Go to CIOLEADERS homepage

Creation, Implementation and Administration of a Hotline

By Thomas R. Fox

Added 28 November 2012

A look at the seven essential features to create an effective hotline

Creation, Implementation and Administration of a Hotline
By: Thomas Fox
Leader: A look at the seven essential features to create an effective hotline
For the Astros, it is not this seasons ignominious record of 107 losses, which they achieved with a season ending loss to the Chicago Cubs, but the magic number of 186; which is the number of days until the Astros open the 2013 season and the next time they will be tied for first place in the American League (AL) West Division.
For the compliance practitioner, the same might be asked of your companys hotline. However apocryphal the story might be it is too good to pass up so here we go: When, in final negotiations with a company to resolve a Foreign Corrupt Practices Act (FCPA) violation, the Department of Justice (DOJ) attorney asked for the phone number of the companys hotline. Counsel representing the company dutifully provided the number and the DOJ attorney called the hotline only to find it was not a working number. Oops.
I thought about the above story in the context of the maxim that not all hotlines are created, or more importantly, administered equally. In an article entitled Hotline Report Reveals Compliance Concerns author Karen Kroll looked at the 2012 Corporate Governance and Compliance Hotline Benchmarking Report and found what she termed troubling findings, which are that not only are instances of fraud increasing but that retaliation against whistleblowers is increasing as well. Kroll noted that despite greater protection for whistleblowers in the Dodd-Frank Act, calls concerning potential retaliation against an employee who has made an inquiry through a hotline increased to 2.9 percent of overall incidents, up from just 2.1 percent in 2010. But as bad as these figures are they seem to only presage Krolls penultimate conclusion, which is that internal reporting will slowly wither away with the protections offered by whistleblowers under the Dodd-Frank Act and the attendant bounties that can be paid to a whistleblower in the event a violation is uncovered and an enforcement action results in a fine or penalty paid to the US government.
I recently saw a White Paper by Business Controls, Inc., released through Compliance Week, where an un-named author posited that there are seven essential features to create an effective hotline. I found this article to be useful in that it provided information by which a compliance practitioner could quickly review how his or her company might set up a hotline. The seven criteria are as follows.
1. The hotline is developed and maintained externally. The author believes that employees tend to trust hotlines maintained by third parties more than they do internally maintained systems. By submitting reports through an external hotline there is a perceived extra layer of anonymity and impartiality compared to a system developed in-house. A third party provider is also more likely to bring specialist expertise thats difficult to match within the organization.
2. The hotline supports the collection of detailed information. If information can be gathered and recorded at every point during the complaint life cycle, then compliance officers should have greater insight into the situation and a company can protect itself more effectively from accusations of negligence or wrongdoing. A hotline reporting system should provide consolidated, real-time access to data across all departments and locations, plus analytic capabilities that allow you to uncover trends and hot spots. All report materials should be consolidated in one comprehensive, chronologically organized file, so that you can monitor ongoing progress and make better, more informed decisions.
3. The hotline meets your companys data retention policies. Retaining data in a manner consistent with your internal data retention policies is important. Make sure your hotline offers a secure, accessible report retention database, or you may be faced with making your own complicated and costly arrangements for transmitting and storing older reports to a permanent storage location.
4. The hotline is designed to inspire employee confidence. Krolls article discussed above cites the fear of retaliation as strong but also increasing among potential whistleblowers. This can destroy the effectiveness of the internal reporting process and poison the corporate culture. The hotline must be seen to offer the highest levels of protection and anonymity. To encourage employee participation, the hotline should allow them to bring their concerns directly to someone outside their immediate chain of command or workplace environment especially when the complaint concerns an immediate superior. The hotline should also enable employees to submit a report from the privacy of an off-site computer or telephone. It may seem like a small convenience, but giving employees the freedom to enter a complaint from a location that feels safe can make a huge difference to participation rates.
5. The hotline offers on-demand support from subject matter experts. Opening lines of communication can bring new issues to your compliance group. It is therefore important that once those reports are entered into the system, a person or function has the responsibility to follow up in a timely manner.
6. The hotline provides inbuilt litigation support and avoidance tools. Ascertain that your hotline is preconfigured to meet the legal requirements for document retention, attorney work product protection procedures, and attorney privilege. Developing these tools in-house can add significantly to your costs, and maintaining a hotline without one exposes your organization to unacceptable risk.
7. The hotline supports direct communication. A hotline should open the lines of communication and give you a direct sight-line into the heart of your company. Look for a system that enables you to connect directly, privately, and anonymously with the person filing a complaint. Direct communication also signals to employees that their complaints are being heard at the highest levels.
Like other risk management issues, hotlines must also be managed effectively after implementation and roll-out. Here are some practical tips which will help you make your hotline an effective and useful tool.
Get the word out. If employees dont know about the hotline, they wont use it. Allocate a portion of your time and budget to promoting the corporate hotline through multiple channels. Put up posters and distribute cards that employees can keep in their wallets or desk drawers. Deliver in-person presentations where possible. And dont think of the promotional initiative as a one-time effort. Its important to remind employees regularly, through in-person communications, via e-mail, or through intranets, newsletters, and so on, that this resource is available to them. Some hotlines offer promotional materials to help make the job easier; make sure you ask what type of promotional support may be available.
Train all your employees. Getting employees to use the system is one half of the challenge; ensuring they use it properly is the other half. This is where training becomes essential. Make sure people understand what types of activities or observations are appropriate for reporting and which are not. HR and compliance staff will need training too, to help them understand how the hotline impacts their day-to-day activities. Company leaders also need to understand the role the hotline plays in the organizational culture, and the importance of their visible support for this compliance initiative.
Take a look at the data. Use the data derived from or through the hotline to identify unexpected trends or issues. Examples might be what percentage of employees use the hotline and what issues are they submitting? A healthy hotline reporting system will yield reports from .5 to 2 percent of your employee base. If your reporting patterns are higher or lower, it may indicate mistrust of the hotline, misuse, or a widespread compliance issue. Isolate the data by location and department to identify micro-trends that could indicate problems within a subset of your corporate culture. Analyzing the data can help you stay a step ahead of emerging issues.
Response is critical to fairness in the system. Seeing a hotline system in action in this way can go a long way toward dispelling employee fears of being ostracized or experiencing retaliation because if see that their concerns are heard clearly and addressed fairly, they will learn to view the hotline as a valuable conduit. If your compliance group responds promptly and appropriately to hotline complaints, you can ensure robust participation and ongoing success. Even when a complaint proves to be unfounded, it can still provide an opportunity to open a dialogue with employees and clear up any misunderstandings. Responding to reported issues also gives compliance officers a chance to prove that issues can be resolved or addressed while protecting the privacy and anonymity of the whistleblower.
As with the management of third party representatives, your real work begins are the contract is signed. You simply cannot set up a hotline without managing it. A fairly administered hotline and investigation protocol is a key component of fair process in your compliance regime. So take a look at your hotline based upon the above concepts. It may be that your magic number needs to change.

For the Astros, it is not this seasons ignominious record of 107 losses, which they achieved with a season ending loss to the Chicago Cubs, but the magic number of 186; which is the number of days until the Astros open the 2013 season and the next time they will be tied for first place in the American League (AL) West Division.

For the compliance practitioner, the same might be asked of your companys hotline. However apocryphal the story might be it is too good to pass up so here we go: When, in final negotiations with a company to resolve a Foreign Corrupt Practices Act (FCPA) violation, the Department of Justice (DOJ) attorney asked for the phone number of the companys hotline. Counsel representing the company dutifully provided the number and the DOJ attorney called the hotline only to find it was not a working number. Oops.

I thought about the above story in the context of the maxim that not all hotlines are created, or more importantly, administered equally. In an article entitled Hotline Report Reveals Compliance Concerns author Karen Kroll looked at the 2012 Corporate Governance and Compliance Hotline Benchmarking Report and found what she termed troubling findings, which are that not only are instances of fraud increasing but that retaliation against whistleblowers is increasing as well. Kroll noted that despite greater protection for whistleblowers in the Dodd-Frank Act, calls concerning potential retaliation against an employee who has made an inquiry through a hotline increased to 2.9 percent of overall incidents, up from just 2.1 percent in 2010. But as bad as these figures are they seem to only presage Krolls penultimate conclusion, which is that internal reporting will slowly wither away with the protections offered by whistleblowers under the Dodd-Frank Act and the attendant bounties that can be paid to a whistleblower in the event a violation is uncovered and an enforcement action results in a fine or penalty paid to the US government.

I recently saw a White Paper by Business Controls, Inc., released through Compliance Week, where an un-named author posited that there are seven essential features to create an effective hotline. I found this article to be useful in that it provided information by which a compliance practitioner could quickly review how his or her company might set up a hotline. The seven criteria are as follows.

1. The hotline is developed and maintained externally. The author believes that employees tend to trust hotlines maintained by third parties more than they do internally maintained systems. By submitting reports through an external hotline there is a perceived extra layer of anonymity and impartiality compared to a system developed in-house. A third party provider is also more likely to bring specialist expertise thats difficult to match within the organization.

2. The hotline supports the collection of detailed information. If information can be gathered and recorded at every point during the complaint life cycle, then compliance officers should have greater insight into the situation and a company can protect itself more effectively from accusations of negligence or wrongdoing. A hotline reporting system should provide consolidated, real-time access to data across all departments and locations, plus analytic capabilities that allow you to uncover trends and hot spots. All report materials should be consolidated in one comprehensive, chronologically organized file, so that you can monitor ongoing progress and make better, more informed decisions.

3. The hotline meets your companys data retention policies. Retaining data in a manner consistent with your internal data retention policies is important. Make sure your hotline offers a secure, accessible report retention database, or you may be faced with making your own complicated and costly arrangements for transmitting and storing older reports to a permanent storage location.

4. The hotline is designed to inspire employee confidence. Krolls article discussed above cites the fear of retaliation as strong but also increasing among potential whistleblowers. This can destroy the effectiveness of the internal reporting process and poison the corporate culture. The hotline must be seen to offer the highest levels of protection and anonymity. To encourage employee participation, the hotline should allow them to bring their concerns directly to someone outside their immediate chain of command or workplace environment especially when the complaint concerns an immediate superior. The hotline should also enable employees to submit a report from the privacy of an off-site computer or telephone. It may seem like a small convenience, but giving employees the freedom to enter a complaint from a location that feels safe can make a huge difference to participation rates.

5. The hotline offers on-demand support from subject matter experts. Opening lines of communication can bring new issues to your compliance group. It is therefore important that once those reports are entered into the system, a person or function has the responsibility to follow up in a timely manner.

6. The hotline provides inbuilt litigation support and avoidance tools. Ascertain that your hotline is preconfigured to meet the legal requirements for document retention, attorney work product protection procedures, and attorney privilege. Developing these tools in-house can add significantly to your costs, and maintaining a hotline without one exposes your organization to unacceptable risk.

7. The hotline supports direct communication. A hotline should open the lines of communication and give you a direct sight-line into the heart of your company. Look for a system that enables you to connect directly, privately, and anonymously with the person filing a complaint. Direct communication also signals to employees that their complaints are being heard at the highest levels.

Like other risk management issues, hotlines must also be managed effectively after implementation and roll-out. Here are some practical tips which will help you make your hotline an effective and useful tool.

Get the word out. If employees dont know about the hotline, they wont use it. Allocate a portion of your time and budget to promoting the corporate hotline through multiple channels. Put up posters and distribute cards that employees can keep in their wallets or desk drawers. Deliver in-person presentations where possible. And dont think of the promotional initiative as a one-time effort. Its important to remind employees regularly, through in-person communications, via e-mail, or through intranets, newsletters, and so on, that this resource is available to them. Some hotlines offer promotional materials to help make the job easier; make sure you ask what type of promotional support may be available.

Train all your employees. Getting employees to use the system is one half of the challenge; ensuring they use it properly is the other half. This is where training becomes essential. Make sure people understand what types of activities or observations are appropriate for reporting and which are not. HR and compliance staff will need training too, to help them understand how the hotline impacts their day-to-day activities. Company leaders also need to understand the role the hotline plays in the organizational culture, and the importance of their visible support for this compliance initiative.

Take a look at the data. Use the data derived from or through the hotline to identify unexpected trends or issues. Examples might be what percentage of employees use the hotline and what issues are they submitting? A healthy hotline reporting system will yield reports from .5 to 2 percent of your employee base. If your reporting patterns are higher or lower, it may indicate mistrust of the hotline, misuse, or a widespread compliance issue. Isolate the data by location and department to identify micro-trends that could indicate problems within a subset of your corporate culture. Analyzing the data can help you stay a step ahead of emerging issues.

Response is critical to fairness in the system. Seeing a hotline system in action in this way can go a long way toward dispelling employee fears of being ostracized or experiencing retaliation because if see that their concerns are heard clearly and addressed fairly, they will learn to view the hotline as a valuable conduit. If your compliance group responds promptly and appropriately to hotline complaints, you can ensure robust participation and ongoing success. Even when a complaint proves to be unfounded, it can still provide an opportunity to open a dialogue with employees and clear up any misunderstandings. Responding to reported issues also gives compliance officers a chance to prove that issues can be resolved or addressed while protecting the privacy and anonymity of the whistleblower.

As with the management of third party representatives, your real work begins are the contract is signed. You simply cannot set up a hotline without managing it. A fairly administered hotline and investigation protocol is a key component of fair process in your compliance regime. So take a look at your hotline based upon the above concepts. It may be that your magic number needs to change.

comments powered by Disqus
Reducing Data Center Energy Usage

Reducing Data Center Energy Usage

ManageEngine adds power management to DCIM portfolio with new plug-in based...

The New Hybrid Cloud

The New Hybrid Cloud

Rackspace offers its latest hybrid cloud solution RackConnect v3

Benefits for CIOs from Windows 10

Benefits for CIOs from Windows 10

Check out the benefits of Windows 10

related Whitepapers

OPINION POLL

Dear CIO/CISO, can you define an Advanced Evasion Technique (AET)?

no-image

CURRENT ISSUE

September 2014

CIO&Leader September Issue