The Hotline as a Board Safety Valve

By Tony Malone and Marian Exall

For years hotlines have worked to reduce run-of-the-mill fraud losses. Connecting them to the board will enable directors to police more serious instances of fraud.

It is tempting to hope that the well-publicized debacles of the past 18 months are the exception, and that the vast majority of companies are ethically and honestly managed. Yet an article in August’s CFO magazine suggests otherwise. One in six chief financial officers reported being pressured by chief executives to misrepresent financial results, and 5% said that they have violated accounting rules in the last five years. Still, 93% denied engaging in aggressive accounting practices.

Even if financial misstatements represent only a tiny percentage of total occupational fraud cases, these instances are by far the most damaging and expensive to the corporation. The Association of Certified Fraud Examiners’ (ACFE) 2002 Report to the Nation indicates that the median loss for detected fraudulent statements is $4.25 million — more than 50 times the median loss from much more common offenses like inventory theft or payroll fraud.

The duty of care to shareholders requires that boards implement appropriate measures to detect and prevent fraud. Attention so far has been focused on structural steps, such as the New York Stock Exchange’s revisions to its listing standards that tighten the definition of an “independent” director, require independent directors to constitute a majority of a board, and mandate that director compensation be the sole remuneration for audit committee members, among other measures. These safeguards (and similar proposals from other stock exchanges and business organizations) are all worthwhile, but they do not address the essential task underlying the director’s duty of care: the duty to inform himself or herself about what is going on in the company.

Need for new information sources

In most companies, the primary source of information about the company’s operations is senior management. Are carefully prepared reports to the board from, or channeled through, senior executives an adequate communications channel, given the high stakes involved? Evidently not, as the recent accounting scandals demonstrate. Executives engaged in disguising losses or plumping up revenues in mandated public financial disclosures will hardly be challenged by tailoring internal disclosures made to the board. Post-Enron, it is clear that directors will be expected to take more initiative to dig beneath and around the summary information provided to them by management. This will require the creative use of existing communication tools, as well as the development of new information sources.

Many companies already recognize how important it is for directors to fully understand what’s going on in the company. Some have adopted indepth orientation programs for new directors. Others are actively seeking out directors with CFO experience and assigning them to the audit committee. Taking a different approach, Home Depot Inc. has long required each director to make four visits to stores every quarter. The stores visited are the director’s sole choice, and the visits are unannounced. They typically consist of a tour of the store, followed by a session in the break room, when associates have the chance to voice concerns or comments. But this measure may not be appropriate outside the retail chain environment, and it has limited usefulness when it is the conduct of corporate executives that is suspect.

The ACFE offers guidance on what communication tools are most useful. The association’s Report to the Nation indicates that the leading means of discovering fraud in the workplace is “tips.” This generally means whistleblowing by employees but can also include tips from vendors and customers, as well as anonymous tips. More than 46% of workplace fraud cases are uncovered this way, compared with 30% that are turned up by either external or internal auditors. This finding suggests that resources should be spent on facilitating channels for employee communication.

The most effective mechanism

Indeed, the ACFE report shows that establishing anonymous reporting mechanisms, such as a business ethics hotline, has a significant impact in limiting fraud losses. The median loss for an organization with a hotline was $77,500, while the median loss where no hotline was in place was $150,000. Although each of the other antifraud measures studied — including internal audits, external audits, and background checks of applicants and employees — played a role in limiting losses, it was the hotline that proved most effective in detecting fraud.

In the absence of an effective internal process for reporting business ethics violations, an employee may turn to external channels. At a conference last year at Baruch College of the City University of New York, Charles Neimeier, chief accountant for the Securities and Exchange Commission’s Division of Enforcement, stated that there has been a surge of information about dubious financial reporting being fed to the SEC’s e-mail complaint line from “disgruntled employees, from nuts,” as well as from company insiders “who are tired of what they view as shenanigans.” If those company insiders had a credible way to get their information to where they knew it could be promptly acted on — to the board’s audit committee, for example — public financial misstatements, and the disastrous consequences of their discovery, might be avoided.

Horrified witnesses

Employees below the level of senior management have a heightened awareness of accounting irregularities now that they have witnessed the fall of Enron and the horrendous impact on employees, who lost not only their jobs but also their savings. As the Sarbanes-Oxley Act acknowledges, anonymous reporting is a safety valve for employees who are caught in the middle of an unethical business practice perpetrated by their superiors.

It seems obvious that employees and others surfacing accounting fraud or other high-level misconduct should have access to independent board members. Yet there is a strong tendency for whistleblowers to stick to the chain of command. Sherron Watkins, Enron’s vice president of corporate development, wrote a seven-page, no-holds-barred letter detailing her concerns about Enron’s accounting practices several months before the company’s financial situation became public, but she addressed it to the company chairman, Ken Lay, who shrugged it off. It is pure speculation whether this letter, in the hands of a strong-minded outside director, might have at least ameliorated the meltdown that caused so much hardship to employees and shareholders.

A third-party hotline provider can facilitate board member access to hotline communications in two ways. First, it can engage in a triage process, identifying the exact nature of the report and the appropriate level within the organization to which the report should go. If the subject is fraudulent financial disclosures or other predefined top-level matters, or if an allegation is made against a senior executive, the report should go to board members. Second, if the person who reports misconduct specifies that the board be informed, that request should be honored.

Board members should take the duty of care one step further than simply establishing a hotline. An anonymous reporting mechanism is an effective safety valve only if employees at all levels of the organization are aware of its existence. Board members should require documentation that management is actively communicating to employees about the hotline. This communication needs to be repeated periodically to ensure the effectiveness of the hotline.

A connection to the board

In the turbulent, post-Enron world, corporate directors no longer can rely exclusively on information funneled through senior management to fulfill their duty of care to get an accurate picture of the company’s operations. They must have access to communication channels that bypass senior management. Similarly, employees, vendors, consultants, and other stakeholders need a reliable and credible mechanism to get critical information to a level at which it can be effectively acted on. The business ethics hotline provides such a channel. For years hotlines have worked to reduce run-of-the-mill fraud losses. Connecting them to the board will enable independent directors to police more serious instances of fraud, and perhaps prevent the kind of corporate disasters we have witnessed in recent months.

From Recommendation To Requirement

An overlooked provision in Section 301 of the Sarbanes-Oxley Act requires that audit committees of publicly held companies establish procedures for “the receipt, retention, and treatment of complaints received by the issuer regarding accounting, internal accounting controls, or auditing matters; and…the confidential anonymous submission by employees…of concerns regarding questionable accounting or auditing matters.” While companies wait for the SEC to enlarge on the new complaint procedure requirement, it is at least clear that such a procedure must include effective protections for the informant.

Elsewhere in the Sarbanes-Oxley Act, there are stringent provisions prohibiting retaliation against those who come forward with information about corporate fraud. A telephone hotline, especially if operated by an experienced third party, would meet the requirements of the legislation. However, the effectiveness of business ethics hotlines depends primarily on two interrelated factors: whether they are used by the employees, vendors, consultants, and others who may have pertinent information, and what use is made of the information after it is called in.

The first step is to clearly and repeatedly advertise the existence of the hotline, and how and when to use it. Organizations are often fearful that promoting a hotline, especially one that offers anonymity, will encourage frivolous claims or malicious accusations. However, if the company commits to investigating all tips in a prompt, thorough, and fair manner, and is seen to take appropriate action if any misconduct is found, over time it will establish a climate of credibility not only for the hotline itself but also for management’s overall commitment to ethical practices.

That climate cannot be created unless the hotline report is channeled to a level in the organization above the level of the individual whose misconduct is the subject of the report. Thus, while a complaint of alleged kickbacks being taken by a district manager might be appropriately routed to a particular corporate department, a complaint from the controller of pressure from her CFO boss to cook the books may be ignored by risk management personnel who themselves report to the same CFO. This “information routing” aspect will require careful planning in setting up the reporting mechanism. Indeed, this is the issue that has resulted in the current situation, in which senior management reports are virtually the only source of information for board members. This situation argues strongly for outsourcing the operation of the hotline to a company that has trained personnel who are experienced in handling a wide variety of stakeholder communications.

Tony Malone is chief executive officer of The Network Inc., a company that has provided hotline services since 1982. The Network helps companies collect and respond to feedback from employees, suppliers, and customers on such issues as ethics, safety, and service quality. Other services include incident and accident reporting, compliance tracking, and awareness programs.

Marian Exall practiced law in Atlanta with Long, Aldridge & Norman and King & Spalding before becoming Home Depot Inc.’s senior employment counsel. Now an independent consultant, she devotes herself to a preventive practice, concentrating on human resources policy and program development, training, and investigations.

Spring 2003 | Directors & Boards

Download this Article [PDF]