Employee Hotlines – A Valuable Fraud Detection Tool
By Tony Malone and Ralph Childs
Legislative enhancements to protect whistleblowers encourage
compliance with corporate ethics
TIME MAGAZINE DECLARED 2002 the year of the whistleblowers,
selecting three employees from Enron, the Federal Bureau of Investigation
(FBI), and WorldCom as the persons of the year. Although the people profiled
by Time were unable to divert financial catastrophes at Enron and WorldCom,
the focus on whistleblowers is well deserved. Surveys regarding fraud
detection have shown that tips from employees or other interested parties
are the leading source for a live operator to detect fraud. A prime example
of this is the case at WorldCom, in which an employee's comment to the
head of internal audit led to the investigation that rocked the company.
Encouraging employees to bring malfeasance to light is a delicate business,
because doing so often means questioning the actions of a supervisor
or an even higher-ranking corporate manager. In the past, employees have
stepped forward at great risk to their careers. As organizations enter
a new era with the U.S. Sarbanes-Oxley Act of 2002, steps have been taken
to protect employees who come forward to report questionable accounting
or auditing matters.
The new law has established stiff penalties for corporations that retaliate
against an employee who reports financial irregularities. But an even
more important precedent set by section 301 of Sarbanes-Oxley is the
requirement that public companies provide a mechanism for reporting financial
irregularities that allows employees to remain anonymous. This is an
important ruling because anonymity is the ultimate employee protection
against retaliation. This requirement may prove extremely helpful to
internal auditors, who will benefit from implementing a powerful tool
for detecting fraud perpetrated by either internal or external parties.
Hotlines 101
Although the law states that the audit committee is responsible for "establishing
procedures for the receipt, retention, and treatment of complaints ...
regarding accounting, internal accounting controls, or auditing matters," internal
auditors should be very active in developing and evaluating options.
As options are considered for compliance with the complaint-procedure
requirement, there are several questions that should be asked to help
implement an effective process.
Does the company have an anonymous hotline?
An open-door policy and a suggestion box are both good ideas, but they
are not enough. The financial investment in a hotline is small in comparison
to the potentially disastrous results of malfeasance that continues undiscovered.
Beyond the obvious financial benefit of stopping fraud in its early stages,
a hotline can give a company the opportunity to limit liability regarding
offenses such as discrimination. Finally, uncovering and dealing with
issues before they are exposed in the media can protect the company from
the destruction of goodwill in the eyes of investors, customers, and
other stakeholders.
Is the hotline run professionally?
Unfortunately, many companies set up a hotline number that is routed
to a junior employee somewhere in the company. There are several issues
with this solution, the most serious being that employees may not be
comfortable calling an internal number because they may fear their identity
will be traced. Other issues include inconsistent handling of sensitive
calls and callers encountering voice mail.
Is the hotline number always answered by a trained interviewer?
There is no substitute for human interaction when dealing with an anonymous
caller, because there may never be another chance to gather information.
Because an anonymous caller typically feels threatened and is in an emotionally
charged state, he or she tends to give information in a disorganized
manner and is likely to leave out details that will help with the investigation
of the allegation. A professionally trained interviewer will ask questions
that help the company gain enough information to be able to investigate.
Are complaints received around the clock?
To be effective, a live operator should answer a hotline 24 hours a
day, 365 days a year. Nearly 50 percent of all hotline calls happen outside
regular business hours, and these calls deserve the full attention of
an experienced interviewer. Employees don't want to call from work, and
they usually won't leave a message. Someone who knows the right questions
to ask needs to be there to answer the call, 24 hours a day, seven days
a week.
Is there a process for sending questions to anonymous callers
after they hang up?
The critical issue when dealing with an anonymous caller is gathering
enough information to begin an investigation. One of the most important
aspects of an anonymous hotline is a process in which the caller is given
a unique code that correlates to his or her report and is asked to call
back after a predetermined interval. This gives internal audit and/or
the audit committee members a chance to review the information and provide
questions that will be asked of the caller if he or she calls back as
agreed. This process can be very helpful as an investigation unfolds.
Do employees know how to report illegal or unethical activities?
A common failing of an ethics program is insufficient communication
to employees about their options for reporting issues. They must be periodically
reminded of the organization's open-door policy, ethics officers or ombudsmen,
and the anonymous hotline number. It is important to provide options
for reporting concerns, and then to make sure employees are aware of
those options.
Do employees know which behaviors are not acceptable?
A comprehensive ethics program includes frequent communication to employees
about the behaviors that are unacceptable. This communication should
be readily available via posters in break rooms and articles in employee
newsletters and on corporate intranet sites. This communication reinforces
the employee's perception that the company wants to know about illegal
and unethical activities and helps an employee decide to make the call.
Employees may need special communication from the company that explains
the nature of issues related to Sarbanes-Oxley. Define terms like "accounting
irregularities" and "insider trading," which may not be
clear to all employees. Topics should include insider trading, improper
loans to executives, accounting irregularities, conflicts of interest,
and whistleblower retaliation. Finally, it is important that the ethics
program emphasize that the Sarbanes-Oxley Act makes it illegal for the
company to retaliate against an employee who reports accounting or audit
irregularities.
Should the hotline accept complaints about issues other than
financial irregularities?
Employees will use a hotline number to report any issue that makes them
uncomfortable. Other issues, such as discrimination and sexual harassment,
may be high-liability issues that need to be addressed. Turning away
these calls may alienate the employee, who has made the difficult decision
to take action. Most companies prefer to learn about any high-liability
issue as early as possible, so that damage control can begin and potential
legal action can be averted.
Some large companies have set up a separate hotline for each type of
issue. This system is typically difficult to communicate and is confusing
to employees. Offering one hotline for a host of complaints is simple
for employees and reduces the communications burden. A professional hotline
provider should be able to automatically disseminate reports to different
departments within the organization based on the type of issue reported,
so that the appropriate people quickly learn about complaints that pertain
to their area.
Who should be notified about the hotline?
Hotlines are a well-established tool for detecting fraud and can be
used in a broad perspective as well. If a company is being swindled by
a supplier, chances are there are employees working for the supplier
who know about it and are bothered by the illegal activity. Listing the
hotline number on checks issued to suppliers is an inexpensive action
that has helped other companies uncover fraud.
In the same vein, investors may be aware of insider trading activities,
and publishing the hotline number offers them a convenient way to communicate
to the board. Informing investors about a hotline number tells them the
organization has complied with this aspect of Sarbanes-Oxley and validates
the company's commitment to uncovering fraud.
What is the best way to launch a hotline?
Like any new initiative, a hotline is destined to fail if it is not
launched properly. The initial communication should include an announcement
by top management about the goals of the program and the reason for implementing
it. Employees should be told that the company is providing every opportunity
to report problems and that the information will be sent to top management
and/or to the board of directors. Information about the program should
be posted on the company's intranet site, in break rooms, and should
be introduced in face-to-face meetings wherever practical. Every employee
in the company should receive a letter or flyer announcing the program.
Ideally, this packet should include a business card with the hotline
number printed on it that employees can keep in a wallet or purse. New
employees should receive this information as part of their orientation.
Finally, the purpose of the hotline program should be mentioned in periodic "refresher" communications.
If reminder messages are not included in the initial launch plan, the
program will lose steam.
Although ethics can be a sensitive topic, an experienced hotline provider
will be able to assist in developing effective messages and vehicles
for launching the hotline and can develop a plan an appropriate plan
based on the unique needs of the organization.
How are audit committee members notified about allegations?
To ensure that allegations regarding top executives reach the board,
rather than being intercepted and covered up, hotline incident reports
should be automatically routed to one or multiple audit committee members.
A report dissemination routine should be set up with the hotline administrator
so that the audit committee receives reports of financial irregularities.
Many companies are electing to simultaneously send such reports to a
member of the audit committee and to an internal employee, such as an
internal auditor or an ethics officer, who works with the audit committee
to manage the investigation.
What is the best way to track the "treatment" of complaints?
An effective tool to implement this Sarbanes-Oxley requirement includes
a database that enables an organization to document complaints that are
received and then add information regarding the actions the company took
to investigate the allegation. This database should record the final
disposition of the investigation and the nature of any disciplinary or
other corrective action taken as a result of the complaint. Should the
company be sued, this documentation can be very helpful in a court of
law. This is another area in which a qualified third-party hotline provider
will be able to assist the organization by providing an established system
for documenting its activities.
Hotlines have been used to detect theft and fraud for many years. In
the past 10 years, since the passage of the federal sentencing guideline,
use has expanded from the retail industry to other sectors and has helped
companies discover and manage a variety of unethical or illegal activities.
With the Sarbanes-Oxley Act, lawmakers have acknowledged the value of
this communications mechanism, giving internal audit a powerful tool
for detecting fraud.
Tony Malone, ARM, CPCU, is chief executive officer of The Network,
Inc., who consults on ethics, safety and service quality issues.
Ralph Childs, ACFE, is chairman and founder of The Network, Inc., and
a former FBI special agent.
|
