Keeping Your Whistleblower Hotline Alive

Is your whistleblower hotline alive or dying a slow death? Whether it’s an effort to jumpstart your hotline program or simply to harvest ideas for continuous improvement, you will want to keep reading.

It’s been 15 years since Rule 10A-3 of the Exchange Act directed the NYSE, Nasdaq and other national securities exchanges and associations to require a listed company’s audit committee to establish formal procedures for addressing complaints thanks to the Sarbanes-Oxley Act. Specifically, listed public company audit committees were required to establish procedures for the receipt, retention and treatment of complaints regarding accounting, internal accounting controls or auditing matters on a confidential and anonymous basis. Thus, the whistleblower hotline trend was born.

Of course, many other organizations voluntarily jumped on the whistleblower hotline trend, and rightfully so. Surveys by the Association of Certified Fraud Examiners have historically concluded that tips are by far the leading detection method of occupational fraud.[1] While hotlines have long proved to be effective, too many organizations put this effort on cruise control rather than looking for opportunities to maximize value of their hotline investment.

A worthy organizational objective is to position the hotline so that people use it upon seeing or suspecting inappropriate or fraudulent activity, such as asset misappropriation, corruption or financial statement fraud. While there are many components to a successful hotline program, here are some key ones:

Clearly define the intended uses of the hotline. Do you want tips on just accounting, internal accounting controls or auditing matters? Or do you also want tips on other types of occupational fraud, such as asset misappropriation and corruption? Will you encourage tips on ethical violations, noncompliance issues, safety matters or sexual harassment claims through the hotline? Clearly defining the desired scope of the hotline is essential in providing potential tipsters a sound understanding of its use and a basis for promoting it. The scope should align with organizational objectives and risks.

Do not underestimate the power of a name. Simply defaulting in calling your hotline a whistleblower, ethics, compliance or fraud hotline without giving it some serious thought can hurt efforts. Naming conventions are important and will vary depending on the industry, organizational culture and hotline scope. Pick a name that will resonate with the audience and reflect well on your hotline objectives. For example, if the hotline scope centers on occupational fraud, calling it a “fraud hotline” reinforces this intention. Otherwise, referring to it as a “whistleblower hotline” has a wider connotation of reporting any kind of information or activity that is deemed illegal, unethical or not correct per organizational policies and procedures.

Ongoing education, messaging and marketing efforts are critical to help ensure that people understand the purpose of the hotline, as well as when and how to use it. It all begins with a well-crafted hotline policy conveying the purpose, scope, policy statements and reporting procedures. The hotline policy then serves as a basis for training and awareness efforts.

Internal training efforts should cover the hotline scope and process for new employees, as well as for continuing employees through refresher training. Oftentimes this training can be folded in with other periodic training on conflict of interest, confidentiality, ethics, fraud, cybersecurity awareness, social media, sexual harassment policy, etc. It is important that potential callers understand the hotline objectives, what constitutes an appropriate call and the process. Without this clear understanding, the hotline can quickly morph into a “gripe line” as people use it for purposes well beyond intended uses. For many hotline programs a majority of calls received are not on target with the hotline scope, thus suggesting that additional training is needed.

Executives, managers and supervisors need to take advantage of opportunities to promote the correct usage of the hotline through all-staff meetings, written communications, business meetings and supervisory interactions. Do not fall into the mindset that it only needs to be included in the code of conduct to be effective. Instead, organizations should design and implement an awareness campaign from multiple sources and mediums.

Inviting customers, vendors and other stakeholder groups to use the hotline can be beneficial. They can be in a unique position to report potential employee fraud as they may be solicited by an employee for ill intent. While extending the hotline to non-employee groups often makes sense, you also need to be careful that your awareness campaign differentiates the hotline purpose from routine customer service and vendor relation communications.

There is a tendency for people not to come forward due to a fear of retaliation or concern that they may look uninformed or have a bias. If tipsters don’t feel that the organization offers a safe place to raise concerns, they may forego reporting the potential fraud or seek alternatives to reporting the fraud internally, such as reporting the fraud to a federal government whistleblower program that provides monetary incentives.

As a result, having an anonymous reporting component – coupled with a strong no-retaliation policy that is enforced – is essential. In addition, utilizing a third-party hotline provider to administer the reporting program should enhance the trust level. Entrusting the report follow-up process to an independent department, such as internal audit, will also help bolster trust. Finally, for complaints involving senior management, it is prudent to also route them to independent directors.

Any hotline process is doomed to failure if there is not timely follow up. Callers need to be comfortable that their concerns will be heard and acted upon in a confidential manner. A responsive hotline process must have a clear escalation and dissemination plan, followed by a robust decision-making process for potential further investigation. In all cases, follow-up is suggested with the tipster to either apprise them of next steps for an investigation or educate them on the proper use of the hotline if the tip is found not to be consistent with its scope. Of course, this can be difficult for the anonymous caller. Anonymous tipsters can either opt for no follow-up contact or subsequently contact the hotline to check in on status using a unique identification number of their original complaint. Response protocol and timeliness often determines the overall success of the hotline program.

Keep in mind that a hotline process is simply one important element to an effective corporate compliance and ethics program as defined by U.S. Federal Sentencing Guidelines. Refer to Integrating a Compliance & Ethics Program with a Control Framework for a previous article on these Guidelines.

Like any business process, the hotline program needs to be periodically assessed. Once clear hotline objectives are defined, harvest hotline metrics to gauge performance, such as:

These metrics can then be compared to benchmarking data obtained from your third-party hotline vendor or other industry sources. A high volume of hotline calls compared to industry peers may indicate that the organization is experiencing significant fraud and potentially has an ineffective compliance and ethics program. Or, it could suggest that:

Conversely, hotline silence (i.e., a low volume of calls as compared to peers) may not necessarily imply that unethical or unlawful conduct is not occurring but, to the contrary, may be indicative of inadequate hotline awareness and an overall ineffective corporate compliance and ethics program.

As ethics and compliance programs mature, hotline metrics should be part of an organization’s scorecard to demonstrate performance. Hotline data can also be an important consideration for allocating resources, including for investigations. An organization’s metrics and benchmarking data should assist in combating fraud more proactively. When done correctly, the hotline, in conjunction with a comprehensive compliance and ethics program, will strengthen the organization’s culture.

Don’t simply assume that your hotline is working as intended, especially if you have a low volume of activity. Evaluate it, measure it, compare it and bring it to life!

[1] For the latest study refer to page 17 of the Report to the Nations: 2018 Global Study on Occupational Fraud and Abuse, published by the Association of Certified Fraud Examiners. Go to http://www.acfe.com/report-to-the-nations/2018/ to download report.