Detect Incidents

You must educate your employees on how you want them to behave, but you must also be on the look out for failures to uphold your standards of behavior. It’s essential that you have a structure in place so employees can confidently come forward, without fear of retribution, and allow you to capture information about fraudulent, illegal or unethical behavior, so you can investigate it and correct it.

An incident detection solution should contain the following critical components:

An anonymous reporting hotline that is 24/7/365, run by a third-party and able to assist callers in multiple languages, is a best practice part of that structure. You should be able to customize the escalation procedures you want in place and the hotline should leverage automated dissemination systems so you get the right information to the right person in the organization for immediate follow-up.
There are two kinds of web-based forms that should be part of your incident detection structure. First is a form that lets employees anonymously submit issues over the web. The second is a manager form, that lets managers and supervisors document and submit issues they learn of when employees come and talk to them.
Remember to think about international web reporting, because you should have a way to modify your forms in order to accommodate special requirements and to ensure you are compliant with how you solicit incidents in all geographies in which you operate.
While it’s critical to have processes in place to reactively capture incidents, it’s just as important to have a way to proactively reach into your organization to uncover issues. Surveys and risk assessments let you take the pulse of the organization and provide another way to gather information from your employees.

IN THE NEWS

Top 12 GRC Considerations for Financial Companies in 2012

While regulation is certainly not a new concept to the financial industry, the risks posed by regulatory non-compliance will continue to drive global enterprises to tighten their focus on risk management – literally, the center of GRC – and find the balance between business value and business ethics.