Jeffrey M. Klink (jklink@klink-co.com) is President and CEO of Klink & Co., headquartered in Pittsburgh, Pennsylvania, USA.
Hotlines can often be the most valuable tool in the compliance, legal, and human resources toolbox. The Association of Certified Fraud Examiners’ “Report to the Nations: 2018 Global Study on Occupational Fraud and Abuse”[1] found that most fraud is identified and resolved because of a tip reported through the company hotline. In fact, hotline reports often notify organizations about serious problems long before they come to light through other organizational controls.
Different types of monitoring
Organizations can use multiple lines of defense to protect against fraud and misconduct, including hotlines and external and internal auditors. Although having all three resources ensures greater protection, relying on a working hotline is often more effective and a better use of department dollars.
Why are hotlines so effective? Simple. Employees are the first line of defense, and they see firsthand when fraud, harassment, or other misconduct occurs. Having an employee or even a third party, such as a vendor, with direct knowledge of a problem be able to anonymously or directly report a concern is extremely valuable to compliance, legal, and human resources professionals charged with keeping an organization safe.
Second to hotlines, internal auditors are in a position to find potential or ongoing problems in an organization. However, there are limitations in their processes and objectives. Internal auditing units are often minimally staffed, because they are not considered a profit center. Few internal audit staffs are large or well-endowed with money and resources. Therefore, having eyes and ears on every happening in an organization is impossible. Another obstacle for internal auditors is that they are often asked to focus more on minutiae (e.g., making sure that employees are following company travel and entertainment policies), rather than on material problems (e.g., managers creating shell companies as vendors, the vice president initiating inappropriate actions with his staff).
Outside auditors should serve as the last line of defense. They often fail to uncover problems that are obvious to employees and vendors, because finding fraud and other misconduct is beyond the scope of the auditor’s tasks. Outside auditors typically perform “financial statement audits” that, due to the objectives of the audit, cannot possibly find well-hidden kickback schemes or ongoing sexual harassment scenarios. External auditors must rely on the information the client provides to them. This is not an effective way to find problems that others are trying to hide.
Reliance on other tools to find problems simply is not as effective as having a working, effective hotline. Those resources, although skilled, often don’t find glaring problems, but not because they don’t know what they are doing. Rather, they cannot possibly be everywhere and be asked to know everything at all times.
Properly maintaining hotlines
Hotlines can be valuable, but they cannot stop bad actors unless properly structured, used, and maintained. We recommend the following to create an effective reporting program for your organization:
-
Communicate: Let your employees and third parties, including vendors, know about the hotline, and require those with knowledge to report suspected or actual misconduct or violations of policies or laws.
-
Monitor: Regularly monitor the hotline.
-
Respond and address: Let the reporter know you are on the case, and take immediate action to begin addressing the concern.
-
Filter: Conduct a simple review based on the report to determine the seriousness of the report.
-
Investigate: Perform investigations when warranted. Be patient, thoughtful, and decisive.
-
Follow the law: If labor or employment laws or policies are at issue, consult with the Equal Employment Opportunity Commission (EEOC) about the timing and scope of an appropriate investigation.
-
Buy-in: Let your superiors know about the investigation, and get them to support your efforts.
-
Conclude: Finish your investigation and, where appropriate, demonstrate the success of the reporting mechanisms to the organization.
Filtering reports
Most reports can be filtered into two categories: minor and possibly serious offenses. Minor reports do not involve suspected or actual violations of your organization’s policies, code of conduct, or civil or criminal laws. These types of reports, for example, often involving employee disputes or complaints about management styles, can typically be addressed with a templated response, and often do not need a robust investigation, if any.
Suspected serious reports, including claims of sexual harassment, important code of conduct violations, or potential breaches of civil or criminal laws, should be treated seriously and with a sense of urgency. In some situations, the government has set forth very specific rules about when and how to respond to reports. As one example of this, the EEOC has set forth very specific timing and other guidelines for responding to certain labor and employment issues.
Investigating reports
If a report is made, and it is believed to have merit, always use appropriate personnel to conduct the investigation. Human resources professionals working in-house often have substantial experience conducting investigations regarding claims of bias or harassment. They are truly experts in labor and employment issues. But in some cases involving theft, fraud, corruption, or bribery, an outside expert might be needed to ensure that an appropriate review is undertaken that is considerate of legal and other potential consequences.
Allegations of vendors paying kickbacks to employees can be particularly challenging reports to investigate. In these cases, there are almost never any documents readily available to explain how the scheme works. There is usually no trail of company records showing how a vendor is providing vacations, cars, money, and other extra benefits to employees. Vendor kickback investigations often require expertise in finding obscure records and interviewing individuals outside of an organization.
So how do you proceed if there might be merit to a serious report? Consider this:
-
Be patient and follow the policies and procedures set forth in your code of conduct.
-
Show respect to everyone in the process, including those who might be engaged in misconduct.
-
Do your homework! Gather all preliminary documentation and evidence before performing interviews of either people with knowledge or others who may have committed the suspected misconduct.
-
If the reporter has consented to be contacted, ask for additional information if facts are developed that require clarification or insight.
-
Conduct interviews only when you have obtained and reviewed available information, including emails, invoices, and documentary information. Be prepared to conduct thoughtful interviews when you already have many of the answers to your questions.
-
You don’t want to ask those suspected of misconduct questions that are not well informed. In fact, the last thing you want to do is ask someone, “Did you do it?” and respond, “Oh, you didn’t, never mind.”
Conclusion
Ensure that everyone in your organization, including employees and third-party vendors, knows how to properly operate the hotline and understands their obligations to report even suspected violations of your own rules or the law. When investigating, be thoughtful and patient. If problems are identified, change internal controls or policies to ensure that future misconduct is prevented. The company’s bottom line can be protected by dedicating the time and resources to running a proper hotline.
Takeaways
-
Hotlines are the most valuable tool available to detect fraud and misconduct.
-
Companies with hotlines face 50% less cost in fraud losses.
-
Employees are always the first line of defense and the most common whistleblowers.
-
Operate an effective hotline in four steps: monitor, address, filter, and respond.
-
Patience is key when conducting large-scale investigations for serious offenses.