Blowing the whistle

The term ‘whistle-blower’ often comes with a stigma attached, as words like ‘snitch’ and ‘big brother’ can get thrown around. But the idea of providing employees with a mechanism to safely air their concerns is catching on – and not just because the law requires companies to do so. There’s a need for people to have a place to turn in the instance that an open-door policy isn’t working, or when there’s even a concern it isn’t working.

The challenge, from a company perspective, is to build the system in a way that encourages employees to participate and assures them that, by using a hotline, something will actually be achieved.

When Sarbanes-Oxley was passed in 2002, it carried along with it Section 301, which mandates the establishment of whistle-blower hotlines. Alongside this is a lesser-known but equally important rule: Section 806, which defines how companies should respond and prohibits retaliation against whistle-blowers.

‘As the world changed following corporate scandals such as Enron and Adelphia and the passing of Sox, there was a need to have this compliance-driven whistle-blower and ethics reporting process,’ explains Ron Paquette, managing partner of Clearview Partners.

‘This business [of ethics hotlines] grew significantly as a result of Sox, stemming from legislation in the form of something referred to as good corporate governance,’ says Dennis Muse, CEO of Global Compliance Services. ‘We have seen a significant shift over the course of the past several years with people and organizations moving from rule-based decision making to more culture- and values-based systems.’

Keith Halasy, director of marketing for Ethics Point, agrees, suggesting that many companies are deploying hotlines across a number of business areas where risk is present – instead of just focusing on fraud or Sox issues. ‘People are now looking at these systems differently than they have in the past,’ he says. ‘It is less about compliance, even though that is still a very critical aspect. It is much more about what we can actually derive from this sort of system, the types of things that help us mitigate risk to get us in front of any critical issues that could impact the public.’

Whether companies use the system strictly for reasons of compliance or invite employees to report other organizational issues, communication is key to the success of any of these programs. Information being reported by employees ranges from compliance and internal control issues to harassment and other problems within the work environment.

Internal vs. external systems

With all listed companies required to have whistle-blower hotlines, there’s a great deal of discussion regarding the most effective way to implement them. The two options are to build and operate a system in-house or to outsource the process to one of the many firms specializing in the field. Both have advantages and disadvantages.

Muse estimates that 30 percent of Fortune 100 companies and 25 to 30 percent of Fortune 1,000 companies conduct their hotlines entirely in-house. The reasons most commonly cited are control, cost and security.

‘With in-sourcing, one of the pros is that your own people are receiving 100 percent of the contact from your own people, and typically there seems to be some comfort there from the standpoint of being able to garner some more information or get the individual placing the call to flip from being anonymous to being non-anonymous,’ Muse explains. People using hotlines take anonymity importantly and may not call if they feel pressured to identify themselves. ‘It will not take long for the rumor mill or grapevine within an organization to spread that they will try to get you to identify yourself,’ Muse notes.

Internal solutions are often viewed as being less expensive, but this may not always be the case, especially considering the personnel time that is involved. Internal systems can have other disadvantages as well. One is the question of independence. The people operating the hotline are employees of the company and may report to the person who is the target of a complaint. ‘If employees realize it is an internal mechanism, they may not be as willing to report items, and there is a chance it may not even qualify under Sox because it may not be anonymous,’ says Dave Nolte, a principal at Fulcrum Inquiry.

‘There really is this tremendous fear about being identified, because I think we’ve all read about this poor whistle-blower whose life explodes on them as the result of thinking they’ve done the right thing,’ says Paquette.

Operators of hotlines find that callers are far less likely to leave a message if they are unable to speak directly with a person and are forced to use voicemail. For this reason, a company has to operate a line 24/7, 365 if it’s going to be effective, especially if it’s for a multinational organization with multiple locations around the globe. The issue then arises of whether it is possible to man a facility of this magnitude internally. Is a company going to staff their facility around the clock or just during business hours?

Psychological effect

For these reasons, many companies consider outsourcing to be a better solution. ‘It goes back to security. If something is built in-house, you really have to trust the people who built it,’ Muse explains. ‘Most individuals, regardless of the country they grew up in, have a fair amount of angst about picking up that phone and making that call or going to the keyboard and creating a workplace alert via the web, and the reason for that is a culture of not ratting. We have to face some facts that there is some psychology at play here, and people have some concerns and internal battles that they are fighting.’

Psychology seems to be a factor when it comes to the highest rate of calls on a given day, as well. Nolte and his team have discovered an interesting anomaly – it seems there is a higher instance of additional reports on the third Monday in January, officially the most depressing day of the year.

Companies that choose to outsource this responsibility need to make sure that the people answering the calls are doing a good job. Many hotline companies are answering their calls with receptionist-type people who are not really trained in accounting and internal control matters. The information intake, therefore, is done through scripts that control the conversation, and as a result you might miss some important information, Nolte explains.

A couple of years ago, many companies were setting up their hotlines in-house. That is changing drastically. ‘We are seeing a number of organizations that chose to do in-source early on to meet compliance requirements and later discovered, if it is not your core competency, you should not be doing it. Anyone building an internal system is going to be a bit more myopic,’ says Halasy.

Indeed, there has to be a level of consistency in the way these reports are handled. There is an issue of independence when considering that any reports being made are going right back into the organization. There also needs to be a sense that this is not a management tool, but rather an independent tool.

Assigning ownership

Though there is no single way that companies are organizing their hotlines, one important factor is who has responsibility for monitoring and processing. For example, giving HR ownership is controversial and depends on what level of independence that function has within an organization. ‘An HR manager might report to the CFO, who may report to the CEO, who may be implicated in a report,’ explains Paquette.

The responsibility of managing the hotlines is starting to reside primarily with the chief internal auditor, corporate secretary, chief compliance officer and/or chief ethics officer. ‘The adoption of this ethics compliance role is verification that the focus on ethics is not just a fad or a knee-jerk reaction,’ Halasy says. ‘Organizations are really taking this to heart and putting into place high-level personnel with a specific focus on ethics and compliance.’

As with many governance issues, the ethics effort needs to be supported strongly very high in the organization. ‘It starts with the tone at the top,’ says Paquette. ‘Do you really want employees to report things that they see that aren’t right? It is a simple thing to say it, but a different thing to believe and to do.’

Depending on the business model, some companies also have call centers that will take the calls and filter them to the chief compliance officer, who will determine whether to investigate.

‘Regardless of who is responsible, the best practice is to make sure they follow up and the people who leave messages have the ability to have a two-way dialogue if they want,’ says Bradley Smith, director of marketing and communications at Shareholder.com. ‘Once they leave a message, the whistle-blower is given a code number, and they can go back to the system with that code. It is important to act on calls received or the employees will feel they are emailing into the wind.’

Paquette agrees, and although he concedes that companies can’t manage expectations properly by promising to report back exactly how the information was used, there needs to be a feedback loop back into the organization on a regular basis, whether quarterly or otherwise.

Having a system in place to deal with complaints is vital. Obviously, not every complaint can be investigated, and it is important to have a system that allows for some preliminary back-and-forth to determine whether an investigation is necessary. Indeed, a full-scale investigation can cost tens of thousands of dollars.

It is not just listed companies that are implementing ethics hotlines. In fact, many nonprofit and private companies are realizing the benefits of allowing anonymous employee concerns to be aired. The concept is beginning to evolve from a compliance requirement to a more important business operation. It is likely that a greater focus will be placed on whistle-blowing as companies look to leverage compliance requirements into efficiency gains.