The URL can be used to link to this page

RPVCCA_CC_SR_2014_06_03_03B_Anonymous_Fraud_Waste_and_Abuse_HotlineCITY OF RANCHO PALOS VERDES MEMORANDUM TO: FROM: DATE: SUBJECT: REVIEWED: HONORABLE MAYOR & CITY COUNCIL MEMBERS DENNIS McLEAN, DIRECTOR OF FINANCE & ~ INFORMATION TECHNOLOGY ~ JUNE 3, 2014 ANONYMOUS FRAUD, WASTE AND ABUSE HOTLINE CAROLYNN PETRU, ACTING CITY MANAGE ~ RECOMMENDATION 1) Receive and file the Memorandum, entitled "Rancho Palos Verdes -Whistleblower Hotline Analysis" written by Mark Meyerhoff of Liebert, Cassidy, Whitmore; 2) Provide Staff with the City Council's policy decisions regarding the establishment of an Anonymous Fraud, Waste and Abuse Hotline ("Hotline"); 3) Direct the City Council Audit Subcommittee to provide oversight for the establishment of a Hotline; 4) Direct Staff to prepare a Request for Qualifications (RFQ) from interested independent 3rd party hotline service providers for review by the City Council Audit Subcommittee; 5) Direct Staff and the Audit Subcommittee to review proposals received and make a recommendation to the City Council for approval of a professional services agreement for hotline administration services; 6) Direct Staff to prepare an RFQ from interested independent 3rd party experts to provide investigative services in connection with hotline reports received for review by the City Council Audit Subcommittee; and 7) Direct Staff and the Audit Subcommittee to review proposals received and make a recommendation to the City Council for approval of a professional services agreement investigative services in connection with hotline reports. EXECUTIVE SUMMARY The proposed establishment of an Anonymous Fraud, Waste and Abuse Hotline would include the following: 3B-1 ANONYMOUS FRAUD, WASTE AND ABUSE HOTLINE June 3, 2014 Page 2 of 10 • Direction by the Audit Subcommittee to provide oversight ensuring Hotline reports are investigated without bias; • Ethics and hotline reporting policies approved by the City Council; • Effective public and employee outreach during (and after) the implementation of the hotline; • Retaining an independent 3rd party hotline administrator to receive reports via a 24171365 phone bank and website; • Ensuring the hotline administrator processes hotline reports (either anonymously, or if not, at the election of the person making the report) via a confidential, secure database; • Ensuring all hotline reports are reviewed to determine whether or not an investigation is warranted, and if so, the level of importance and which other parties (e.g. law enforcement or other government agencies, the Audit Subcommittee, independent auditors, independent 3rd party experts, the City Manager, HR Manager and other supervisors); • Ensure that confidentiality is maintained through the course of the investigation ; • Completion of the investigation and an accompanying confidential report; • A reliable, effective reporting process; and • Oversight of the hotline by the Audit Subcommittee, as well as the City Council, and independent auditor to ensure that internal accounting controls are effective. Following are the essential policy decisions to be determined by the City Council regarding the establishment of an Anonymous Fraud, Waste and Abuse Hotline. The issues are further explained in greater detail, along with background and recommendations made by Mark Meyerhoff of Liebert Cassidy Whitmore ("LCW") in the attached Memorandum, and cited below: 1) Type of Hotline? (1) Hotline for reporting exclusively "financial" fraud, waste & abuse; or/and (2) Hotline to report personnel and human resources-related issues (e.g., discrimination, harassment, retaliation, employee misconduct, etc.)? 2) Who will operate the hotline? (1) Internally operated by City Staff; or (2) Independent 3rd part hotline service provider? 3) Scope of the hotline? Limited to reports for financial fraud, waste and abuse hotline reports? Inclusive of any hotline report of fraud, waste and abuse, including personnel and human resources-related hotline reports? 4) Who will audit [review] reports to the hotline? 1) Internal review of hotline reports, either by management staff, the City Attorney or special labor counsel, or the Audit Subcommittee of the City Council (not an industry-accepted Best Practice); or (2) a hybrid process, whereby the initial review of certain reports is conducted by independent 3rd party experts (e.g. CPAs , legal counsel with Human Resources or forensic expertise) with the City Attorney; and the initial review of reports is conducted by the City Manager or HR Manager with involvement of the City Attorney? The City Attorney would receive a copy of every hotline report to ensure dual dissemination without any bias. 3B-2 ANONYMOUS FRAUD, WASTE AND ABUSE HOTLINE June 3, 2014 Page 3 of 10 5) Who will investigate complaints? Should the formal investigation be handled by the independent auditor, a CPA or licensed investigator? Should personnel/human resources hotline reports be administrated internally by the Human Resources Manager in accordance with existing personnel and administrative policies or, for more significant investigations, by an independent, licensed investigator? 6) What should the City Council's involvement be with the hotline, if any? Should the Audit Subcommittee's responsibility be to ensure that procedures exist for the receipt, retention and treatment of hotline reports regarding fraud, waste and abuse [Best Practice], and working closely with the independent auditor to review hotline reports regarding financial irregularities in accordance with the AICPA's Authoritative Guidance? Should the Audit Subcommittee conduct or participate in the review and/or investigative process of hotline reports? [not recommended by LCW and not Best Practice] It has been documented that the establishment of hotlines in other agencies has enhanced the sense of openness and has saved money through the anonymous reporting process; however, it has also been noted that an effective, positive community and employee educational process is important to the success of the hotline. BACKGROUND AND DISCUSSION In 2012, Mayor Duhovic requested that a staff report be prepared for the City Council to consider the establishment of fraud, waste and abuse hotline. Separately, Staff presented the City's reply to the Los Angeles Civil Grand Jury report at the September 9, 2013 City Council meeting , as well as a several recommendations, including the implementation of a fraud, waste, and abuse hotline, administered by an independent third party consultant. The City Council approved the recommendations presented to the City Council, including the establishment of a hotline. Most large urban California cities have established hotlines under the day-to-day management of the internal auditor who works for the City Manager and who also reports to the Audit Subcommittee and the independent auditor. Because the City, like most "contract cities", does not have an internal auditor, prudent care must be exercised in the design and implementation of a hotline to ensure transparency, confidentiality of information, anonymity for the complainant making a hotline report, dual dissemination of hotline reports so that all reports are fully investigated without bias, protection of employee personnel rights and corrective action, when necessary. Few contract cities similar in size and scope to Rancho Palos Verdes have established anonymous fraud, waste and abuse hotlines using 3rd party providers. Based upon inquiries, staff learned that several cities have merely established voice mail boxes or referred callers to the State's whistleblower hotline. Brief Overview -Purpose of a Fraud, Waste and Abuse Hotline The City of Rancho Palos Verdes is committed to protecting its revenue, property, information and other assets. If adopted, a policy would set out specific guidelines and 3B-3 ANONYMOUS FRAUD, WASTE AND ABUSE HOTLINE June 3, 2014 Page 4 of 10 responsibilities regarding appropriate actions that must be followed for the Investigation of reports concerning fraud, waste and abuse. If approved by the City Council, the City would retain an Anonymous Fraud, Waste & Abuse hotline service provider (the "Hotline Administrator") to facilitate the receipt of fraud, waste and abuse hotline reports by telephone, and a hosted website that enables on-line submission of reports confidentially, either anonymously or not -at the discretion of the reporter. The Hotline Administrator shall provide hotline services, including, but not limited to, telephone call center services staffed 24/7 /365 by competent, trained personnel. The provider shall immediately forward hotline reports to the designated hotline report reviewers, and shall provide a secure database for all reports submitted, as well as status and analytical reports to be used by case managers, City management, elected officials and the public, as appropriate. Based upon the above background, Mark Meyerhoff of LCW, the City's special employment counsel, has prepared a Memorandum (attached), entitled "Rancho Palos Verdes -Whistleblower Hotline Analysis" for consideration by the City Council. Mr. Meyerhoff offered six (6) topics for policy decisions to be made by the City Council. A summary of LCW's and Staff's comments and recommendations follow. Six Topics for City Council Policy Decisions from the Memorandum "Rancho Palos Verdes -Whistleblower Hotline Analysis" by Liebert Cassidy Whitmore 1) -What type of Hotline should be used? (1) Hotline for reporting "financial" fraud, waste & abuse; or/and (2) Hotline to report personnel and human resources-related issues (e.g., discrimination, harassment, retaliation, employee misconduct, etc.)? LCW's Memorandums states : "Fraud, waste and abuse" is defined by the statute as follows: any activity by a local agency or employee that is undertaken in the performance of the employee's official duties , including activities deemed to be outside the scope of his or her employment, that is in violation of any local, state, or federal law or regulation relating to corruption , malfeasance , bribery, theft of government property, fraudulent claims, fraud, coercion , conversion , malicious prosecution, misuse of government property , or willful omission to perform duty, is economically wasteful, or involves gross misconduct." Gov. Code§ 53087.6, subd. (f)(2). Staff Recommendation : Staff believes that the hotline should include both categories (1) and (2) cited in LCW's Memorandum: fraud, waste and abuse (not limited to financial incidents) and personnel and human resources-related issues . If the Council directs Staff to draft a hotline policy for approval by the Council, Staff believes that the statutory definition should be included as the policy definition for both financial and personnel and human resources hotline reports. 3B-4 ANONYMOUS FRAUD, WASTE AND ABUSE HOTLINE June 3, 2014 Page 5 of 10 The Government Finance Officers Association ("GFOA") appears to supports the recommendation to open the hotline broadly to both fraud, waste and abuse, and personnel and human resources hotline reports as cited below from the attached GFOA Best Practice publication titled "Encouraging and Facilitating the Reporting of Fraud and Questionable Accounting and Auditing Practices (2007) (CAAFR)": "Since ensuring or enhancing confidentiality can significantly increase costs, consider minimizing those costs by providing a separate reporting mechanism for employees, who typically desire greater assurance of confidentiality than do outside parties. In this regard, a government may wish to explore the possibility of engaging the services of an outside vendor to receive complaints from employees. The use of an outside vendor offers a number of potential advantages, including the following: o Employees may be more readily persuaded of the confidentiality of their calls if they are made directly to a party outside the government. o Vendors may be able to provide extended hours of service, thus avoiding the need to place a call during regular working hours (i.e., while the employee is still at work)." 2) Who will operate the hotline? (1) Internally operated by City staff; or (2) independent 3rd party service provider? Staff Recommendation : Staff concurs with LCW's recommendation that the hotline should be administrated by an independent 3rd party provider with 24/7/365 service, trained staff, and a secure database that offers a flexible configuration to include several layers of access rights to update and view, maintain an audit trail of each access to it, and provide status and case completion reports satisfactory for review by the Audit Subcommittee and public viewing. 3) What should be the scope of the hotline? (i.e. What sorts of complaints are appropriate for submission on the hotline, how particular terms are defined, etc.)? Staff Recommendation : Staff agrees with LCW and believes that the hotline should receive all fraud, waste and abuse (not limited to financial incidents) and personnel and human resources-related reports. However, it will be necessary and important to inform residents, vendors and employees that certain complaints, observations, and problems should continue to be reported to the City or public utilities in the ordinary course of public service (e.g. power outages that should be reported to SCE, request for graffiti removal, and tree limb removal in the right of way). Additionally, the GFOA Best Practice publication titled "Encouraging and Facilitating the Reporting of Fraud and Questionable Accounting and Auditing Practices (2007) (CAAFR)" cites the following: "A government should regularly publicize the availability of these mechanisms and encourage individuals who may have relevant information to provide it to 3B-5 ANONYMOUS FRAUD, WASTE AND ABUSE HOTLINE June 3, 2014 Page 6 of 10 the government." Staff also recommends the inclusion of a broad spectrum of hotline report incident categories. For context, The Network, one of the leading providers of hotline administration services, offers 24 "incident codes" as reporting categories. LCW's Memorandum refers to 24 incident codes ("categories") that were established by the City of Sacramento with the implementation of its hotline utilizing the services of The Network. Staff recommends that a broad spectrum of reporting categories be set up by the City if it establishes a fraud, waste and abuse hotline. 4) Who will audit [review] the reports to the hotline? (1) Internal review of hotline reports, either by management staff, the City Attorney, or the Audit Subcommittee of the City Council (not an industry-accepted Best Practice); or (2) a hybrid process, whereby the initial review of certain reports is conducted by independent 3rd party experts (e.g. CPAs, legal counsel with Human Resources or forensic expertise) with the City Attorney; and the initial review of reports is conducted by the City Manager or HR Manager with involvement of the City Attorney? LCW's Memorandum states : "If the City determines that it does not want to audit hotline complaints internally, the City may contract with an independent auditor or CPA to audit complaints to the hotline. This independent auditor could then interface with the City Manager and/or legal counsel for the City. The benefits to utilizing an outside auditor are the greater perception of independence and fairness, and lessened chance of bias or conflict. By utilizing legal counsel to interface with the auditor, it also maintains the attorney- client privilege which will generally protect communications from disclosure." LCW's Memorandum also states : "The Human Resources Manager is the individual most suited and qualified to audit/evaluate complaints to the personnel/human resources hotline to determine whether the complaint warrants further investigation. The Human Resources Manager could then retain an outside investigator, either directly or through the City Attorney or outside counsel, for particularly sensitive, complex or time consuming investigations." Staff Recommendation : Since the City does not have an internal auditor, Staff agrees with LCW's recommendation to establish a hybrid pre-determined procedure for the review of hotline reports, including, but limited to, the following : a) Initial review of certain, more-serious hotline reports about an employee are conducted by independent 3rd party experts (e.g. CPAs, legal counsel with HR or forensic expertise) collectively with the City Attorney; b) Initial review of certain hotline reports (e.g. employee is repeatedly late to arrive for work, an employee treats a member of the public extremely rudely at a public counter at City Hall) are conducted by the City Manager or HR Manager collectively 3B-6 ANONYMOUS FRAUD, WASTE AND ABUSE HOTLINE June 3, 2014 Page 7of10 with involvement of the City's labor counsel; c) Initial review of a hotline report about an elected official would be reviewed by independent 3rd party legal counsel with HR expertise; d) Initial review of a hotline report of accounting irregularities would be forwarded immediately to a pre-designated, independent 3rd party CPA with expertise in municipal accounting . Such a hotline report would also be forwarded to the City's independent auditors and Audit Subcommittee for review. The 3rd party CPA expert, independent auditor, Audit Subcommittee, City Attorney and the City Manager would collectively determine appropriate next steps, including the possibility of notification to other governmental agencies; and e) The City Attorney shall be copied with every hotline report to ensure its review and appropriate action. f) If a hotline report is about observations and problems that are normally reported to public utilities or the Public Works Department as maintenance service requests (e.g. power outages that should be reported to SCE or a request for graffiti removal), the Hotline Administrator will need pre-determined instructions to share with a complainant to redirect their attempted hotline report . 5) Who will investigate complaints? LCW's Memorandum states : "For complaints to the fraud, waste and abuse hotline, depending on the type of complaint involved, the formal investigation could be handled by the independent auditor, a CPA or licensed investigator, with the City Manager's approval and legal counsel's guidance. For complaints to the personnel/human resources hotline, depending on the type of complaint involved, the investigation could be handled internally by the Human Resources Manager or, for more significant investigations, by an independent, licensed investigator." Staff recommendation : Staff generally agrees with these two recommendations. Staff also recommends that certain serious, pre-designated types of hotline reports should be investigated by an independent 3rd party CPA with expertise in municipal accounting. Such a hotline report would also be forwarded to the City's independent auditors and Audit Subcommittee for review. Hybrid procedures may require immediate investigation of a hotline report as follows: a) Upon completion of the initial review by the HR Manager, certain serious hotline reports shall immediately be directed to independent 3rd party experts (e.g. CPAs, legal counsel with HR or forensic expertise) collectively with the City Attorney ; and b) Upon completion of the initial review , certain hotline reports shall immediately be directed to other law enforcement and government agencies to protect public health and safety. 3B-7 ANONYMOUS FRAUD, WASTE AND ABUSE HOTLINE June 3, 2014 Page 8of10 6) What should the City Council's involvement be with the hotline, if any? LCW's Memorandum states: "Finally, with respect to the issue of whether City Council members, and particularly members of the Audit Subcommittee, should participate in the hotline, while it makes sense for Audit Subcommittee members to be involved in the initial establishing of the hotline(s), we do not recommend that the City Council or even the Audit Subcommittee become involved in the auditing or investigation of any individual reports to the hotline ." "As a general rule, we recommend that the City Council not involve itself in day-to- day personnel management matters. Such duties are better left to the City Manager and Human Resources personnel." "Although we strongly discourage City Council and/or Audit Subcommittee members from participating in the auditing of individual hotline reports, it would be perfectly acceptable and we, in fact, recommend that the Audit Subcommittee as well as the independent auditor, receive periodic (e.g., monthly or quarterly) reports of hotline usage and the resolution of hotline reports in order to assess the effectiveness of the hotline and to evaluate the ongoing need for the program. As long as Audit Subcommittee members are not participating in the auditing and/or investigation of individual reports, the Audit Subcommittee could also receive timely reports of any assertions of significant accounting wrongdoing to ensure that internal accounting controls are sufficient." Staff recommendation -Role of the Audit Subcommittee Following the objectives of the Sarbanes-Oxley Act, the Audit Subcommittee should be responsible for ensuring that procedures exist for the receipt, retention and treatment of hotline reports regarding fraud, waste and abuse. GFOA Best Practice publication titled "Encouraging and Facilitating the Reporting of Fraud and Questionable Accounting and Auditing Practices (2007) (CAAFR)" cites the following: "Have the audit Subcommittee, as part of its evaluation of the government's internal control framework; examine the documentation of how complaints were handled to satisfy itself that the mechanisms for reporting instances of potential fraud or abuse, and questionable accounting or auditing practices are in place and working satisfactorily." The City Council may wish for the Audit Subcommittee to review submission of qualifications and quotations provided by independent, 3rct party hotline service providers, expert investigators, and CPA's with municipal expertise that would be submitted to the City. Upon completion of reviews, the Audit Subcommittee would make a recommendation to the City Council with a draft professional services agreement. The Audit Subcommittee may wish to engage the City's current independent auditors in the review process, especially for the independent CPA that would perform investigations of accounting incident hotline reports. Staff strongly encourages the Audit Subcommittee to meet with 3B-8 ANONYMOUS FRAUD, WASTE AND ABUSE HOTLINE June 3, 2014 Page 9of10 the City's independent auditors regularly (semi-annually or more frequently if necessary) to rev iew the status of on-going hotline reports, investigations and actions taken, as needed. Independent 3rd Party Hotline Providers LCW's Memorandum cites the following : "The benefits of utilizing an established third party provider include 24/7 telephone coverage , experienced interviewers staffing the phones, already developed and tested web reporting , customization , impartiality and various case management and reporting tools." ... "The Best Practices document also notes that use of a professional, third party provider also ensures that there will be no bias involved in the decision to escalate time-sensitive issues. Another benefit of utilizing an external provider is that it may enhance the perception of confidentiality, possibly making members of the public and employees more comfortable utilizing the hotline to make anonymous reports ." Mayor Duhovic (in mid-2013) and Staff (in early 2014) made separate inquiries and obtained quotes for 24/7/365 telephone call center (&web-based) hotline services from The Network, a leader in the ethics hotline industry . In addition to discussions with The Network, Staff also contacted several other Hotline Administrators. Each of the hotline administrators provides essentially the same functions, namely: toll-free phone service in multiple languages, open service 24/7 /365, web intake solutions that are available for display on the City's web site. Varying levels of costs are associated with the services depending on the established framework of services. Of those companies contacted, only one provider does not actively participate in traditional Request for Qualification ("RFQ ") processes. Staff recommends development of a detailed RFQ, with the responses reviewed by both Staff and the Audit Subcommittee in advance of a recommendation to the City Council. Proposed City Council Policy -Anonymous Fraud, Waste and Abuse Hotline Subject to the City Council direction, Staff and the City's advisors would draft a proposed detailed City Council hotline policy. FISCAL IMPACT No funding has been included in the draft FY14-15 budget of the General Fund to pay for the proposed Anonymous Fraud, Waste and Abuse Hotline. Initial set-up costs range from $500 -$4,000. Ongoing (annual) costs range from $750-$12 , 100. In the instance of one company, its analytics component is an additional, separate cost. For illustrative purposes only, one company using an assumption of a 24-code system with 100 total calls I web reports I general inquiries annually and 10 user licenses for reporting analytics would cost approximately $17 ,000 per year. For discussion purposes only, staff offers an annual estimate of 40 hours x $250/hour, totaling $10,000. Based upon preliminary, rough estimates, it appears the on-going annual 3B-9 ANONYMOUS FRAUD, WASTE AND ABUSE HOTLINE June 3, 2014 Page 10of10 cost would be approximately $27,000 ($17,000 for Hotline Administration plus $10,000 for independent 3rd party experts). Based upon the draft FY14-15 budget, the General Fund is currently a "balanced budget", but just barely. The cost of the proposed hotline, as well as several other pending program ideas described in the FY14-15 Budget staff report tonight, would require off-setting budget reductions. Otherwise, the resulting budget deficit would violate City Council Policy No. 41 -Reserve Policies and General Fund Reserves. Attachments: • Memorandum, entitled "Rancho Palos Verdes -Whistleblower Hotline Analysis" written by Mark Meyerhoff of Liebert, Cassidy, Whitmore • GFOA Best Practice publication titled "Encouraging and Facilitating the Reporting of Fraud and Questionable Accounting and Auditing Practices (2007) (CAAFR)" • The Network publication titled "Best Practices in Ethics Hotlines" 3B-10 LIEBERT CASSIDY WHITMORE MEMORANDUM CONFIDENTIAL AND ATTORNEY-CLIENT PRIVILEGED DATE: April 29, 2014 CLIENT-MATTERNO.: RA025/001 TO: Dennis McLean; Sean Robinson FROM: Mark H. Meyerhoff; Alex Y. Wong RE: Rancho Palos Verdes -Whistleblower Hotline Analysis This memorandum addresses, step by step, the general analysis Ranchos Palos Verdes ("City") should conduct in order to determine whether and how to implement a "whistleblower hotline" for the purpose of allowing members of the public and City employees, to bring complaints regarding financial and/or personnel misconduct. Generally, the questions that the City should address prior to establishing a hotline are the following: (1) What type of hotline is to be established? (2) Who will operate the hotline? (3) What is the scope of the hotline? (4) Who audits the hotline and determines whether further investigation is warranted? (5) Who investigates complaints made to the hotline? (6) What involvement, if any, should the Council or Audit Committee have regarding the hotline? I. TYPE OF HOTLINE The first question to be addressed is what type of hotline is contemplated? Typically, whistleblower hotlines fall into two categories: (1) hotlines for the reporting of "financial" fraud, waste and/or abuse; and (2) hotlines to report personnel and human resources-related issues (e.g., discrimination, harassment, retaliation, employee misconduct, etc.). Government Code section 53087.6, enacted in 2009, expressly permits local auditors or controllers to create whistleblower hotlines with the approval of the legislative body for the purpose of identifying fraud, waste and abuse. "Fraud, waste and abuse" is defined by the statute as follows: any activity by a local agency or employee that is undertaken in the performance of the employee's official duties, including activities deemed to be outside the scope of his or her employment, that is in violation of any local, state, or federal law or regulation relating to corruption, malfeasance, bribery, theft of government property, fraudulent claims, fraud, coercion, conversion, malicious prosecution, misuse of government property, or willful omission to perform duty, is economically wasteful, or involves gross misconduct. Error! Unknown document property name. 3B-11 Re: Whistleblower Hotline April 29, 2014 Page2 Gov. Code§ 53087.6, subd. (f)(2). There are certain pros and cons of instituting a whistleblower hotline of any kind. The Association of Certified Fraud Examiners ("ACFE") produces on a biannual basis a Report to the Nations on Occupational Fraud and Abuse. The findings and recommendations in ACFE's reports have been cited by cities as justification for the creation and maintenance of fraud reporting hotlines (see, e.g., Sacramento and Oakland). In ACFE's most recent report, issued in 2012, it made the following findings: Survey participants estimated that the "typical organization" loses 5% of revenues to fraud each year. Occupational fraud is more likely to be detected by a tip from an employee than by any other method. For organizations with fraud reporting hotlines, 50.9% of fraud cases were detected through tips . For organizations without such hotlines, 34.6% of cases were detected through tips. Employees were the source of 50.9% of tips . The banking and financial services, government and public administration, and manufacturing sectors were the industries most commonly victimized by fraud. Fraud at government organizations accounted for 16.8% of cases, with the median loss for such government organizations at $81,000. The benefits to implementing a whistleblower hotline include: Enhanced potential to detect fraud , waste, abuse and other wrongdoing. By providing an anonymous and confidential mechanism for reporting, employees or residents who otherwise might not report issues due to fear of retaliation may be more willing to come forward with information disclosing wrongdoing. Potential for employee and community empowerment when reports of wrongdoing are followed up on and result in corrective action being taken. Appearance of improved accountability, particularly if the hotline is open to the public and if the City issues reports regarding the general nature and disposition of reports to the hotline. The mere existence of the hotline has the potential to reduce the incidence of fraud and waste through deterrence. Error! Unknown document property name. 3B-12 Re: Whistleblower Hotline April 29, 2014 Page 3 The downsides to having a whistleblower hotline include: The additional, though likely not substantial, cost of implementing and maintaining such a system. As noted in an assessment by the Sacramento City Auditor leading up to that city's implementation of a hotline, the cost of contracting with a third party service for running a 24-hour phone hotline and web intake and case management system may not be substantial (approximately $9,000, plus an initial set up charge). The true cost of the hotline will largely depend upon the number of calls/reports received on the hotline and the corresponding cost of independent professional services (e.g., CPAs, investigators and the City Attorney) necessary to sort through the complaints, identify those which are credible and warrant further investigation, and actually investigate complaints. Although it should generally be viewed as a positive that the public and/or employees are utilizing the hotline to provide leads on potential wrongdoing, many complaints may prove to be unfounded or frivolous. An increase in the number of frivolous complaints if complaints may be made anonymously and confidentially. All complaints must receive some level of follow up, even if only to determine that a full investigation is not necessary. Individuals are less likely to bring frivolous complaints if they cannot do so anonymously. Uncertainty regarding utilization. Absent a survey of employees, it will be difficult to forecast whether such a hotline would be embraced and utilized by employees to a degree that justifies its existence. Similarly, there is no way to know to what degree the public will utilize the hotline. On the other hand, there is also the possibility that the City might receive an overwhelming number of complaints and tips which could lead to significant delays in processing, reviewing and, if necessary, investigating. Potential for abuse (e.g., false or exaggerated claims by one employee against another, prank reports). Potential negative effects on employee morale caused by the perception that employees are unfairly being scrutinized. After weighing the pros and cons of establishing hotlines, the City may decide to establish a fraud, waste and abuse hotline, a personnel complaint hotline, or both types of hotlines. As set forth more fully below, establishing a hotline to address personnel complaints is not recommended. However, even ifthe City decides to implement both types ofhotlines, due to the different interests involved in each type of hotline, the manner in which each hotline functions need not-and should not-be the same. Error! Unknown document property name. 3B-13 Re: Whistleblower Hotline April 29, 2014 Page 4 II. WHO WILL OPERATE THE HOTLINE? Once the City determines the type (or types) of hotline that it wishes to establish, the next inquiry is who will operate the hotline itself. For operation of the hotline, the City may either operate its hotline internally or contract with an independent, third party provider that specializes in providing hotline services . The decision whether to operate the hotline internally or through use of a third party provider will likely depend on the type of hotline involved. A. Operation of a Fraud, Waste and Abuse Hotline 1. Internal Operation Should the City wish to operate a fraud, waste and abuse hotline internally, the City will need to do more than simply establish a telephone number and/or a website to receive complaints/reports. The City will also need to develop a detailed protocol for how complaints are to be initially processed, including determining who is privy to the information received. The City will also need to provide staffing, training and other resources necessary to efficiently and effectively receive and process complaints as they come in. We have assumed that the City intends to accept live calls to the hotline directly. This is preferable to simply passively monitoring a voicemail box because it allows for two-way communication and the opportunity to ask for additional, clarifying information and details that will assist in determining whether to commit additional City resources toward investigating complaints. That opportunity to obtain clarifying information is unavailable if someone leaves an anonymous voicemail without any callback information. Because it is unlikely that current City employees, outside of certain high level managers or directors, possess the requisite knowledge and familiarity with what constitutes fraud, waste and abuse, the individuals responsible for answering calls to the hotline will need to be trained on proper identification of fraud, waste and abuse. Such individuals will also need to be trained regarding interview practices in order to ensure that the City receives as much relevant information as possible. This is particularly important because the initial call to the hotline may be the only opportunity for the City to obtain information necessary to determine whether a formal investigation is warranted or even possible. Multiple individuals will also need to be trained to ensure there is always someone available to answer the hotline, even if one of the responsible individuals is sick or on vacation or even simply away from the telephone. Unless the City is willing to staff the hotline 24/7 then the City will have to accept the fact that many reports may end up being left on voicemail, increasing the likelihood that the City will receive reports with incomplete or insufficient information. Given that employees-particularly those that wish to remain anonymous-may be more likely to contact an internal hotline during non-work hours, it is possible that a high number of complaints/reports will end up being left on voicemail. This would be a disadvantage to operating a fraud, waste and abuse hotline internally. Error! Unknown document property name. 3B-14 Re: Whistleblower Hotline April 29, 2014 Page 5 Another downside to operating the hotline internally is that employees who wish to remain anonymous may be less willing to come forward if they know they will be speaking directly with a City employee due to concerns about confidentiality and/or their ability to remain anonymous. Importantly, information disclosed through the hotline, including the identity of the caller and the individuals identified by the caller, are to be held in confidence. Gov. Code § 53087.6, subd. ( c ). The identity of the reporting individual may not be disclosed without written permission of that person, unless the disclosure is to a law enforcement agency that is conducting a criminal investigation. Id., subd. (e)(l). Accordingly, the procedures for receiving complaints must be tightly controlled, and the City staff responsible for complaint intake must be absolutely trustworthy. This office does not recommend that the City operate a fraud, waste and abuse hotline internally by utilizing City staff to initially receive and process fraud complaints. As set forth above, there are several reasons to operate such a hotline externally as the training and dedication of personnel time necessary to operate an internal hotline would likely be beyond the capacity of current staffing levels. 2. Utilization of an Independent Third Party Hotline Provider The second and recommended option for operating the hotline would be to utilize an external, third party provider such as The Network, which is an independent provider of whistleblower hotline services (The Network provides hotline services for Sacramento and San Diego, for example). External hotline providers will provide call in numbers as well as a website where individuals can submit reports/complaints. The benefits of utilizing an established third party provider include 24/7 telephone coverage, experienced interviewers staffing the phones, already developed and tested web reporting, customization, impartiality and various case management and reporting tools. As noted in a "Best Practices in Ethics Hotlines" document prepared by The Network, interactive communication, such as a face-to-face conversations or a hotline interview, generates more detailed information than one-way communication, such as anonymous voice mails or reports made to a Web form. The Best Practices document also notes that use of a professional, third party provider also ensures that there will be no bias involved in the decision to escalate time-sensitive issues. Another benefit of utilizing an external provider is that it may enhance the perception of confidentiality, possibly making members of the public and employees more comfortable utilizing the hotline to make anonymous reports. The cost of utilizing a third party provider also does not appear to be prohibitively high when compared to the work and logistical problems involved in operating the hotline internally. According to an assessment conducted by the Sacramento City Auditor to determine whether a hotline would be a benefit to their city, the amount they were quoted by the third-party provider Error! Unknown document property name. 3B-15 Re: Whistleblower Hotline April 29, 2014 Page 6 (The Network) for running the 24-hour phone hotline, web intake and case management system was $9,120 per year with a $2,000 one-time system deployment charge. Accordingly, it is recommended that any fraud, abuse or waste hotline established by the City be operated externally. B. Operation of a Hotline for Reporting Personnel/Human Resources Issues Many of the above considerations apply in determining whether to operate a hotline for reporting personnel/human resources issues internally or via a third party provider. However, one significant difference which may tilt the analysis in favor of operating such a hotline internally, or not utilizing a hotline for receiving complaints for personnel/human resources at all, is that the Human Resources Manager is already trained and responsible for receiving and identifying personnel and human resources-related issues such as discrimination, harassment, retaliation, etc., and for maintaining confidentiality. Employees may already contact the Human Resources Manager to make such reports. For smaller agencies, such as the City, employees already have relatively easy access to managers or Human Resources to complain of personnel issues. Accordingly, the City's existing internal procedures for reporting complaints regarding personnel issues are likely sufficient and a hotline for personnel issues is probably unnecessary. Should the City determine that it would still like to create a hotline for personnel issues, the City could rather easily establish a voicemail box, and/or intranet page for employees who wish to maintain anonymity in reporting complaints. The Human Resources Manager could then be given exclusive access to information provided through the hotline in order to evaluate and investigate complaints, or to retain an outside investigator or counsel for such purpose. Alternatively, if the City already intends to utilize a third party hotline provider for a fraud, abuse and waste hotline, the City could very easily add reporting of personnel/human resources to the scope of the hotline services that the third party will provide. This office does not recommend establishing a separate personnel complaint hotline. In addition to the sufficient internal procedures for making personnel complaints that already exist, establishing such a hotline raises additional issues of staffing, training, confidentiality and the potential for abuse. III. SCOPE OF THE HOTLINE After the City determines who will operate the hotline(s), the City must then decide the scope of the hotline(s), i.e., what sort of complaints are appropriate for submission on the hotline, how particular terms are defined, etc . When utilizing a third party hotline provider, the City will be able to customize the "menu" of complaints that individuals may file. For example, Oakland, via the online reporting system Error! Unknown document property name. 3B-16 Re: Whistleblower Hotline April 29, 2014 Page 7 established by its third party provider, permits individuals to select from the following categories to describe their complaints: Accounting and Auditing Matters Confidentiality and Misappropriation Data Privacy Disclosure of Confidential Information Embezzlement Environmental Protection, Health or Safety Law Falsification of Contracts, Reports or Records Hiring Irregularities Improper Supplier or Contractor Activity Misconduct or Inappropriate Behavior Misuse of Assets or Services Theft Time Abuse Unauthorized/Fraudulent Use of Facilities and Equipment Unsafe Working Conditions Violation of Policy Other Sacramento's online complaint form lists the following categories of issues that may be reported: Accounting/ Audit Irregularities Conflicts of Interest Customer Relations Error! Unknown document property name. 3B-17 Re: Whistleblower Hotline April 29, 2014 Page 8 Discrimination Falsification of Company Records Fraud Fraudulent Insurance Claims Improper Controls Improper Loans to Executives Kickbacks Policy Issues Product Quality Concern Release of Proprietary Information Retaliation of Whistle blowers Safety Issues and Sanitation Sexual Harassment Substance Abuse Theft of Cash Theft of Goods/Services Theft of Time Unauthorized Discounts Wage/Hour Issues Waste and Abuse Workplace Violence/Threats San Jose, which appears to operate its hotline internally, created its hotline to provide the public and employees an opportunity to report concerns on topics including: Error! Unknown document property name. 3B-18 Re: Whistleblower Hotline April 29, 2014 Page 9 Theft of city resources such as cash, equipment, supplies or materials Record falsification, including timecards Misuse of city equipment or property Misuse or waste of city resources, including government funds Improper activities by City officials, employees and contractors As a practical matter, regardless of the particular type of hotline or scope of each hotline, the City should expect to receive complaints or reports that do not necessarily fall within any of the pre-defined categories for a particular hotline. Furthermore, if the City creates separate hotlines for fraud, waste and abuse issues and for personnel issues, or if the City foregoes one or the other type of hotline, the City should also expect to receive complaints made to the wrong hotline (i.e., complaints regarding personnel/human resources issues made to the fraud, waste and abuse hotline). The City will need to determine a protocol for transmitting erroneously filed/categorized complaints to the appropriate channel for appropriate consideration. If the City chooses to utilize a third party hotline provider, as recommended, the provider will be provided these protocols during implementation and will be responsible for re-directing hotline calls not within the scope of the hotline system. For example, if a member of the public attempts to file a hotline report about a topic not within the scope of the hotline, the provider's personnel might instruct the complainant how to make their report to the City. IV. WHO WILL AUDIT REPORTS TO THE HOTLINE? After determining the scope of the hotline, the next inquiry is who should have responsibility for auditing complaints to determine whether additional investigation is necessary. Auditing of complaints may be handled completely internally, but also could involve the assistance of outside auditors and/or counsel. A. Auditing Reports to the Fraud, Waste and Abuse Hotline Although the City may audit complaints to the fraud, waste and abuse hotline internally by utilizing existing staff, many of the same problems that occur if the City operates the hotline internally are present if the City audits the reports internally. Specifically, because the City does not have an existing internal auditor, 1 City staff or, more likely, management, tasked with auditing complaints must be trained to determine which reports warrant further attention and investigation. Because the intake and initial evaluation of complaints takes time, additional staff may be also necessary depending upon the number of complaints received. Internal auditing also leaves the potential for claims that the internal auditing mechanisms, or the City employees performing the See Section VI, below, for a discussion as to why we do not recommend that the Council or Audit Committee involve itself in the auditing or investigation process. Error! Unknown document property name. 3B-19 Re: Whistleblower Hotline April 29, 2014 Page 10 auditing, are biased. Finally, sufficient safeguards must be put in place to ensure that the audits are kept confidential. Investigative audits, like the identities ofwhistleblowers, must be kept confidential, except to issue any report of an investigation that has been substantiated, or to release any findings resulting from a completed investigation that are deemed necessary to serve the interests of the public. However, the identity of the individual who reported the activity and the subject employee or employees are to remain confidential. Gov. Code § 53087.6, subd. (e)(2). Substantiated audit reports that include the identities of the subject employees may, however, be provided to the appropriate appointing authority for disciplinary purposes. Id., subd. (e)(3). If the City determines that it does not want to audit hotline complaints internally, the City may contract with an independent auditor or CPA to audit complaints to the hotline. This independent auditor could then interface with the City Manager and/or legal counsel for the City. The benefits to utilizing an outside auditor are the greater perception of independence and fairness, and lessened chance of bias or conflict. By utilizing legal counsel to interface with the auditor, it also maintains the attorney-client privilege which will generally protect communications from disclosure. As discussed in The Network's Best Practices document: One of the most important aspects of dissemination is planning for checks and balances. Dual dissemination can be a helpful practice for ensuring that complaints are not overlooked or mishandled. A system of dual dissemination involves having an Ethics or Compliance Officer receives copies of all reports as a secondary layer of dissemination, beyond the report sent to the person responsible for investigation." If the City desires dual dissemination, the City Attorney and/or outside counsel could be provided all reports forwarded by the hotline provider. B. Auditing Reports to the Personnel/Human Resources Hotline The Human Resources Manager is the individual most suited and qualified to audit/evaluate complaints to the personnel/human resources hotline to determine whether the complaint warrants further investigation. The Human Resources Manager could then retain an outside investigator, either directly or through the City Attorney or outside counsel, for particularly sensitive, complex or time consuming investigations. V. WHO WILL INVESTIGATE COMPLAINTS? Error! Unknown document property name. 3B-20 Re: Whistleblower Hotline April 29, 2014 Page 11 The City next needs to determine who will investigate complaints to the hotline which the auditor determines warrant further investigation. For complaints to the fraud, waste and abuse hotline, depending on the type of complaint involved, the formal investigation could be handled by the independent auditor, a CPA or licensed investigator, with the City Manager's approval and legal counsel's guidance. For complaints to the personnel/human resources hotline, depending on the type of complaint involved, the investigation could be handled internally by the Human Resources Manager or, for more significant investigations, by an independent, licensed investigator. VI. WHAT SHOULD THE CITY COUNCIL'S INVOLVEMENT BE WITH THE HOTLINE, IF ANY? Finally, with respect to the issue of whether City Council members, and particularly members of the Audit Committee, should participate in the hotline, while it makes sense for Audit Committee members to be involved in the initial establishing of the hotline(s), we do not recommend that the City Council or even the Audit Committee become involved in the auditing or investigation of any individual reports to the hotline. As a general rule, we recommend that the City Council not involve itself in day-to-day personnel management matters. Such duties are better left to the City Manager and Human Resources personnel. Substantiated complaints to a hotline may result in disciplinary measures taken against City employees, whether the complaint relates to financial or personnel issues. Because of this, if Council members participate in the intake of hotline complaints or decisions whether to investigate complaints, they could potentially become witnesses in disciplinary cases or in litigation arising out of the complaints. This scenario may impair the ability of Councilmembers to participate in necessary closed session meetings to discuss issues arising from confidential complaints. In addition, depending upon the role of the Councilmember in a hotline system, inclusion of Councilmembers could significantly blur the roles between Council and staff and result in Councilmembers becoming involved in personnel recommendations or decisions. Such a role could cause employees and/or the public to believe that personnel decisions are being made for political reasons. Although we strongly discourage City Council and/or Audit Committee members from participating in the auditing of individual hotline reports, it would be perfectly acceptable and we, in fact, recommend that the Audit Committee as well as the independent auditor, receive periodic (e.g., monthly or quarterly) reports of hotline usage and the resolution of hotline reports in order to assess the effectiveness of the hotline and to evaluate the ongoing need for the program. As long as Audit Committee members are not participating in the auditing and/or investigation of individual reports, the Audit Committee could also receive timely reports of any assertions of significant accounting wrongdoing to ensure that internal accounting controls are sufficient. Error! Unknown document property name. 3B-21 Re: Whistleblower Hotline April 29, 2014 Page 12 VII. HOW IT WOULD WORK The following is an example of how the hotline would work if the City were to utilize a third party provider, with auditing responsibility delegated to an independent auditor with assistance from counsel: 1) A member of the public contacts the hotline with a complaint. 2) The operator interviews the complainant and takes down relevant information. 3) The hotline provider sends a report of the complaint along with all pertinent information to the City's independent auditor, with a copy to the City Attorney and/or outside counsel for dual dissemination. 4) The independent auditor, with the assistance of the City Manager and City Attorney (or outside counsel) shall evaluate whether there is sufficient information to warrant a further investigation and, if so, what type of investigation is required. 5) If further investigation is deemed appropriate, the City shall, through the City Attorney and City Manager, retain an outside investigator (either a CPA for accounting issues or private investigation firm for other issues). 6) The investigator will conduct its investigation and issue a report back to the City Manager and City Attorney or outside counsel. 7) If misconduct or other improprieties are found, the City Manager will then take any reasonable and necessary corrective action including imposing discipline upon any responsible employees. 8) If significant issues are found, or the report relates to matters within the jurisdiction of the City Council, the City Manager, investigator, City Attorney and/or outside attorney verbally reports back to the Audit Committee or Council with information on the report. 9) The City Council will reach some type of determination based upon the investigation findings with input from the City Manager, City Attorney and/or outside attorney. 10) The report and its resolution will be added to a monthly or quarterly hotline activity report that will be provided to the Audit Committee. Error! Unknown document property name. 3B-22 • BEST PRACTICE Encouraging and Facilitating the Reporting of Fraud and Questionable Accounting and Auditing Practices (2007) (CAAFR) Background. Statement on Auditing Standards (SAS) No. 112, Communicating Internal Control Related Matters Identified in an Audit, emphasizes the need for governments to have a financial reporting system in place that is sufficient to provide reasonable assurance that management can prepare financial statements in conformity with generally accepted accounting principles (GAAP). To meet that objective, a financial reporting system must be designed 10 detect not only material fraud or abuse, but also any questionable accounting or auditing practices that could jeopardize the integrity of financial reporting. SAS No. 112 instructs independent auditors that inadequate "anti-fraud programs and controls" constitute, at a minimum, a significant deficiency that would need to be reported. In most cases, potential instances of fraud or abuse and questionable accounting or auditing practices come to the attention of responsible parties thanks to employees or citizens who become aware of such practices. Governments can and should take practical steps to encourage and facilitate such reporting. Recommendation. The Government Finance Officers Association recommends that every government establish policies and procedures to encourage and facilitate the reporting of fraud or abuse and questionable accounting or auditing· practices. At a minimum, a government should do all of the following: • Formally approve, and widely distribute and publicize an ethics policy that can serve as a practical basis for identifying potential instances of fraud or abuse and questionable accounting or auditing practices. • Establish practical mechanisms (e.g., hot line) to permit the confidential, anonymous reporting of concerns about fraud or abuse and questionable accounting or auditing practices to the appropriate responsible parties.1 • A government should regularly publicize the availability of these mechanisms and encourage individuals who may have relevant information to provide it to the .government. • Since ensuring or enhancing confidentiality can significantly increase costs, consider minimizing those costs by providing a separate reporting mechanism for employees, who typically desire greater assurance of confidentiality than do outside parties. In this regard, a government may wish to explore the possibility of engaging the services of an outside vendor to receive complaints from employees. The use of an outside vendor offers a number of potential advantages, including the following: o Employees may be more readily persuaded of the confidentiality of their calls if they are made directly to a party outside the government. o Vendors may be able to provide extended hours of service, thus avoiding the need to place a call during regular working hours (i.e., while the employee is still at work). 1 While providing mechanisms to promote the reporting of fraud is an important element of an overall fraud prevention program there are other elements necessary for a complete program that are outside the scope of this recommended practice. 3B-23 \ • • Train those answering calls from the general public to recognize calls that are reporting fraud or abuse and direct them appropriately to ensure that reports of instances of fraud or abuse by outside parties receive the appropriate disposition even when they are not made through the mechanism established for that purpose. • Make internal auditors (or their equivalent) responsible for the mechanisms used to report instances of potential fraud or abuse and questionable accounting or auditing practices. Emphasize that they should take whatever steps are necessary to satisfy themselves that a given complaint is without merit before disposing of it. Further, they also should document the disposition of each complaint received so it can be reviewed by the audit committee. • Have the audit committee, as part of its evaluation of the government's internal control framework, examine the documentation of how complaints were handled to satisfy itself that the mechanisms for reporting instances of potential fraud or abuse, and questionable accounting or auditing practices are in place and working satisfactorily. Approved by the GFOA's Executive Board, October 19, 2007. ·"' 3B-24 3B-25 Table of Contents Abstract .............................................................. 2 Introduction .......................................................... 3 Step One: Planning a Successful Hotline Program ........................... 5 Getting started Give employees, suppliers and others options for coming forward Internal vs. External Receiving tips: telephone interview, message service or Web form? Should one hotline accept complaints about multiple issues? Who within the organization should "own" the hotline? Dissemination of information Escalation criteria Global operations Data security and retention Step Two: Communication -The Key to Hotline Effectiveness ................ 14 Objectives and strategies Key messages Delivery methods Launching the program A report could come from anywhere Global communications Keep the hotline "top-of-mind" Step Three: After the Call .............................................. 20 Report dissemination Ongoing communication with anonymous parties For public companies Investigation of allegations Tracking the "treatment" of complaints Management reports Benchmarking Conclusion .......................................................... 23 About the Authors .................................................... 24 1 --r 3B-26 Abstract Virtually all organizations are vulnerable to fraud and misconduct in the workplace. By establishing a proactive approach and engaging stakeholders to promote an ethical workplace an organization can significantly limit liability and loss. A successful strategic approach undertaken by many organizations is the implementation of an anonymous employee hotline. The Sarbanes-Oxley Act, enacted in 2002, requires publicly traded corporations to provide a mechanism for reporting financial irregularities that enables employees who report information to remain anonymous. The positive results realized from this requisite has prompted not-for-profits, private organizations and government agencies to adopt similar reporting mechanisms for detecting and deterring organizational malfeasance. The Sarbanes-Oxley Act has even spurred a global shift as different cultures around the world recognize the value of such a mechanism for reporting unethical activities in the workplace. The impact of fraud on U.S. businesses is costly to organizations, shareholders and consumers alike. According to the Association of Certified Fraud Examiners' (ACFE) 2008 Report to the Nation on Occupational Fraud & Abuse, it is estimated that U.S. organizations will lose 7 percent of their annual revenues to fraud. Based on 2008 figures, that translates to $994 billion in fraud losses. This paper discusses techniques for developing an effective ethics hotline program by examining three critical stages: planning prior to launch, communicating to stakeholders about the hotline and reacting to hotline tips. The most effective hotlines offer 24-hour, 365-day access to a skilled interviewer. For the best results, and to simplify communication, organizations should provide a single mechanism for reporting all workplace issues. Reports should be disseminated quickly to designated parties. The hotline should also be promoted with educational materials directed to everyone in the organization, including employees and vendors. This helps maximize usage and supports an ethical environment. Using a centralized reporting mechanism, information should be disseminated to the most appropriate parties, which likely includes Human Resources, the Audit Committee of the Board of Directors, Legal and Loss Prevention, among others. Dual dissemination of complaints related to fraud acts as a system of checks and balances by ensuring that no single person is in possession of this highly sensitive information. This protects the integrity of the reporting mechanism. The hotline program's case management system should provide a centralized database for documenting the steps taken by the organization to investigate allegations reported via the hotline. Once the data is available, an effective hotline program should provide management with a means for analyzing and managing the collected information. A robust reporting system offers managers the opportunity to not only view summary hotline information but also drill down to investigate specific details based on the user's unique needs. And it should be accessible, easy-to-use and -through both graphical and numerical interfaces -simple to interpret and analyze . Taking an analytical approach to hotline data allows an organization to measure trends, compare their results to norms for similar organizations, and identify areas for improvement. The results of a feature-rich reporting system should include the timely, consistent and practical delivery of reports to all stakeholders and provide the ability for an organization to make better business decisions. 3B-27 Introduction There is a strong tie between employees reporting misconduct in the workplace and a company's ethics programs. The 2007 National Business Ethics Survey conducted by the Ethics Resource Center (ERC), found that in companies with comprehensive ethics and compliance programs, only 29 percent of employees fail to report misconduct they observe, in contrast to 61 percent in companies with no formal ethics and compliance programs. Nevertheless, still less than 40 percent of employees state that their company has a comprehensive program in place. The same survey found that ethical misconduct is in general very high with 56 percent of employees witnessing ethical misconduct. The Federal Sentencing Guidelines for Organizations define a comprehensive ethics and compliance program as one that includes six components : • Written standards of ethical workplace conduct • Means for an employee to anonymously report violations of ethics standards • Orientation or training on ethical workplace conduct • A specific office, telephone line, e-mail address or Web site where employees can get advice about ethics-related issues • Evaluation of ethical conduct as part of regular performance appraisals • Discipline for employees who commit ethics violations One of the many requirements set forth by the Sarbanes-Oxley Act is providing a process for the anonymous reporting of accounting or audit irregularities. All organizations, whether public or private, benefit from fraud detection and deterrence by having such a mechanism in place. This legal requirement has proven extremely helpful to auditors, who reap the benefits of a reporting tool that has demonstrated its usefulness in detecting fraud. In its 2008 Report to the Nation, the ACFE found tips are the number one method for reporting fraud. In fact, the ACFE found that organizations with a hotline typically cut their fraud by 60 percent. Organizations without a hotline lost an average of $250,000 while those with a hotline lost $100,000. The ACFE also found that tips were the leading common detection method for uncovering million-dollar frauds, accounting for 42 percent of initial reports. 3 3B-28 4 Tip By Accident I: ·e ; Interna l Audit c ~ !. Inte rn al Contro ls ~ External Audit Notified by Po lice Initial Detection of Occupational Frauds •••••••··-25.4 r ] 19.4% ••••••••• 20.2% 19.2% - 3.8% 0% 10% 20% 30% 40% 50% Percent of Cases Source: Association of Certified Fraud Examine rs 2008 Report to the Nation 2008 .. 2006 A key element of the Sarbanes-Oxley Act is that it states that the Audit Committee of the Board of Directors is responsible for "establishing procedures for the receipt, retention and treatment of complaints ... regarding accounting, internal accounting contro ls or auditing matters." It goes on to specifically state that the reporting mechanism must enable employees to remain anonymous when making such a complaint. This is an important step toward protecting a whistleblower from possible retaliation. SARBANES·OXLEY, SECTION 301 STATES: Complaints. Each Audit Committe.e shall establish procedures for: A. The re<,:eipt., retention and treatment of complaints re.ceived by the issuer regarding accounting, internal accounting controls or auditing rnatt.ers; and B. The confidential anonymous submission by employees of the issuer of concerns regarding questionable accounting or auditing matters. 3B-29 Other key organizations have found the ACFE's statistics compelling. The American Institute of Certified Public Accountants (AIC PA), the organization that sets ethical standards for CPAs, published a tool for evaluating an anonymous hotline in 2005. The A/CPA recommended that all organizations establish a whistleblower hotline, ideally by using an external provider in order to enhance the perception of confidentiality. The A/CPA also encouraged using a trained interviewer via the telephone rather than a voice mailbox, maintaining a hotline 24 hours a day, 365 days a year and implementing alternative reporting methods such as Websites, e-mail addresses, fax and regular mail. The AICPA's full advice regarding improving the hotline effectiveness can be found at http://www.aicpa.org/ audcommctr/spotlight/jan_05_whistleblower.htm . As public corporations and other organizations review and revise their governance procedures, there are certain hotline best practices that are helpful in developing a hotline program to uncover fraud and other unethical and/or illegal activities. These best practices are illustrated by breaking down the anonymous reporting process into three steps: 1. Planning the Hotline Program 2. Communicating the Hotline 3. Reacting to Hotline Tips Step One: Planning a Successful Hotline Program GETTING STARTED At first blush, implementing a hotline may seem to be a simple endeavor, but planning an effective reporting process can be quite complex. It must adequately protect the confidentiality of anonymous callers while gathering information necessary to resolve complaints or allegations. A modern hotline program requires a plan for: • How information is to be received; • How information is to be distributed; and • How records of complaints and investigations are to be maintained Depending on the size and complexity of the organization, it's often best to appoint an executive project leader who champions the implementation process. In order to create a program that meets the needs of the entire organization, the project leader should embrace representatives from Legal, Finance/Audit, Human Resources, Risk Management/ Loss Prevention, Operations, the Board of Directors, Information Technology (IT) and Communications . A group representing all operational areas typically meets several times to discuss the plan and anticipate any enhancements that would make the program more valuable. For example, if the organization is large enough to anticipate a steady stream of reports, Human Resources or Loss Prevention may have an existing case management system. Hotline data can easily be fed into an existing system via an EDI data feed. While this is a simple matter for the IT department, having this conversation early ensures a smooth launch. _s ~ 3B-30 6 GIVE EMPLOYEES, SUPPLIERS AND OTHERS OPTIONS FOR COMING FORWARD The most effective way to learn about fraud is to provide employees, suppliers and other stakeholders with a variety of methods for reporting their concerns about illegal or unethical behavior. These intake methods include traditional telephone interviews, Web forms, e-mails, faxes and face-to-face meetings. Interactive communication, such as a face-to-face conversation or a hotline interview, generates more detailed information than a one-way communication, such as an anonymous voice mail or a Web form. While some individuals may feel comfortable coming forward through an open door policy, others may not and thus the importance of having multiple reporting options available . The hesitation some employees feel about revealing their identity may be due to fears about potential retaliation for reporting a peer or manager. In these situations, the hotline interview is the best option for the organization because an interview conducted by an experienced interviewer maintains anonymity yet results in the capture of the most actionable information poss ible. The ultimate goal is to give employees, suppliers and other stakeholders every possible means for coming forward, so they report information to top management or to the Board of Directors, rather than turning to the media . A hotline will most likely uncover additional sensit ive situations from employees than previous ly reported face-to-face, but it is far better to learn about these situations from a hotline than from a surprising telephone call to the CEO, or worse, from a headline. When a concern is reported internally, the organization can investigate and take corrective action, potentially avoiding the additional threat of devastating negative publicity. Ernst & Young conducted a survey of employees to understand their reporting preferences . Of those surveyed, 80 percent said they would be willing to report a co-worker's illegal or unethical activity, and 39 percent would be more likely to make a report if they could remain anonymous . The employees who were willing to report fraud stated the following preferences: • 57% chose a hotline as their preferred method for reporting fraud • 20% said they would prefer to write an anonymous letter • 16% said they would use an anonymous Website. Employees tend to prefer an anonymous telephone hotline because they have more confidence that they can remain anonymous . They often fear that electronic communication can be traced back to them. This fear can cause them to either not report their concern, or worse, report it to a source outside of the organization. It is interesting to note that not all hotline callers are anonymous. Approximately 46.5 percent of hotline callers give their names, and roughly one-third of hotline callers report they have previously informed management of the situation . These callers use the hotline as an additional mechanism for reporting issues they feel have not been handled adequately through face-to-face reporting . 3B-31 Factors influencing anonymity include the level of trust participants have that their information will remain confidential, the significance of the issue being reported and the confidence that the report will be acted upon. The type of incident also has an effect on anonymity as individuals reporting customer/competitor interaction and personnel management incidents are more likely to remain anonymous than those reporting incidents in corruption and fraud or company/professional code violations. INTERNAL VS. EXTERNAL Some organizations provide an internally managed hotline as an option for employees who are uncomfortable discussing issues face-to-face. Reports to the hotline are frequently routed to an employee somewhere in the organization, generally in Human Resources, Legal or the Ethics office. An internal program may seem attractive, but there are some serious drawbacks. For instance, if employees realize they are calling an internal number, they may be afraid their identity will be traced and decide not to submit the report. There are also operational issues, such as the potential for inconsistent handling of sensitive calls and callers encountering voicemail. An internal hotline also leaves the organization vulnerable to charges of covering up issues involving management. In comparison, an external process provides greater safeguards of anonymity and avoids even the appearance of impropriety. An external hotline is also typically more attractive to use from home or another location outside the office as there is less fear of detection. It is also important to evaluate what happens on the back end of the hotline. Will adequate case management or reporting be available with an internal hotline? An external hotline may have a set of sound processes in place for managing information that comes from the hotline. Making the decision early on about whether the hotline will be administered internally or externally is important because it will influence many aspects of the program. For example, the dissemination process may require greater planning for an internal hotline while an external provider will typically have a set of escalation channels and those associated processes pre-defined. While there are costs associated with an external hotline, the financial investment is small compared to the potentially disastrous financial repercussions associated with malfeasance that goes undiscovered. With the expertise, trained personnel, resources and technology already established to operate a hotline and conduct quality assurance, a professional hotline provider can usually provide these services for much less than it costs to implement them internally. 3B-32 RECEIVING TIPS: TELEPHONE INTERVIEW, MESSAGE SERVICE OR WEB FORM? The most effective method for any communication is a two-way conversation in which every unclear or incomplete statement can be clarified. The Federal Bureau of Investigation (FBI) recognizes a hierarchy for communications during an investigation, with face-to-face communication best, followed by telephone interview, followed by written communication. The FBI emphasizes the importance of live interaction over written communication because of its ability to detect and question nuances like the inflections of the voice or the presence of other voices in the background coaching the caller. A skilled interviewer will also be able to notice red flags indicating a potentially bogus report, such as an inability to answer logical questions or an avoidance of certain questions. This is best illustrated through the example of e-mail. Most people have received an e-mail message that was ambiguous, resulting in a desire to ask the author a clarifying question. This is an inherent risk of written communication over live communication. In the case of an e-mail, the recipient can either reply to the e-mail or can often call the sender to pursue the clarifying information. Unfortunate ly, when communication is received from an anonymous source such as by means of a Web form or voicemail, the recipient cannot simply reply with a new question. Advances in technology have not altered the fact that a skilled interviewer will ask questions and clarify information to a degree that is not feasible through other i ntake channels. The most effective hotlines are staffed 24 hours a day, 365 days a year. Around-the-clock coverage is vital, since nearly SO percent of hotline calls happen outside of regular business hours, and each call deserves the full attention of an experienced interviewer. Typically, employees don't call from the workplace and won't leave a message, so it's important to have someone standing by 24/7 who knows the right questions to ask in order to gather all crit ical information and then, importantly, follow escalation guidel ines. The need for human interaction is especially critical when dealing with an anonymous caller, because there may never be another chance to document his/her complaint. An anonymous caller is typically in an emotionally charged state and may feel threatened . If he or she even leaves a message, it tends to be incomplete and disorganized, omitting details that would help the organization investigate the allegation . Gathering information via a suggestion-box style approach (e-mail, voice mailbox, Web form, etc.) does not make the most of a unique opportunity to learn from a concerned caller. A professionally trained interviewer asks questions that help the organization gain enough information to successfully investigate. Legally, this is a very important point because receiving a tip constitutes notice of an issue . The organization may be exposed to greater liability if it is found to be aware of an issue without taking action to investigate and correct it. It is important to understand that the organization will continue to receive anonymous information through a var iety of channels outs ide of the hotline program, including voice messages, letters and faxes. Information received through any channel should be funneled to the same people who receive hotline reports. Ideally, this information should be ma intained in the same case management system w ith hotline reports to provide insight into all issues reported, regardless of the source . 3B-33 SHOULD ONE HOTLINE ACCEPT COMPLAINTS ABOUT MULTIPLE ISSUES? Employees, suppliers, consumers and other stakeholders are more likely to use a hotline to report an issue that makes them uncomfortable. If complaints regarding discrimination and se xual harassment, both high-liability issues, are turned away because the hotline is "for Sarbanes-Oxley Complaints Only," this may alienate the employee, who has made the difficult decision to take action. It is better to learn about any high-l iability issue as early as possible, so that damage control can begin and potential legal action can be averted . Therefore, having a general ethics hotline in place gives the organization an opportunity to limit their liability regarding offenses such as harassment or discrimination. Frequency of Incident Categories Reported 10 .6% 2.2% 5.2% 1.2% 3 .6% • Company/Professional Code Violation • Corruption & Fraud Customer/Competitor Interaction • Employmen t Law Vio lation 49 .6% Environment, Health & Safety • Misuse of Assets/Information • Other/Unresolved • Personnel Management Source: 2007 Corporate Governance and Compliance Hotline Benchmarking Report Another issue is that many large organizations already have multiple hotlines to report a variety of incidents . For example, there may be one phone number for reporting harassment, another for reporting theft and a third for safety issues. This is typically difficult to communicate, and people may not understand which number is best suited for the nature of their concern. Offering one hotline for a host of complaints makes communication simple for callers. At the same time it reduces the burden of communicating about the hotline. Until the consolidated hotline number is firmly established, numbers can be automatically forwarded to the new universal number. The hotline provider can implement a distribution process that ensures the appropriate people continue to get complaints regarding their areas of responsibility, as discussed in a later section, "Dissemination of Information." 3B-34 WHO WITHIN THE ORGANIZATION SHOULD "OWN" THE HOTLINE? In any organization there are several departments that should be interested in the ethics hotline, including Legal, Human Resources, Internal Audit, Security, Risk Management and Loss Prevention. Consider the interests of each department when planning the reporting process. If the organization is publicly traded, the Legal Department is interested in assuring the organization is in compliance with Section 301 of the Sarbanes-Oxley Act, which requires the organization to provide a mechanism for reporting financial irregularities while offering employees anonymity. The General Counsel should also be aware of complaints that may result in legal action, such as those regarding discrimination, wrongful termination or violations of regulatory standards. Many of the hotline reports depict unfair treatment, discrimination, harassment, substance abuse or concerns about corporate policies. For this reason, some organizations choose to make Human Resources responsible for managing the hotline program and any hotline vendor relationship. If the organization has an Ethics or Compliance Officer, this person is an ideal candidate for "owner" of the hotline program. Both HR and Legal need to be involved in organizing the hotline and formulating complaint report distribution rules in order to meet regulatory requirements and ensure that the right people receive information in a timely manner. Other departments, such as Loss Prevention/ Risk Management, Audit and Security are typically involved in developing the report distribution and escalation guidelines. This ensures that the appropriate departments learn about the issues concerning them. Another department that needs to be involved early on in the planning of a hotline is IT. There may be a need to set up mailboxes or plan for data feeds if there is substantial call volume. Discussing these issues up front makes the entire process run more smoothly in the long run. DISSEMINATION OF INFORMATION One of the most important aspects of planning the hotline is deciding where to send information that is received. A system of rules must be developed to determine what happens to information upon completion of the report. One of the most important aspects of dissemination is planning for checks and balances. Dual dissemination can be a helpful practice for ensuring that complaints are not overlooked or mishandled. A system of dual dissemination involves having an Ethics or Compliance Officer receive copies of all reports as a secondary layer of dissemination, beyond the report sent to the person responsible for investigation. For example, reports of harassment would be sent to Human Resources as the primary recipient of the information, with a copy to the Ethics Officer as the secondary recipient. 3B-35 Dual dissemination acts as a protective measure in case a report is sent to the accused party. If a report is received by only one person, and that person has a motive for preventing an investigation, the system is vulnerable. Complaints that have potential legal implications, like allegations of discrimination, should be sent to Legal and HR to ensure that both departments are involved in the investigation . Depending on the organizat ion's structure, there may be other interested groups . For example, some organizations have a Risk Management or Safety department that should receive reports of unsafe working conditions. Similarly, Loss Prevention should receive reports regarding internal theft, Internal Audit should get reports of vendor fraud, and Security should get reports of potential workplace violence. Sample Report Distribution Structure ISSUE POTENTIAL RECIPIENTS Employee Mistreatment Human Resources, Ethics Officer External Fraud Internal Audit, Loss Prevention, Risk Management, Ethics Officer Accounting Irregularities Audit Committee, External Auditors, Internal Audit, Ethics Officer Workplace Violence Security, Operations, Legal, Human Resources Employee Theft Loss Prevention, Human Resources Note : The distribution structure will vary based on the organization's structure. ESCALATION CRITERIA Another extremely important aspect of the planning process is determining procedures to be followed when a time-sensitive issue is reported . The hotline implementation group, which should include representatives from each operational department, must agree upon a list of topics that are sufficiently critical to require immediate escalation 24 hours a day and what topics are left for normal next-business day notification . Although many hotl ine reports do not require immediate notice 24/7, there are certain high-risk situations that may be reported through the hotline . These incidents or allegations should be considered prior to hotline implementation, so the management team has a shared understanding of how such a situation will be handled. Reports generally requiring immediate escalation include: • Threat of violence or physical harm to employees or customers • Threat of business interruption • Notice that a high-risk incident is expected to happen within the next 24 hours 3B-36 12 Depending on the nature of the organization's business, impending incidents requiring immediate escalation will vary. Many organizations classify the following as critical incidents: • Fraud • Falsification of company records • Release of proprietary information • Theft • Media inquiries When a report is received that is designated for immediate escalation, the organization should implement a set process to contact representatives immediately based on a pre-determined list of home and cell phone numbers of key personnel. In the case of a report received at 11 p.m . on a Friday night, immediate notification enables the organization to take preventative action rather than discover the report on Monday morning, which may be too late to address the issue. Use of a professional provider also ensures that there will be no bias involved in the decision to escalate time-sensitive issues. GLOBAL OPERATIONS Multi-national organizations face special challenges when it comes to making their hotlines available to global employees. Knowledge of any potential differences in legislation for all locations helps determine what steps must be taken to ensure your hotline program is compliant in countries outside of the United States. A case in point is since the enactment of the Sarbanes-Oxley Act in 2002, many countries including Canada, Japan, France and Germany have established similar legislation or guidelines but with many subtle differences. In France, the hotline must comply with specific criteria outlined by the government privacy agency, Commission nationale de l'informatique et des libertes (CNIL). CNIL guidelines stipulate that anonymous calls are not to be encouraged and that the scope of a hotline must be limited to specific types of incidents. In Germany, guidelines are in line with the CNIL however define the scope of hotlines more broadly to cover ethics issues beyond the purely financial and accounting issues envisaged by the French and European Union (EU) guidance. Another aspect that demands attention is that for companies working throughout Europe they must comply with EU data transfer privacy rules. Understanding the directive for data retention is also important. In June 2006, Japan enacted its Financial Instruments and Exchange Law. It is effective in all fiscal years ending after April 1, 2008. Commonly referred to as "J-SOX," this law applies to certification of internal financial controls. An ethics hotline is a crucial internal financial control and thus must comply with this law. Communication to employees must be reviewed for potential cultural issues. As a best practice, many organizations involve managers and labor representatives of international locations in the development stage of all ethics-related communications in order to uncover cultural nuances that should be addressed. Discussing these issues during the early planning stages ensures the program's complete support throughout the organization . 3B-37 There are also issues regarding the translation of both hotline interviews and communications materials and how to offer equal accessibility (toll-free telephone, Web, etc.) across the globe . Global callers must be able to place a toll-free call to reach the hotline. The organization cannot make the assumption that offering a Web reporting option is sufficient for global support. This assumes that all employees have access to the Internet. In many areas of the world Internet access is not affordable or reliable, so depending on an Internet hotline solution can be the equivalent of only offering the hotline to the highest paid employees. International dialing options vary by carrier around the globe. For U.S.-based organizations, collect calling is convenient when available, but many telephone providers around the world no longer offer collect calling to the United States . Depending on areas of operations, a method of cost-free reporting needs to be devised and effectively communicated to employees. Once the employee has placed a report, the hotline interviewer should be able to conduct the interv iew in the caller's language, using an interpreter if necessary. It is imperative that employees are able to report information in their native language, so they are as comfortable as possible during a potentially stressful conversation. DATA SECURITY AND RETENTION Ensuring that information from hotlines is kept in a secure environment is another important aspect of the planning stage. Safe Harbor certification ensures that an organization provides adequate security of personal data in accordance with the Department of Commerce and the EU's directive on data protection. Ask the hotline provider or the IT manager about the processes and safeguards that are in place to protect confidential information . For example, is the data vulnerable to hackers? Are employees of the organization's IT department able to easily access confidential information? Have interviewers been trained about confidentiality? Interviewers should have passed an extensive background check and signed a strict confidentiality agreement as part of the hiring process. Another data protection technique that should be considered is encryption of report information to ensure the security of e-mail transmissions. As mentioned previously, the CNIL requirements and other directives of EU limit the amount of time that organizations can keep records generated by the hotline. Depend ing on the country and the findings of the investigation, records must be destroyed within a specified time period. Multi-national organizations seeking to comply with guidelines of different countries should ensure their case management system is set up appropriately. 13 3B-38 Step Two: Communication - The Key to Hotline Effectiveness Once the hotline processes are defined and operational details are in place, it is time to focus on the communications plan. Hotline communications should be part of a broader program of defining the organization's ethics policy and promoting ethical behavior in the workplace. Communications that promote ethics and encourage use of the hotline not only help detect issues, but should also help prevent them by creating a culture of ethical behavior. Statistical data bears this out; the ACFE's 2008 Report to the Nation found that the median loss in organizations with fraud awareness or ethics training was $150,000 - half that of the loss for those organizations with no training . Organizations with awareness programs in place also experienced fraud schemes of a significantly shorter duration. OBJECTIVES AND STRATEGIES Prior to developing the plan, an organization must first determine the program's goals and objectives. What results does the organization want to achieve? What do they want the program to accomplish and how will the results be tested? A base line needs to be established prior to program implementation. As with any communication that seeks to modify behavior, there are strategies that help ensure the program's success. Strategies to keep in mind while developing the communications plan include: Top Down -Is the purpose of the program communicated and supported from the very top of the organization 7 Visible support from top executives is especially critical in any program seeking to modify employee behavior. If a program is seen as unimportant to top management, employees may disregard the communication. Shared Understanding -Are the roles of each participant identified and understood? If everyone does not have the same understanding of his/her role within the program, the process will break down. Documentation -Is there a way to measure and document the program? For example, is there a way to document that each employee has received information? Documentation can help evaluate the causes of a program's success or weakness and guide future decisions. Recognition -Is there a way to recognize positive performance? For example, if an employee reports theft, is there a way to reward him or her financially? If a hotline report inspires a change in policy, publicly applauding the person who drew attention to the situation demonstrates the usefulness of the program. This, in turn, inspires more participation. Forward Strategies -How will ongoing support and communication requirements be managed? Is there a plan for evaluating and periodically redirecting the program 7 Thinking ahead about the future direction of the program ensures its success. 3B-39 KEY MESSAGES As mentioned previously, communication about the hotline should ideally help create and maintain an ethical workplace . A communications team that includes top management should be involved in developing an ongoing ethics communication campaign . An ethics communication campaign is essentially an advertising campaign that seeks to inspire a certain behavior within an audience. As with any advertising campaign, the first step is to determine desired behaviors and the key messages that will help motivate these behaviors. A good place to begin when identifying key messages is with an organization's code of conduct; it is one of the most essential components in creating and maintaining an ethical culture. A code of conduct is a valuable resource for employees to turn to when they have a question about company policies and serves as a central component to a compliance program that helps teach employees how to make ethical decisions. Key messages should include: • Behaviors that are expected (i .e., conducting business in a legal and ethical manner) • Behaviors that the organization does not condone (i.e., illegal and/or unethical behavior) • What to do if you are aware of unacceptable activities. This aspect of communication must include information about all of the available avenues for reporting unacceptable behavior. This ensures people are aware of their options. • How to access the anonymous hotline • What happens when you report through the hotline It is then relevant to study the target audience (be it employees, suppliers or others) to determine how to effectively reach them. What are their demographics and psychographics? How do they receive communications? Where do they receive such communications? How much of a part does differing locations play in how best to communicate with employees? Also, what is their current attitude toward and perception of the organization and how it handles ethical issues? Employees may also need special communication from the organization explaining the nature of issues related to Sarbanes-Oxley. These materials should define terms like "accounting irregularities" and "insider trading," which may not be clear to all employees . Topics should include insider trading, improper loans to executives, accounting irregularities, conflicts of interest and whistleblower retaliation . Finally, these materials should emphasize that the Sarbanes-Oxley Act makes it illegal for the organization to retaliate against an employee who reports accounting or audit irregularities. It isn't just managerial employees who report fraud. Support personnel like administrative assistants or building maintenance staff may be aware of unethical behavior, so it's important to communicate clearly to everyone about unacceptable behaviors. 3B-40 DELIVERY METHODS When developing a plan it is important to determine a budget in the early stages of the process. This plays a key role in establishing parameters for communication methods and deliverables. For example, if employees are wide-spread, meetings may prove costly while electronic communications are significantly lower in cost than their written counterparts . These communications should educate participants and motivate them to report their concerns. Based on the results of studying the target audience, it will be clear how to effectively and efficiently communicate your message. Generally, the strongest method of communication is through team-building meetings and other face-to-face opportunities . How~ver, these messages should be reinforced with supporting communications delivered through vehicles such as posters in break rooms, e-mails, Web meetings, articles in employee newsletters, wallet cards, brochures and corporate intranet sites. There is an added "soft benefit" to communication: It reinforces the employee's perception that the organization wants to know about illegal and unethical activities, and it helps an employee decide to make the call. While developing delivery methods for the hotline communication, organizations at the same time may refresh their code of conduct; for many organizations, their code of conduct is out of date in not only content but format. In today's workplace, a code of conduct, along with an organization's hotline communications, needs to engage employees. The content should be easy to understand, its language suitable for all employees and its tonality positive and inspiring. An effective code of conduct focuses on encouraging employees to support and maintain an ethical workplace. It also requires a delivery makeover, transforming it from a traditional hard copy document to an interactive electronic tool complete with hyper/inks, a searchable database, vivid graphics and illustrations. Although ethics can be a sensitive topic, an experienced hotline provider can assist the organization in developing effective messages and vehicles for launching the hotline. They can also develop an appropriate plan based on the unique needs of the organization. LAUNCHING THE PROGRAM Like any new initiative, a hotline requires the proper launch in order to be truly successful. The initial communication to participants should include an announcement from top management about the program's goals and objectives. This helps set the program's tone by indicating that top management truly supports it. Employees should be told the organization is providing them with every opportunity to report problems and that the information they report will be sent to top management and/ or to the Board of Directors. It is important to stress reporting anonymity at this point and throughout all communications. Information about the program should be posted on the organization's intranet site and in break rooms. It should also be introduced in face-to-face meetings wherever practical. 3B-41 Every employee in the organization should receive a letter or flyer announcing the program. Ideally, this packet should include a card that he or she can keep in a wallet or purse as a reminder of the phone number and Website address. Remember, nearly half of hotline reports happen outside of normal business hours, so it is critical to help employees keep the hotline information handy. To add an element of fun to the kickoff, the use of electronic mediums can play a tremendous role in engaging employees. For example, teaser e-mails with built-in "movie trailers" can create buzz prior to the launch. A live Web meeting for the launch featuring top executives, interactive surveys and sample scenarios can deliver a strong message on an organization's commitment to an ethical workforce while providing clear messages in an upbeat environment. New employees must receive this information as part of their orientation. Managers throughout the organization should receive an implementation guide that informs them about the program, helps them encourage employees to use the hotline, and prepares them to handle questions. A REPORT COULD COME FROM ANYWHERE Hotlines are a well-established tool for detecting fraud, and the best return on investment from a hotline comes from focused communication beyond your employee base. If the organization is being swindled by a supplier, there may be employees working for the supplier who know about it and who may be bothered by the illegal activity. Listing the hotline on checks issued to suppliers is an inexpensive action that has helped uncover fraud for many organizations. The ACFE 2008 Report to the Nation also promotes communication efforts to the non-employee audience. The report revealed that more than 30 percent of reports came from external sources. Public corporations should also inform investors about the hotline. This action tells shareholders the organization has complied with this aspect of Sarbanes-Oxley and validates the corporate commitment to uncovering fraud . Publishing the hotline to investors offers them a convenient way to communicate their concerns to the organization . 3B-42 18 .. Q. 40% j:: 0 .. 30% c .. ~ .. "" 20% Percentage of Tips by Source* 57.7% Source ofTips The sum of percentages in this chart exceeds JOO percenr beca use in some ca~s respondents 1dentifred more 1han one sourcl! of the intt1J I lip Source: Association of Certified Fraud Examiners 2008 Report to the Nation GLOBAL COMMUNICATIONS For organizations operating outside of the United States or with a diverse employee base, a decision must be made about how to communicate to employees for whom English is not a native language. Depending on the organizational structure, it may be feasible to print bilingual materials, or it may be necessary to have several translations of primary communications tools. The communication pieces must also include specific information and language as mandated by the employee's country of residence . Currently, some European countries require compliance with the CNIL guidelines. Under these guidelines, communications must indicate who has oversight of the hotline and if a third party is engaged to operate the hotline and the location of that company. Communications must also include a required statement that abuse of the hotline can expose the caller to disciplinary actions and that anyone identified in a hotline report must be given the opportunity to access and correct information . Another issue is hotline access. Some countries may require dialing an international operator or some other step that is not required for callers in the United States. The specific dialing/reporting procedures must be outlined accurately for employees of each country, in their native language. 3B-43 KEEP THE HOTLINE "TOP-OF-MIND" A hotline produces stronger results if communication to employees about their options for reporting issues is consistent and persuasive . There is a well-defined pattern of hotline activity that follows a rule of advertising: When a tool is publicized, people use it for a while, and then they forget about it. COMMUNICATIONS MODEL M A M A Activity Following a Single Communication Event F MAMJ J ASO Activity With Repeated Communication Events Periodically reminding employees, suppliers and other stakeholders about the avenues for reporting unethical behavior (open door policies, ethics officers/ombudsmen and the anonymous hotline) increases usage and helps the organization uncover a variety of issues that can threaten profitability or reputation. Just as it is important to provide options for reporting concerns, it is equally important to make sure participants are aware of those options. Program maintenance communication is the most overlooked component of a hotline program. The best way to ensure it is not overlooked is by planning for communications at the time of program launch and each year thereafter. 3B-44 20 Step Three: After the Call A standardized system for responding efficiently and appropriately to hotline reports is a key element in fostering a culture of ethics throughout the workplace and aids in limiting the potential liability associated with illegal and unethical acts . Once a hotline report or allegation is reported it has to be addressed and when necessary, fully investigated. An effective preliminary investigation starts with a critical assessment of an organization's available resources to support an investigative process. This organizational assessment will serve as the foundation to determine what an organization can achieve through internal resources or if it is necessary to seek the services of an independent, third-party investigator. However, prior to initiating an investigation, a series of steps should be taken to "triage" a report in order to determine its logical next steps. Organizations start this process by outlining the different types of unethical and illegal behaviors that may occur within their organization and determining who is best qualified to respond to each hotline report. REPORT DISSEMINATION It is important to set up dissemination rules that determine which individuals, groups or departments receive each type of report. The hotline implementation team should periodically review the disseminat ion structure to ensure any changes within the organization are reflected in the report dissemination rules. ONGOING COMMUNICATION WITH ANONYMOUS PARTIES When dealing with an anonymous party, the goal should be to capture complete and accurate information during the interview. This is based on the assumption that there may never be an opportunity to add additional information. An anonymous hotline or Web form should therefore enable the person reporting to follow up to offer additional information while maintaining anonymity. This is generally done by giving the person a process to follow for calling back to answer more questions from the organization . The anonymous party is given a unique code correlating to his/her report and is asked to call back after a pre-determined interval. This gives investigators a chance to review the information and formulate questions to ask the caller if he or she calls back as agreed. While the call-back process can enhance an investigation, roughly two-thirds of anonymous callers never call back, so the quality of every interview is of critical importance. Even if the person reporting provides his or her name, the person may often refuse to answer questions provided by the organization or have second thoughts after making the initial report. FOR PUBLIC COMPANIES To ensure that allegations related to Sarbanes-Oxley reach the board, hotline incident reports regarding financial irregularities should be automatically routed to one or multiple Audit Committee members . The organization should set up a report dissemination routine with the hotline administrator. This enables the Audit Committee to receive any reports of 3B-45 financial irregularities in a timely manner. Many companies elect to simultaneously send such reports to a member of the Audit Committee and to an internal employee, such as an Internal Auditor, Legal Counsel or an Ethics Officer, who works with the Audit Committee to manage the investigation. INVESTIGATION OF ALLEGATIONS Having received an allegation, the next step is to determine how the allegation should be investigated. Personnel who receive reports generally have procedures in place to investigate incidents pertaining to them. These processes should be periodically reviewed with legal counsel to ensure they are appropriate and effective. Allegations of financial irregularities present a somewhat more complicated situation for public companies, as Sarbanes-Oxley requires the Audit Committee of the Board of Directors to develop a mechanism for the "receipt, retention and treatment" of complaints. Some organizations are developing relationships with external parties, such as forensic accountants or independent Certified Fraud Examiners. This gives them an independent resource to manage an investigation, should an allegation arise. Given new independence requirements for external auditors, many accounting firms have formed alliances that enable them to recommend a second firm for special projects such as these. Regardless of who oversees the investigation, the elements of a thorough investigation are the same: gathering key evidence, conducting in-depth interviews and documenting the findings. The elements are cyclical, as evidence is gathered and personnel are identified, new evidence will present itself along with the names of additional people to interview. It's a process that should continue until objectives are met and a comprehensive report is completed. A thorough investigative report is an organization's best ally in assuring an ethical workplace. When investigating an incident based on a confidential hotline tip, it is important for the organization not to reveal that it is reacting to a tip. Disclosing this information is a breach of confidentiality and may put the whistleblower at risk . For more information about investigating allegations, visit http://www.tnwinc.com/downloads/investigativetips_ whitepaper.pdf. TRACKING THE "TREATMENT" OF COMPLAINTS The tracking of the treatment or management of complaints is best met with a case management-driven database . A sophisticated database enables an organization to document every complaint and then add information regarding the actions they have taken to investigate each allegation. The database should record the final disposition of the investigation and the nature of any discipline or other corrective action taken as a result of the complaint. Should the organization be sued, this documentation can be very helpful in a court of law. This is another area in which a qualified third-party hotline provider can assist the organization by providing an established system for documenting investigative activities. 3B-46 I i 22 I MANAGEMENT REPORTS A hotline program is dynamic with activity that peaks and plunges as a result of activity within the organization. The introduction (or elimination) of a training program, a renewed emphasis on ethical behavior by the CEO, a lapse in written communications about ethics - all of these (and a myriad of other factors) can contribute to the number of hotline tips and reports. Activity Count per Original Report Month 120 -Othe r 100 -Callback 80 -Original Report 60 40 20 ~ ~ ~ ~ 8 ~ ~ ~ ~ 8 ~ 8 N N N ~ ~ . . . . ~ ~ "" ~ f ~ -" -" 1 2 ~ B E ~ ::1 < < 2 /) ~ -" Y: ~ ~ z To effective ly detect problems, analyze trends and manage the program, an organization needs ready access to a reliable reporting tool . Organizations should seek a reporting tool that provides high-level summary information as well as detailed information and can filter information by incident type, volume , time frame and location. The formatting and d isplay of the data is important; a graph ical format can help users better interpret the data and make educated business decisions . And for organizations that use case management tools, reporting should include details about the status, volume and resolution of allegations. Organizations should look for "hot spots ." Is there a division that seems to have more issues than others? If so, there are probably opportunities for employee training or increased management training to improve the situation. Is there an investigator whose number of past-due cases is consistently high? There may be a need to evaluate the investigator's caseload or his/her ability to manage the load. Is there one location where very few calls are made? Perhaps communication about the hotline has not reached this group. Analysis of data is key to making future enhancements to a program. The best hotline programs are ones that gauge the effectiveness of campaigns, assess the need for additional training, track trends and evaluate the overall health of an organization . An effective reporting tool can drive th is effort. 3B-47 BENCHMARKING Comprehensive reporting tools give organizations a good grasp on their hotline activity. But to measure its overa ll ethical health and the value of its ethics program, an organization needs to look outside the bounds of its corporate walls and compare its hotline activity to that of similar organizations. Are other organizations seeing the same rate of anonymous reports? On average, what percent of employees are reporting through the hotline within a certa in industry? What incidents represent the highest number of reports industry-wide? Benchmarking provides organizations with the metrics it needs to determine if its hotline activity is considered high (or low) with i n the industry. Then the organization can analyze the information in order to determine why the hotline activity fluctuated . This knowledge can drive the need for change within a hotline program, suggest the need for new initiatives or reinforce the conduct of ones that are already in place. Conclusion For many years, organizations have been using hotlines to detect theft and fraud with great success. But until recently, some organizations still considered them a luxury, rather than a necessity. Since the passage of the Federal Sentencing Guidelines more than twelve years ago and the more recent corporate scandals, hotline usage has dramatically expanded. A variety of business sectors have found hotlines to be critical tools in their efforts to uncover and manage a variety of unethical or illegal activities. And given the current trend toward outsourcing non-critical functions and the advice of the AICPA, it is logical that hotlines should be externally operated by a neutral, experienced organization . Lawmakers have further validated the need for this reporting mechanism. Establishing an anonymous hotline gives corporations access to a powerful tool for detecting fraud and other harmfu l act iv it ies. It also assures investors and customers that the organization has made a long-term commitment to maintaining the highest standards of business conduct. The Association of Certified Fraud Examiners' 2008 Report to the Nation suggests hotlines should be open to participants beyond the employee population in order to maximize results. By making hotlines available to vendors, contractors, and the general public, both the quantity and quality of reports would increase. Having these hotlines would also help to deter unethical or illegal activity and demonstrate the organization's commitment to ethics. Creating a successful hotline program involves thoughtful planning of the reporting process, the communications strategy and the back-end issues of investigation, data management and analysis . 3B-48 About the Authors The Network pioneered the employee hotline industry over 25 years ago. Today more than 2,500 organizations, including almost half of the Fortune 500, rely on The Network for centralized reporting of sensitive workplace incidents . The Network also offers comprehensive communications services to support employee communication initiatives. For more information about The Network, call 800-357-5137 or visit www.tnwinc.com . Tony Malone is Chief Executive Officer of The Network, Inc. Mr. Malone holds the Associate in Risk Management (ARM) and Chartered Property & Casualty Underwriter (CPCU) professional designations . He is a member of the National Association of Corporate Directors as well as the American Society for Industrial Security. Ralph Childs is Chairman of The Network, Inc. He founded The Network in 1982 as the nation's first anonymous third-party ethics hotline provider. Mr. Childs is a former FBI Special Agent and an Associate Member of the Association of Certified Fraud Examiners with extensive experience in security consulting. 3B-49 ©200& Tl".a Nehvo r~ Inc 1 NW+i.LWP08·CI.!. 3B-50