35. However, before any decision was made regarding Crosthwaite's employment, he submitted his resignation. Id. ¶ 36. Crosthwaite acknowledged to Mathisen there had been a "panicked response" following the revelation a few weeks earlier that some controls were not being performed and claimed he was "an easy target." Id. ¶ 36. That same day, Mathisen submitted two whistleblower complaints against Plaintiff alleging misconduct by Plaintiff that were forwarded to Defendant Wilson. Id. ¶¶ 39, 42. In her complaints, Mathisen stated that she had certified certain SOX controls as "not effective" during a risk assessment but that Plaintiff had done the opposite and certified the controls as "effective" despite being told not to. Id. ¶ 43. Mathisen, however, had not seen Plaintiff's certification and did not know that Plaintiff's certification actually matched Mathisen's in certifying the controls as "not effective." Id. ¶ 44. Mathisen further stated in her complaints that she believed Plaintiff was retaliating against her and that Mathisen would be fired for accurately filing a certification about the status of the unperformed and ineffective SOX controls. Id. ¶ 46. Mathisen also complained that Masiello had suggested a change in the documentation Mathisen filed certifying the controls. Id. ¶ 47.

Mathisen's complaints against Plaintiff were investigated by FHLB's Internal Audit Department. Id. ¶ 50. The auditors reviewed certifications related to SOX controls and Disclosure Committee sub-certifications, conducted interviews, and reviewed e-mails. Id. ¶ 52. Mathisen was interviewed the same day she filed her complaints on August 7, 2019. Id. ¶ 53. During her interview, Mathisen reported that Plaintiff's certification inaccurately listed all controls as operating effectively while Mathisen's certification accurately listed the controls operating ineffectively. Id. Mathisen also reported that Crosthwaite had resigned because he believed he would be made a scapegoat and fired anyway. Id. ¶ 54. Crosthwaite was also interviewed for the investigation into Mathisen's complaints. ECF No. 133-1 ¶ 17. Plaintiff, Masiello, and Stojanovic were not interviewed for the investigation. ECF No. 132-2 ¶ 55.

Also on August 7, Mathisen contacted Defendant Wilson to discuss an issue with certifications and controls. Id. ¶ 37. Wilson scheduled a meeting to discuss these issues with Mathisen for two days later on August 9, 2019. Id. ¶ 38. Mathisen also met with Plaintiff on August 9. Id. ¶ 56. Mathisen later testified she believed she would be fired on August 9, however, Plaintiff did not fire Mathisen. Id. Instead, Plaintiff expressed how serious of a mistake it was that the SOX controls had not been performed. Id. Plaintiff did not know how long Mathisen had been aware of the problem before reporting it to Plaintiff, so Plaintiff counseled Mathisen to "speak up immediately" if something similar ever happened again. Id. ¶ 57. There is no evidence that Plaintiff retaliated against Mathisen for either Mathisen's certification that turned out to match Plaintiff's or Mathisen's complaints against Plaintiff. Id. ¶ 13. In fact, Plaintiff did not learn of Mathisen's complaints against her until well after Plaintiff's employment was terminated. Id. ¶ 48.

An Interim Report regarding the investigation into Mathisen's complaints was completed...