Compliance hotlines can alert management to possible instances of unethical or fraudulent behavior and can highlight the need for additional training on the organization’s policies. They can enable “employees to participate in enhancing the culture” of organizations, says Julie Myers Wood, chief executive officer with Guidepost Solutions, a risk, investigation and compliance consultancy.
Indeed, a hotline is where “the rubber meets the road” for an organization’s overall compliance program, says Donna Boehme, principal of Compliance Strategists. “All of the risk assessment, policy development, training, monitoring, and reporting activities of the program are useless unless they result in employees’ willingness and ability to safely raise compliance issues and concerns.”
Yet hotline initiatives often fall short of their potential. The 2016 Ethics and Compliance Hotline Benchmark Report, an analysis of more than 800,000 hotline reports by NAVEX Global, a provider of compliance solutions, identified the ways in which hotline programs are doing well, as well as the areas in which many could improve.
One is the median case closure time, which rose from 32 days in 2001 to 46 days in 2015, according to the report. Employees are apt to grow frustrated when workplace issues fester for six or seven weeks, says Carrie Penman, chief compliance officer and senior vice president, advisory services, with NAVEX Global, as well as an author of the report. In addition, “the longer the time, the more employees may think nothing is happening.”
Penman said many organizations attribute the lengthening schedules to a lack of resources and the complexity of the cases. While these reasons likely are legitimate, the growing time frames can impact hotline programs’ effectiveness.
In addition, fewer than one-third of employees who submit reports follow up, NAVEX found. When employees don’t check back, they may assume nothing is happening. At the same time, those investigating the report can find their efforts to move forward stymied because of the lack of information.
In her work, Boehme also sees several recurring gaps in hotline programs. These include mishandled program oversight, a lack of feedback, failure to maintain confidentiality, and inadequate follow-up.
“Repeated communication about the availability of the hotline and a reassurance of no retaliation is key to its success.”
Bill Libit, Partner, Chapman and Cutler
Steps to take: An effective hotline program starts with the onboarding of new employees. Their training should incorporate information about the hotline, its uses, and the protections in place to safeguard employees’ confidentiality and anonymity.
The training should emphasize the need for employees to remain in contact after they submit a report. “Tell them why you might need them to follow up,” Penman says. For reporters who prefer to remain anonymous, companies should enable continued contact via a user name or identification number.
Similarly, the organization needs to keep employees informed of the progress of investigations and their conclusions, to the extent possible. “As you respond back, it gives assurance that the hotline program is legitimate,” says Jillian Bower, vice president, business development, with Compliance Resource Center.
At the same time, the information should provide a realistic idea of the information the company typically can provide at the end of the investigation. Privacy and confidentiality concerns typically limit what organizations can tell those who’ve come forward. “I often tell employees that I don’t discuss their personal information with their coworkers,” Penman says. So, “I can’t and won’t discuss personal information belonging to their coworkers with them.”
The code of conduct and ongoing compliance training also should include information about the hotline. “Repeated communication about the availability of the hotline and a reassurance of no retaliation is key to its success,” says Bill Libit, a partner with Chapman and Cutler.
IN-HOUSE OR OUTSOURCE?
Companies implementing hotline programs need to decide whether to administer them in-house or contract with a third party. Both choices have advantages and disadvantages.
When companies administer their own hotline programs, they need to ensure the line is answered 24/7, says Jillian Bower, vice president business development, with Compliance Resource Center, LLC. They also need to reassure employees their reports will remain confidential and when requested, anonymous. “There’s a concern the individual (taking reports) will recognize their voice or know their email address,” Bower says.
For these reasons, employees may feel safer reporting violations to a hotline managed by a third party, says Bill Libit, partner with Chapman and Cutler LLP.
Engaging a third-party to administer the system also is a way to demonstrate to regulators that you take the program seriously, says Julie Myers Wood, chief executive officer with Guidepost Solutions.
Working with an outside hotline provider carries its own risks, however. One is that allegations are filtered before being reported to the company. “The best third-party operators are recording and reporting (messages) to the companies substantially as they’re received,” Libit says. They also offer a range of mechanisms employees can use to submit reports, including phone and web. They should track and aggregate all reports.
Some organizations fail to follow-up or analyze the information provided by the third-party in a timely manner, Wood says. “Utilizing a third-party vendor does not help a company if underlying complaints are not addressed appropriately.”
—Karen Kroll
,
Of course, encouraging employees to use the hotline is just the first step. The organization also needs to gather the information that will allow it to conduct thorough investigations. “It’s ‘who, what, when, where, why’,” Penman says. “Who was involved? Who might have witnessed it? Who knew about it? When did it happen? Was it ongoing or one-time? Where did it occur?”
Many organizations can further build the credibility of their hotline programs by regularly letting employees know general information, such as the number of reports received, the topic areas covered, and any actions taken. “The onus is on the organization to publicize what they’re doing with the information received through the hotline,” Bower says. Showing the hotline is a good-faith effort to provide employees with a way to alert management to wrongdoing can reduce the incentive to report issues outside the organization.
Organizations can also encourage greater hotline use opening them to employee inquiries—essentially, expanding it into a helpline. “It’s an opportunity for the organization to receive inquiries from employees seeking guidance on ethics and compliance issues,” Libit says. For instance, an employee may want to know whether he can accept a supplier’s invitation to a professional football game. By working through the decision with the employee, the organization stands a better chance of reducing actions that violate government regulations or its policies.
Another benefit: Employees may be more comfortable reporting misconduct if they’ve previously called the hotline to discuss other questions. “It’s important for employees to see compliance as a resource to help avoid problems, and not a last resort,” Penman says.
A credible, effective hotline program also needs to report to management the information they need to follow-up and continually improve their compliance efforts, such as the overall volume of calls and areas that appear to be generating a disproportionate volume of inquiries. This is key, as management and boards of directors sometimes assume the launch of a hotline will “magically raise to their attention any serious matters in the organization that require their oversight,” Boehme says. “Without further enquiry, this is a dangerous form of false security.”
CASE CLOSED!
Retaliation: The risk of retaliation is a tremendous concern to most employees considering whether to report actions they believe violate relevant regulations or their organizations’ policies. While instances of retaliation accounted for less than one percent of the reports in NAVEX’ database, 26 percent of those were substantiated in 2015. That’s up from 10 percent in 2013.
Although the jump seems like a step backward, the reverse may be true. The increase in substantiated instances of retaliation could mean more companies are taking the allegations seriously, Penman says. Their efforts may act as a deterrent to those considering retaliatory actions, she adds.
That’s key, as about 45 percent of the 2015 reports to the Equal Employment Opportunity Commission included charges of retaliation. Employees who feel they’ve been retaliated against after raising an issue within their firms may feel justified in reporting it elsewhere outside.
To assuage fears of retaliation, management should provide the tools that will help employees learn to recognize and avoid it, Penman says.
The Code of Conduct should state that retaliation against an employee who’s raised an issue in good faith will not be tolerated, Wood says. “It is important to create a culture where employees can freely ask questions and raise issues and concerns without fear of retaliation,” she says.
Credible, effective hotline programs are one key to that culture.
No comments yet