What are the best practices for an internal reporting system? The FCPA 2020 Resource Guide stated: âAn effective compliance program should include a mechanism for an organization’s employees and others to report suspected or actual misconduct or violations of company policies in a confidential manner. and without fear of retaliation.
The 2020 update further refined this basic hotline requirement with surveys of the effectiveness of your corporate hotline, by asking: “Effectiveness of the notification mechanism – Does the company have an anonymous reporting mechanism and, if not, why not? How is the reporting mechanism made public to company employees and other third parties? Has it been used? Does the company take steps to verify that employees are familiar with the hotline and feel comfortable using it? How did the company assess the seriousness of the allegations it received? Did the compliance function have full access to reporting and investigation information? Some key points to consider are:
The hotline must be developed and maintained externally. It seems obvious that employees tend to trust third-party hotlines more than in-house managed systems. Submission of reports via an external hotline is seen as an additional layer of anonymity and impartiality compared to a system developed in-house. A third-party vendor is also more likely to bring hard-to-match specialist expertise within the organization.
The hotline supports the collection of detailed information. As with almost everything, information is power. If a CCO can gather and record information throughout the lifecycle of a complaint, the business will have a better understanding of the situation and can more effectively protect itself against accusations of negligence or wrongdoing. A hotline reporting system should provide consolidated, real-time access to data from all departments and locations, as well as analytical capabilities that allow you to uncover trends and hot spots. All reported documents should be consolidated into a complete file and organized in chronological order, so that a CCO can monitor ongoing progress and make better and more informed decisions.
The hotline must comply with your company’s data retention policies. It is important to maintain data in a manner consistent with your internal data retention policies. A hotline should provide a secure and accessible report retention database, or you may need to make arrangements to transmit and store old reports in a permanent storage location.
The hotline should be designed to instill confidence in employees. Retaliation or a perception of unfairness towards those who file complaints on the hotline will destroy the effectiveness of the internal reporting process and poison the corporate culture. A hotline should be viewed as offering the highest levels of protection and anonymity. To encourage employee participation, the hotline should allow them to raise concerns directly to someone outside their immediate chain of command or work environment, especially when the complaint involves an immediate supervisor. The hotline is also expected to allow employees to submit a report from the privacy of an offsite computer or phone. It might seem like a small convenience, but giving employees the freedom to file a complaint from a safe location can make a huge difference in turnout rates.
Hotline provides on-demand support from subject matter experts. Opening lines of communication can bring new challenges to your compliance group. It is therefore important that once these reports enter the system, some person or function has the responsibility of ensuring timely follow-up. One of the biggest mistakes you can make is sitting down on a hotline complaint and letting the employee reporting it fester. Plus, with the tight deadlines set in Dodd-Frank Whistleblower’s resolution times before an employee can go to the SEC to claim a bonus, the clock literally clicks.
The hotline provides integrated assistance and dispute avoidance tools. A business should ensure that its hotline is preconfigured to meet legal requirements for document retention, attorney work doctrine, and attorney-client privileges. Developing these tools in-house can dramatically increase your costs and maintain a hotline without exposing your organization to unacceptable risks.
The hotline supports direct communication. A hotline should open up the lines of communication and give you a direct view of the heart of your business. Look for a system that allows you to connect directly, privately and anonymously with the person making a complaint. Direct communication also signals employees that their complaints are heard at the highest level.
Like other risk management issues, hotlines must also be managed effectively after implementation and deployment. Here are some practical tips that will help you make your hotline an efficient and useful tool.
Spread the word. If employees don’t know about the hotline, they won’t use it. Allocate some of your time and budget to promoting the corporate hotline through multiple channels. Put up posters and hand out cards that employees can keep in their wallets or desk drawers. Make presentations in person whenever possible. And don’t think of the promotional initiative as a one-time effort. It is important to remind employees regularly, through 360-degree communications, that this resource is available to them. Some helplines offer promotional material to make the job easier; be sure to ask what type of promotional support may be available.
Train all your employees. Getting employees to use the system is half the challenge; making sure they’re using it correctly is the other half. This is where training becomes essential. Make sure people understand which types of activities or observations are appropriate for the report and which are not. Human resources and compliance staff will need training to help them understand the impact of the hotline on their day-to-day operations. Business leaders should also understand the role the hotline plays in organizational culture and the importance of their visible support for this compliance initiative.
Take a look at the data. Use data derived from or through the hotline to identify trends or unexpected issues. For example, what percentage of employees use the hotline and what issues do they bring up? A healthy hotline reporting system will produce reports from 0.5 to 2 percent of your employee base. If your reporting patterns are higher or lower, it may indicate distrust of the hotline, misuse, or a widespread compliance issue. Isolate data by location and department to identify micro-trends that could indicate issues in a subset of your corporate culture. Analyzing data can help you stay ahead of emerging issues.
The answer is essential to the fairness of the system. Seeing a hotline system in action in this way can go a long way in allaying employees’ fears of being ostracized or experiencing retaliation, because if they see that their concerns are heard clearly and treated fairly, they will learn to view the hotline. as a valuable channel. If your compliance group responds quickly and appropriately to hotline complaints, you can ensure strong participation and continued success. Even when a complaint turns out to be unfounded, it can still be an opportunity to open a dialogue with employees and clear up misunderstandings. Responding to reported issues also gives compliance officers a chance to prove that issues can be resolved or addressed while protecting the privacy and anonymity of the whistleblower.