Best practices for maintaining a healthy incident-response program

“Hotline reporting is a very strong indicator of the culture of the organization, the concerns in the organization, and where there are gaps in training and communication,” said Carrie Penman, chief compliance and risk officer at NAVEX Global, during a recent Webinar. So, it’s in the best interest of chief ethics and compliance officers to stay on top of the latest best practices, as well as stay informed about how the performance of their hotline and incident-management programs stack up against their peers.

Enter NAVEX Global’s annual “Risk & Compliance Hotline Benchmark Report.” Published Tuesday, this year’s benchmark report took from 3,255 organizations that received 10 or more reports during 2019 and was based on an overall analysis of 1.4 million individual reports.

While report volume has remained steady at a median of 1.4 reports received per 100 employees over the last four years, new data points added this year show 19 percent of organizations received five or more reports per 100 employees. “This is encouraging news,” the report stated, citing research by George Washington University, which found a strong correlation between report volume and positive business outcome. “More reports are always an indicator of better performance,” Penman said.

This year’s report also revealed, as in previous years, that organizations that track from a variety of reporting methods—Web forms, hotline, open door, mobile, e-mail, and more—saw 100 percent more reports than organizations that track only hotline and Web-originated reports. The message here is clear: By not gathering reports from all methods, and in a centralized database, the ethics and compliance department may be missing out on several culture concerns that simply aren’t being addressed.

Anonymous reports versus named reporters are another metric for taking the pulse of the organization’s culture. According to NAVEX Global’s analysis, most reporters are anonymous, which is somewhat troubling, given that reports made anonymously may suggest lack of employee trust in the compliance program.

Anonymous reports can also be a hinderance from an internal investigation standpoint. “While every organization should encourage reporting of any kind, it’s a lot more difficult to process, investigate, and substantiate an anonymous complaint,” said Greg Keating, practice group leader in the Labor, Employment & Benefits group at Choate. Thus, robust follow-up communication procedures are especially important with anonymous reports in ensuring they are investigated and substantiated as often as named reports.

NAVEX Global’s data also revealed case closure times are another area in need of improvement, which prudent chief ethics and compliance officers and in-house counsel should aim to reduce as much as possible, Keating said. According to NAVEX Global’s analysis, the median case closure time increased from 40 days in 2018 data to 45 days in 2019 data. “A lot of those cases could have been avoided in litigation had the issue been resolved at an earlier stage,” Keating said.

Another new data point in this year’s report revealed a median gap of 21 days between the date an incident occurred and when the individual chose to report it. This is another troubling finding, because a significant gap between the time of the incident and the time of the report could suggest the reporter fears retaliation, or it could suggest there was a breakdown in communication by the frontline supervisor somewhere down the line.

“My primary concern is from an investigation standpoint and the impact that it can have on trying to do a thorough investigation,” Keating said. If a significant amount of time has passed before a report is made, it increases the chance of either evidence getting lost or the incident fading from the reporter’s memory, he said.

Substantiation rates are another indicator of organizational culture. In 2019, the median substantiation rate was 43 percent. “High substantiation rate reflects a well-informed employee base making high-quality reports, coupled with effective investigation processes,” NAVEX Global said in its report. Thus, low substantiation rates reflect the opposite.

Types of reports

While “HR, diversity, and workplace respect” continue to make up the highest percentage of reports, they declined in 2019 to an all-time low of 65 percent. Penman said this finding is surprising and may reflect, in part, the time at which the data was collected, following the high reporting levels in 2017 and 2018 at the height of the #MeToo movement.

The numbers don’t seem to correlate, however, with what is being observed in practice. “The low number of reports that organizations are receiving is providing a false sense of security of what we are actually seeing,” Penman said.

Keating said he has observed a similar trend. “Based on the amount of investigations I did in 2019 that alleged either harassment, a hostile environment, or discrimination, I do not think that the #MeToo era has ended,” he said. “I think they continue to percolate pretty regularly.”

The findings also curiously showed that retaliation reports declined for the first time in eight years—albeit, minimally. Keating said this finding doesn’t reflect what he has been observing in practice through investigations and litigation. “In my view, retaliation claims are continuing to surge, not going down,” he said. “My concern here is that people are not coming forward and speaking to their employers about their concerns.”

To reduce the risk of retaliation reports, one best practice is to “empower your managers, leaders, and employees to recognize and understand retaliation when they see it through clear definitions and real-world examples in your Code of Conduct and retaliation policy,” NAVEX Global advised in its report. It’s also important, the report stated, to investigate alleged retaliation “in a way that provides clear communication with the reporter, anonymous or named, and protects the reporter from further retribution to every extent possible, whether the allegation is substantiated or not.”

Taking into consideration the report’s findings, Penman recommended the following best practices that ethics and compliance officers can adopt now: Focus on shortening the case closure time of reports; get a more complete picture of reported issues and trends by documenting all reports in a centralized incident management system; encourage employees to see the hotline as a resource for information, not just as a reporting channel; and train and communicate consistent definitions on key reporting topics, like retaliation, harassment, and discrimination.

COVID-19 impact

Since the data was compiled for the hotline benchmark report in 2019, “the world has changed profoundly,” and most reports coming in right now specifically relate to COVID-19, Penman said. NAVEX Global staff observed its highest report volume in mid-March, about 25 percent of which were related to COVID-19 reports—mainly concerning environment, health, and safety issues, she said.

Other reporters have expressed concerns about their financial security, particularly in the retail and restaurant industries, Penman shared. The main concern reporters are expressing is an overall lack of communication and “a strong need and desire for more ongoing communication” from their employers during the crisis.

“Reporters are saying that they don’t know what is coming and that their organizations are not communicating,” she said. Anecdotally, emotions are running high among the individuals who are making COVID-19-related reports, and many people are scared—an important message that would be missed by looking at data alone.

Penman stressed that this is an opportune time for chief ethics and compliance officers to shine by providing the senior leadership team with real-time information as to where the biggest risk areas lie to help the business make more informed decisions. For example, where are there communication gaps? Are their certain locations where managers are putting the safety of their employees at risk to meet production demands?

Proactively, this information can then be fed to the crisis management team to address these issues in real-time. As a further resource, NAVEX Global has put together a Web page called “Stronger Together” that offers guidance and resources for chief ethics and compliance officers.

From a data perspective, Penman said one interesting observation has been the increase in named reporters as opposed to anonymous reporters as it relates to many of the COVID-19-related reports. Anecdotally, NAVEX Global staff have observed that about 60 percent of reporters are self-identifying right now, whereas in 2019 it was the direct opposite. “People want their issues specifically addressed, and so they are providing their name,” Penman said.

Aside from the coronavirus pandemic, ethics and compliance officers would be remiss to ignore the current intensity of the Securities and Exchange Commission’s Whistleblower Program over the past few weeks. Keating noted that this further speaks to the importance of fostering a speak-up culture, as well as responding to, and closing, reports in as timely of a manner as possible.