How to get the most out of your confidential hotline

8 minute read

Organizations are expected to have investigative capabilities, yet the majority do not. In fact, the U.S. Department of Justice (DOJ) and the Securities and Exchange Commission (SEC) consider confidential reporting and internal investigation to be among the most critical hallmarks of an effective compliance program. A very important initial step toward meeting the government’s compliance program expectations is starting a hotline. There is a lot more to this hallmark than retaining a software provider and deploying their platform.

In its publication Evaluation of Corporate Compliance Programs, the DOJ builds on its prior guidance to emphasize the importance of an “efficient and trusted mechanism by which employees can anonymously or confidentially report allegations . . .”[1]

Consistent with other DOJ-published guidance, it is written from the perspective of how prosecutors should go about assessing the compliance programs of defendant companies.

For example, it states: “Prosecutors should assess whether the company’s complaint-handling process includes proactive measures to create a workplace atmosphere without fear of retaliation, appropriate processes for the submission of complaints, and processes to protect whistleblowers. Prosecutors should also assess the company’s processes for handling investigations of such complaints, including the routing of complaints to proper personnel, timely completion of thorough investigations, and appropriate follow-up and discipline.”

The Evaluation of Corporate Compliance Programs document poses many questions about hotlines and investigative processes, including:

  • “Does the company have an anonymous reporting mechanism and, if not, why not?”

    • Implementing one or more anonymous reporting mechanisms usually becomes an obvious choice. It has either been pointed out to the organization that they are of a size, complexity, and geographic diversity that it would be appropriate to implement them, or one or more significant matters went unreported because there was no obvious reporting channel. If the organization has decided against implementing reporting mechanisms, it is essential to document the thought process underlying that decision and for the company to be prepared to defend that position.

  • “How is the reporting mechanism publicized to the company’s employees and other third parties? Has it been used?”

    • Having a hotline that no one knows about and is never used raises many concerns about the effectiveness of other key elements of the compliance program, including training and communications, program oversight and governance, commitment by senior and middle management, investigation of misconduct, and the overarching question: “Does the Corporation’s Compliance Program Work in Practice?”

  • “Does the company take measures to test whether employees are aware of the hotline and feel comfortable using it?”

    • Retaliation is very real and is often the number one reason people don’t speak up. Gauging employee and manager awareness of confidential reporting channels and their comfort level using them can be an excellent watermark of the state of the company’s ethical culture; it can focus leadership on the extent to which culture must be improved.

  • “How has the company assessed the seriousness of the allegations it received? Has the compliance function had full access to reporting and investigative information?”

    • While these questions are meant to assist prosecutors in evaluating compliance programs, compliance personnel would be well-advised to use them to critique themselves and the state of their program. Once you have a hotline in place, heightened obligations and expectations attach. One way to test the overall effectiveness of the confidential reporting channels and investigative processes is for internal audit to regularly assess the process from end to end and pose some of the same questions raised in the DOJ’s guidance.

This document is only available to members. Please log in or become a member.
 


Would you like to read this entire article?

If you already subscribe to this publication, just log in. If not, let us send you an email with a link that will allow you to read the entire article for free. Just complete the following form.

* required field