The 2012 Corporate Governance and Compliance Hotline Report has some alarming findings for compliance officers: fraud and instances of retaliation against those who report it are on the increase.
According to the report, the percentage of incidents related to fraud continues to grow, hitting 21.1 percent of all reports, up from 13.6 percent in 2007. “The fact that we're continuing to see this level, even though the recovery is going on, is a surprise,” says Luis Ramos, chief executive officer of The Network, a provider of governance, risk, and compliance solutions and author of the report.
And despite greater protection for whistleblowers in the Dodd-Frank Act, calls concerning potential retaliation against an employee who has made an inquiry through a hotline increased to 2.9 percent of overall incidents, up from just 2.1 percent in 2010.
Over the past five years, The Network has amassed a vast amount of data from the reports that come in through the telephone and web-based hotlines it operates for about 3,000 companies. The Network removes any details that might identify an organization or individual, assembles the data, and then works with BDO Consulting to analyze it.
The percentage of reported incidents related to fraud has grown steadily over the past few years. With the economy remaining tight, Ramos explains, companies continue to have an incentive to investigate any concerns about possible fraudulent activity. That means even if the number of incidence of fraud has not increased dramatically, companies' efforts to uncover it have.
In addition, employees likely are reporting in greater numbers, says Glenn Pomerantz, partner at BDO Consulting and head of its Anti-Corruption Compliance and Investigations practice. “My instincts and experience tell me that fraud awareness has improved over the last several quarters and is a contributing factor to the statistics.”
Along with greater awareness, more employees may report any concerns in order to ward off trouble at their firms. That's a change from even a few years ago, when employees may have been more worried about the potential for backlash, and thus less likely to come forward. Since then, however, they may have seen the damage that can result when some sort of criminal activity isn't stopped until it becomes public. “They are more willing to report because they want to make sure they safeguard their own jobs,” Ramos says.
Yet, most frauds are not the type that can threaten the health of the company involved, finds another recent report on fraud. About 56 percent of the 1,400 fraud cases analyzed in the 2012 Report to the Nations, prepared by the Association of Certified Fraud Examiners, involved amounts of less than $200,000. “What's driving the fraud index is not high value misappropriations, but lower-level theft and shrink,” Ramos says.
What's more, even as the number of fraud reports has grown, personnel management issues account for most reports, making up 47 percent of the total.
“While a whistleblower hotline is necessary, it's not sufficient. You also need a mechanism to proactively gather information without waiting for an employee to come forward.”
—Luis Ramos,
Chief Executive Officer,
The Network Inc.
While the increase in cases of whistleblower retaliation is small, its still cause for concern, says Ramos. “It's a key element we follow, because it is so poisonous to open communication and an ethical culture,” he says. “If people can't tell their organization what's happening, it's a terrible environment.”
Another area that bears watching is the fact that just 28 percent of employees notified management before making a report via a hotline. Moreover, it's possible that even this percentage may decline. Section 922 of the Dodd-Frank Act allows the Securities and Exchange Commission to offer an award to an individual who voluntarily provides original information about a violation of Federal securities law that leads to the successful enforcement action resulting in monetary penalties exceeding $1 million. While the SEC has said that employees who first report through a company's internal compliance program may be eligible for an increase in their awards, it's possible that this provision will gradually reduce the number of employees who report internally, Ramos says.
The report did provide a few positive findings. Among them: the percentage of employees who both report internally and are willing to provide their names and contact information grew, albeit slightly, over the past year. A slight majority – 52 percent – of employees provided their contact information, up from about 50 percent in 2009 and 2010. “It's indicative that employees are more comfortable sharing this information with their employers,” says Ramos.
INDUSTRY DIFFERENCES
The variations in the number and types of hotline reports from one industry to another can be dramatic, the 2012 Corporate Governance and Compliance Hotline Benchmarking Report shows. For instance, the number of hotline reports filed per 1,000 employees hit 10.99 within the retail sector, compared to just 4.13 per 1,000 in manufacturing. Ramos theorizes that the structure of many retail organizations may account for the industry's relatively higher numbers. It's not uncommon for retailers to have regional human resources employees who are responsible for multiple stores. That can make it difficult for store employees to interact directly with HR, so they may find it more practical to report their concerns through a hotline.
The prominence of different concerns also varies from sector to sector. Perhaps not surprisingly, environment, health, and safety violations accounted for seven percent of construction reports, but just two percent of reports within the finance, insurance, and real estate sector.
—Karen Kroll
About two-thirds of the issues reported in 2011 prompted an investigation, the data shows, with 41 percent of the investigations leading the company to take corrective action, such as disciplining an employee or enhancing training. “Companies are taking follow-up steps,” Ramos notes.
It's important that employees be made aware of the actions that result from their reports, Ramos adds. Otherwise, they're left to wonder if their efforts to notify management of a concern simply fall on deaf ears. “Let them know what you're doing,” Ramos says. That should encourage employees to continue to come forward with concerns.
The report indicates that posters remain the most common means of informing employees of the company's ethics and compliance program, used by slightly more than one-third of organizations. More sophisticated measures, however, are growing in use. Ramos says his firm is seeing a renewed focus on the part of many management teams to provide employees with ethics training and to communicate the companies' values, code of conduct, and policies. Increasingly, their efforts are interactive and tailored to different groups of employees, rather than a legalistic report within a three-ring binder that sits on a shelf, where it's rarely viewed, Ramos adds.
While the report offers valuable insight into a range of compliance issues, it's important to keep in mind that reports made via a whistleblower hotline are just a fraction of the issues reported on within an organization. For instance, 43 percent of occupational frauds are initially detected via a tip, according to the ACFE's Report to the Nations. The next most common means of detection was management review of documents, which uncovered 15 percent of frauds. “While a whistleblower hotline is necessary, it's not sufficient,” Ramos says. “You also need a mechanism to proactively gather information without waiting for an employee to come forward.”
That means regularly undertaking a risk assessment to identify areas in which the organization is most vulnerable to a violation of its policies or code of ethics, and then taking action to prevent potential problems. While organizations have to have a means of allowing employees to communicate concerns, they also need to take proactive steps to ward off wrongdoing before it begins. “You want to find things before they grow,” Ramos says.
No comments yet