Assess your processes with an investigation maturity model

It’s easy to get stuck in a routine when conducting compliance investigations. But continuous improvement protects the employees involved and makes the investigative processes easier and more efficient for investigators. 

How do you know where to start? Use an investigation maturity model. This tool helps investigative teams determine their program’s strengths and areas of risk or weakness. 

According to Meric Bloch, principal at Winter Investigations, a compliance investigation program’s maturity is determined by eight main characteristics: 

• Defined procedural steps 

• Efficiency 

• Documentation 

• Automation 

• Effectiveness 

• Standardization 

• Consistent data metrics 

• Program analysis^[1]

Based on these, your program could fall into one of five levels of maturity: initial, managed, standardized, predictable, or optimized. Each stage comes with its own risks and steps to improve. Maturity reflects a function’s expected performance. The more significant the maturity, the more you can turn events or mistakes into teachable moments that lead to improvements. 

Once you’ve determined your program’s maturity level, your team should make an action plan for addressing your weaknesses so you can protect both employees and your organization through more effective investigations.

Uncover areas of risk with a risk assessment

Risk assessments cost time and money. So why should you bother? The benefits of a risk assessment far outweigh any inconvenience because they can help you avoid incidents, fines, lawsuits, and negative media attention.

Benefits of conducting a risk assessment include:

• Money saved: Picking up the pieces after a cyberattack, break-in, fire, or act of workplace violence is stressful and can cost thousands of dollars; a risk assessment costs far less. 

• Fewer lawsuits: By preventing incidents, you won’t have to deal with injured or disgruntled employees seeking legal action. 

• Lower risk of noncompliance: Eliminate risks above and beyond compliance requirements to avoid penalties from regulatory bodies. 

• Positive organizational reputation: Customers and clients want to do business with companies that operate safely, ethically, and fairly. 

• Fewer incidents: Learning where to focus your training and internal controls can reduce the number of ethics and compliance issues in your organization.

To assess your company’s risks, follow these steps. First, define the scope of your risk assessment. Then, identify hazards and calculate their likelihood (unlikely, seldom, occasional, likely, definite) and consequence level (insignificant, marginal, moderate, critical, catastrophic). Next, assign a risk rating (low, medium, high, extreme) to each hazard based on the likelihood and consequences. Finally, create an action plan to address each hazard and plug the data into the risk matrix to visualize the risks.

Catch issues early with a whistleblower hotline

If your organization doesn’t have a whistleblower hotline, now is the time to implement one. According to the 2024 ACFE Report to the Nations, 43% of fraud cases are detected by a tip, and 48% of reports were corruption cases, making hotlines the strongest method for discovering workplace issues.^[2]

Compliance and ethics lapses could lead to fines and penalties for your company if they aren’t dealt with in a timely fashion. You can catch these issues early with an internal hotline and even prevent them. If you receive many reports of employees not following safety requirements, for example, you should update your training in that area. Or, if a manager has a history of discrimination, enroll them in a sensitivity course.

Once you’ve implemented your reporting mechanisms and trained employees how to use them, how do you know they’re effective? Here are four main questions to ask:

1. How many reports are you receiving? While the volume will vary depending on your organization’s size and industry, the number should be neither very high nor extremely low. Too many reports could mean you have a high level of unethical behavior or employees are overreporting. Too few could indicate a fear of retaliation for reporting or a hard-to-use hotline.

2. What is the quality of the reports? Poor-quality reports mean the hotline isn’t providing insight that can help protect your employees and organization. Review past investigations that stemmed from hotline tips. How many of the reports were substantiated? If many reports came to a dead end or turned out to be false, employees aren’t using the hotline as intended or were not properly trained upon implementation.

3. How are you using the information you receive? Not using the data you receive on your ethics hotline wastes time, money, and resources. Collecting misconduct complaints and not acting on them shows employees that you are just going through the motions and could even land you in legal trouble. Do you run reports to spot areas of risk in your organization? This step helps you catch ethics and compliance violations faster while also identifying the areas where you should focus your preventive efforts.

4. How does your company culture complement the hotline? Boost the commitment to ethics companywide, and your hotline should naturally work better. You can implement measures to ensure your culture remains strong. For example, require all employees to attend yearly training sessions and/or reward whistleblowers who report real misconduct, with recognition or praise in the company newsletter. Additionally, advertise the hotline widely and make it easy to report violations by offering multiple reporting avenues.

Manage investigations efficiently with case management software

An ethics or compliance breach is an opportunity to conduct a strong, comprehensive investigation, act accordingly, and move forward with lessons learned. It is also ideal to evaluate and assess your current policies, processes, and procedures to prevent future ethics issues. However, without the right tools, you can’t do any of these things effectively.

Case management software makes investigating, managing, and preventing incidents easier. Home-grown or dated case management solutions have many shortcomings. For instance, managing your investigations using manual methods is inefficient, often leading to duplication of effort and information silos. These solutions also open your organization up to security breaches and inconsistent documentation, which could lead to fines and lawsuits, and further mistrust in the system by employees.

Purpose-built case management software can improve your department’s investigative processes in three ways. First, using a case management system improves consistency within and across departments. Consistency builds trust between employees and your organization. When employees know what to expect after submitting a report and a timeline of events, they’ll feel safer and more confident raising issues. Standardized case management also helps build accountability and defensibility should you be audited or asked to provide evidence of your processes by legal or regulatory bodies.

Next, the business intelligence tools included with a case management platform help you spot case trends so you can address areas of risk before they escalate. You can use your data to determine how well your processes work based on investigation results, resolution time, and more. This analysis then allows you to make data-driven business decisions.

Finally, case management software improves the efficiency of your investigations. By storing all case information in one centralized location, you can close cases faster, make investigators’ jobs easier, maintain a single source of truth, and keep case data secure. When you don’t have to search for documents or evidence, you need to work on the case; you’ll resolve incidents faster, reducing risk.

Improve consistency with an investigation report template

After you and your team have worked hard to gather evidence, interview subjects, and reach a conclusion for the investigation, you need to summarize everything and share it with stakeholders in a final investigation report.

Pulling together all that case information and putting it into an easy-to-read format takes a lot of time and effort. It’s one of the most tedious parts of an investigation, as well as one of the easiest to botch.

This is especially true for compliance professionals. No one has the mental capacity to remember the reporting requirements for every regulatory body and case type; however, using the wrong formatting or forgetting important information can result in fines and other negative consequences. That’s where an investigation report template can come in handy.

When you use a template to write your final investigation reports, you’ll never forget a key piece of information or section, whether it’s required by law or just helpful to the reader. You’ll save time by not having to build a report from scratch. Finally, your entire team, department, or organization will have consistent reports, reducing your risk of lawsuits (for handling cases inconsistently) or noncompliance penalties and making it easier to reference old instances.

Conclusion

Ethics and compliance investigations should be thorough, efficient, and thoughtful, as their conclusions impact many people’s lives. An ineffective investigation (or failing to conduct one at all) puts employees and your organization at risk. When you use the tools outlined in this article, you’ll ensure your investigations (and corporate culture) are efficient and effective from start to finish.

Takeaways

• Utilize an investigations maturity model to help your team assess current needs and areas for improvement. Systematic assessment is the most efficient method for effectively overhauling compliance procedures.

• Conduct risk assessments regularly. Preemptively addressing potential threats will help keep all risks under wraps. The cost of risk assessments will always be lower than missing the signs of a breach.

• Implement ethics reporting tools and complementary case management software to streamline investigations and keep them efficient, secure, and more effective.

• Use investigative data to drive company decisions. As you gather data from comprehensive employee reports, use it to drive decision-making around training, human resource management, and anything related to employee wellness. Patterns in data give you insight into changes that need to be made.

• Standardize reporting with templates to ensure legal compliance and reduce penalty risk and potential errors.