More Than Just Talk: Hotlines

By Dave Slovin, Vice President of Business Development, The Network and C. O. Hollis Jr., CPA, CIA, CFE, Director of College Auditing and Advisory Services, Morehouse College

Colleges and universities are uniquely complex organizations with vulnerability to fraud and other unethical behavior. The diversity of operations and the sizes of the various university populations make it difficult to monitor behavior and prevent malfeasance. In terms of internal fraud, administrators can accept bribes or divert institutional payments. Externally, suppliers can overbill in a variety of ways. Another area of risk is illegal or unethical behavior on the part of any representative of the college or university, which could damage the institution’s reputation.

The good news for internal auditors is that institutions of higher education are increasingly adopting hotlines, a tool that has proven its value in law enforcement and in corporate America. When considering implementing a hotline, internal auditors should understand the role of a hotline as a detection tool, hotline best practices and the importance of communications regarding ethics and the hotline.

Hotlines as a Detection Tool

The Federal Bureau of Investigation uses hotlines to gather information that leads to the capture of criminals. A recent example of this is the capture of the Washington, D.C., snipers, who were discovered as the result of a call to a hotline. Decentralized employers, such as retailers, have relied on hotlines for uncovering internal theft for more than 20 years. The Sarbanes-Oxley Act of 2002 expanded the use of hotlines by requiring publicly traded companies to offer a confidential reporting process to employees as a governance best practice. Now not-for-profits are seeing the value of a mechanism that helps both deter and detect improper behavior.

One out of five American workers has personal knowledge of workplace fraud, according to a 2002 study sponsored by Ernst & Young LLP and conducted by research firm Ipsos-Reid. It is interesting to note that 80% of the participants indicated that they would turn in fraudsters who were stealing from the employer, but of those who had the opportunity, less than half of them actually did. Of that group, 39% were more likely to report fraud if they could remain anonymous, and 57% chose a hotline as the best means to report fraud.

The Association of Certified Fraud Examiners periodically surveys its members to understand the dynamics of fraud. Their 2004 Report to the Nation found fraud is discovered via a tip 40% of the time, making tips the number one method of fraud detection. The same survey found that fraud losses were reduced by more than 50% for organizations with a hotline. Educational institutions lost an average of $31,000 per scheme, with the most common type of fraud involving erroneous billing.

The American Institute of Certified Public Accountants (AICPA) has also recognized the value of hotlines. In January 2005, The AICPA’s Antifraud Programs and Controls Task Force published a tool designed to help evaluate the effectiveness of a hotline. As part of the announcement of the new guidance, the AICPA recommended that all organizations seriously consider establishing a whistleblower hotline because of its effectiveness for catching fraud at the management level. Internal auditors within the academic community should be able to use the AICPA advice to implement changes to an existing process to improve detection of fraud perpetrated by internal parties or by suppliers.

Although hotlines are a proven tool for fraud detection, many institutions of higher education still do not have an anonymous hotline. The financial investment in a hotline is small in comparison to the potentially disastrous results of malfeasance that continues undiscovered. Beyond the obvious financial benefit of stopping fraud in its early stages, a hotline provides the opportunity to limit liability. Uncovering and dealing with sensitive issues before they are exposed in the media can be especially important for a college or university because of the opportunity to protect the organization’s reputation. For example, a tip regarding misuse of research funds could be investigated and the matter rectified prior to notifying the sponsor.

Best Practices

Multiple Reporting Mechanisms The most effective way to learn about fraud is to provide faculty, students and vendors with a variety of methods for reporting their concerns about illegal or unethical behavior. Interactive communication, such as a face-to-face conversation or a hotline interview, generates more detailed information than one-way communication, such as an anonymous note. While some individuals may feel comfortable coming forward through an open door policy, others may not. Resistance to revealing one’s identity may be due to fears about potential retaliation, especially when reporting a peer, professor or supervisor. In these situations, the hotline interview is the best option for the institution, because an interview conducted by an experienced interviewer results in the most actionable information possible.

There is also evidence that people feel more comfortable using an anonymous hotline. The Ernst & Young survey showed that while 57% of those surveyed would report unethical behavior using a telephone hotline, 20% of respondents would write an anonymous letter, and only 16% said they would use an anonymous Web site. The student population may more readily accept the Web as a vehicle than the population included in the Ernst & Young survey, but Web-savvy individuals often point out the ease of tracking IP (Internet protocol) addresses as a cause for concern. Offering several reporting options will accommodate the preferences of different individuals.

Interactive Interviews 24/7/365 An effective hotline must be available 24 hours a day, 365 days a year. Many organizations operate a hotline by publicizing a number that reaches an individual in administration during the work day, and then is answered by voice mail outside of business hours.

This is not ideal because nearly 50% of hotline calls occur at night or on weekends, and these calls deserve the same treatment as contacts made during the day. Sometimes an individual will not leave a message because of a fear that his or her voice will be recognized. If the individual does happen to leave a message, it may be incomplete and disorganized due to an urge to get off the phone. A more effective approach is to have someone who knows the right questions to ask answering the line any time, day or night.

Given that the purpose of the hotline is to gather enough information to support an investigation, there is no substitute for a robust interview. Therefore, when one considers the pros and cons of various solutions, the interview process should be the most important factor. The interview needs to be detailed and tailored to the type of concern being reported. For example, the line of questioning necessary to properly document falsification of research findings in order to qualify for a grant will differ greatly from the appropriate questions for a case of violating athletic eligibility. Questions that are tailored to the incident help paint a picture and guide follow-up actions.

The interview technique becomes even more critical in light of the possible state of mind of an anonymous person. As mentioned previously, anonymous parties may often be anxious and provide information in a disjointed manner. The interviewer should have specialized training on how to help callers remain calm. Ideally, the interviewer should have supporting technology that will assist in tracking the information reported, pointing out any need for clarification.

Looking at an example in detail, consider a report claiming, “My professor isn’t fair.” A voice mail or e-mail report might end there. An interactive sequence of questions, however, could reveal that the professor is treating students differently based on gender or ethnic group. The issue becomes more serious when the possibility of discrimination is raised. Asking questions that elicit examples of preferential treatment (without biasing the caller) becomes an important part of validating the allegation. An experienced interviewer asks unbiased questions that help the organization gain enough information for the investigation.

Maintaining communication with an anonymous person after the initial contact enhances the hotline’s usefulness. Each hotline report should be assigned a unique code, and the individual should be asked to call back within a predetermined time period. The unique report number enables the person to call back to offer additional information while maintaining anonymity. Investigators will have a chance after reviewing the report to provide questions to be asked of the caller if he or she does call back. This process can be very helpful as an investigation unfolds. Unfortunately, roughly 70% of anonymous callers never call back, so a dialogue capability does not alleviate the need for a detailed initial report.

Internal versus Third-Party Operations The AICPA’s guidance on anonymous hotlines mentions using a third party to operate the hotline as a method for improving the perception of confidentiality. An external process provides greater safeguards of anonymity and avoids even the appearance of impropriety. While there are costs associated with an external hotline, the financial investment is small in comparison to the potentially disastrous results of malfeasance that goes undiscovered.

With the expertise, trained personnel, resources and technology already established to operate a hotline and conduct quality assurance, a professional hotline provider can usually provide these services for much less than it costs to implement them internally.

Report Dissemination One of the most important aspects of having a hotline is deciding where to send the information that is received. Report dissemination procedures should protect faculty, staff and students from retaliation and safeguard auditors from accusations of improper handling of the investigation. To ensure allegations reach the right people, hotline incident reports can be automatically routed to one or multiple recipients within the college or university structure. A report dissemination routine should be set up with the hotline administrator so the appropriate officials receive reports of illegal or unethical behavior.

Dual dissemination is a helpful practice for ensuring complaints are not overlooked. This simply involves having an appropriate official, in addition to the investigative authority, receive copies of all hotline reports as a secondary layer of dissemination. For example, a report of internal theft could be sent to a designated security person as the primary recipient of the information, with a copy to the ethics officer or an official in a similar position, as the secondary recipient. Dual dissemination acts as a protective device in case a report is sent to the accused party. If a report is distributed to only one person, and that person has a motive for preventing an investigation, the system is vulnerable.

Another operational consideration is accelerated notification of a time-sensitive issue. For example, if an allegation is received regarding potential campus violence, security officers should be alerted immediately. Procedures that must be followed when time-sensitive issues are reported should be set up during the planning stages, as part of a global crisis response plan. The group responsible for setting up the hotline must agree upon a list of topics that are sufficiently critical to require immediate notification 24 hours a day, such as threats of violence or an allegation that a recurring fraud will occur again in the near future. This ensures key parties have a shared understanding of how such a situation will be handled.

Communication Regarding Ethics and the Hotline

Launching the Program Like any new initiative, a hotline program will fail if it is not launched properly. The initial communication should include an announcement by the president of the college or university about the goals of the program and the reason for implementing it. Employees should be told that the college or university is providing every opportunity to report problems, and the information will be sent to top management and/or to the governing board. Information about the program should be posted on intranet sites, in break rooms and in other appropriate places, and should be introduced in face-to-face meetings wherever practical. Every member of the staff and administration should receive a letter or flyer announcing the program, and ideally an accompanying card that he or she can keep in a wallet or purse as a reminder of the phone number. New employees and students should receive this information during their orientation.

Ongoing Communication Communication about ethical behavior and options for reporting inappropriate behavior should ideally be repeated several times a year. The hotline can only be effective if people know it exists. Consumers are exposed to numerous promotional messages in a typical day, and messages about the hotline will need to be conveyed in a manner that cuts through the clutter of information. One way to accomplish this is periodically changing informational postings to keep them from becoming “wallpaper” that no longer attracts attention. For example, if the initial posting used a photograph of a school setting, the replacement poster might use a photograph of a person on the telephone so that the change is immediately visible to anyone passing by.

A comprehensive hotline program includes communication explaining the behaviors that are unacceptable. Posters in high traffic areas, articles in newsletters or school publications and pages on intranet sites all help create awareness of ethical issues and act as preventative devices. Such communication reinforces the perception that the school wants to know about illegal and unethical activities so that action can be taken to stop them. If the institution discovers there are trends in the types of behaviors being reported via the hotline, these posters are a useful tool for explaining which behaviors are not condoned.

The best return on investment from a hotline will come from promoting it to as many people as possible. Consider an example in which a member of administration is handling collection of fees from companies who are sponsoring an activity on campus. If the administrator asks the contributors to make checks out to him, they may question the practice but not know where to turn with their concern. Listing the hotline number on all checks and invoices issued is an inexpensive action that has helped other organizations uncover fraud. Knowledge that the hotline number is communicated to anyone writing checks to the institution will have a deterrent effect on anyone tempted to commit internal fraud.

Detecting and deterring unethical behavior help protect the college or university from losses and negative publicity that could hurt the institution’s reputation. Offering a professional, confidential hotline gives employees, students and suppliers every possible means for coming forward about especially sensitive situations. Ultimately this gives the institution an opening to investigate allegations and take corrective action in order to minimize losses.

About the Authors

Dave Slovin is the Vice President of Business Development at The Network, a company that has operated confidential hotlines for more than 20 years. The Network provides hotline services to some of the nation’s largest colleges and universities.

C. O. Hollis Jr., CPA, CIA, CFE, is Director of College Auditing and Advisory Services at Morehouse College in Atlanta, Georgia. In 2004, he coordinated the implementation of an ethics line at the college to assist Morehouse in detecting and reporting suspected unethical and illegal behavior.