Compliance hotlines are part and parcel of an effective compliance program. An anonymous internal reporting system is one of the seven elements of an effective program dictated by the U.S. Sentencing Guidelines which means there’s no such thing as an effective compliance program without one.
Now that the fundamental point is clear: How should a compliance hotline actually work? What does an effective compliance hotline do?
Those questions are much more tricky to answer. There is no standard compliance hotline an organization can install and then declare victory; each business must find the hotline system that works best for its own needs.
We can say that all effective compliance hotlines have certain traits. For compliance officers looking to develop hotline systems, the challenge is mapping those traits onto your company’s unique characteristics—its size, complexity, workforce, transactions, and more.
What is a Corporate Compliance Hotline?
Before we jump into the common traits every effective hotline should possess, let's review the purpose of a hotline. A corporate compliance hotline is a system that allows employees, third parties, and other stakeholders within an organization to report potential wrongdoing. Common examples of wrongdoing include bribery, corruption, fraud, or financial concerns.
Whistleblower hotlines provide a channel for whistleblowers to voice their concerns so that the issue can be investigated by the compliance team. For many organizations, the types of reports submitted, along with the frequency and severity of the issues can be telling about the culture. Compliance teams leverage hotlines to protect the organization from reputational and financial risk but also to better understand what is going on in the organization including where additional risks might be.
5 Elements of an Effective Compliance Hotline
What are those traits of effective compliance hotlines? Let’s consider five.
1. Accept submissions in multiple formats
Compliance professionals associate the word “hotline” with a telephone number employees can call—and yes, just about all hotline systems do give employees the option to place a call. But that shouldn’t be the only option you offer employees.
An effective hotline system will let employees (and third parties!) submit concerns by phone, email, website, text message, or any other form of communication that seems appropriate. Even a suggestion box bolted to the factory wall, where employees can submit questions written on a piece of paper, should be considered.
Notice, for example, that SEC rules about internal reporting systems expressly decline to say, “Thou shall use a phone.” Instead:
“We believe audit committees should be provided with flexibility to develop and utilize procedures appropriate for their circumstances… We expect each audit committee to develop procedures that work best consistent with its company's individual circumstances to meet the requirements in the final rule.”
The goal with compliance hotlines is to provide reporting channels that work for your employees. Office employees might prefer one method, factory workers another, and remote workers yet another. An effective hotline can allow submissions through whatever channels make sense.
2. Feed into a larger system for case management
As diverse as your hotline system may be, most issues will still come to senior executives’ attention via employees speaking to their immediate managers. So for compliance officers to get a complete sense of all the issues affecting the business, you need to integrate reports arriving via the hotline with reports arriving from managers.
That goes beyond mere intake of reports, to details about how each report is classified and stored in your case management system. This point also requires some training; since managers will need to understand, “Oh, this employee is reporting something to me right now” and then enter that issue into your internal reporting system.
Ultimately, your internal reporting system should be able to pull all that data together into one unified report. This will provide you with better visibility into compliance and misconduct risks the company faces.
3. Support data analytics
To that point about integrating with larger case management systems, compliance officers can piece together a more complete picture of risk—your hotline system should also feed into data analytics programs, to support that in-depth analysis.
At the intake phase, that means the hotline should try to collect as much standardized information as possible: fields for employees to enter the type of complaint, their office location, whether they’ve already tried to raise this with their manager, and so forth. (For a phone hotline answered by call center staff, develop a script that lets them ask the same questions.)
Behind the scenes, your hotline should then record those points of data, and each report should go to a central repository where those fields are tagged and indexed. That level of specificity is crucial for in-depth reporting and data analytics: “How many employees from this region have complained about this type of misconduct in the last 18 months?” and so forth.
4. Allow for direct communication with reporters
Building trust with a whistleblower can be invaluable to help you understand what misconduct is really happening within the organization. To that end, then, an effective hotline system allows you to communicate with reporters—even the anonymous ones, if they’re open to further communication.
For example, anonymous online submissions could be structured almost like a text message chain, where the compliance officer can leave an acknowledgment, ask for more information, or even send information back to the reporter. Phone systems could have call center workers ask the reporter to call again, either with new information or to hear a status update on your investigation. Communication fosters trust, which is the currency of the realm for ethics and compliance professionals.
5. Actually work in practice
Don’t underestimate the practical challenges of implementing a hotline, especially at the global level. Even establishing valid phone numbers in multiple countries, connecting to one or more call centers around the world, can be quite difficult. Accommodating data privacy rules in the European Union and elsewhere can also be enormously complicated.
Effective hotlines overcome those obstacles. That can take time, as well as much planning in the design and implementation phase—but investing that time and effort at the beginning is far wiser than discovering later that some complaints aren’t arriving, or are miscategorized, or can’t be recorded because your call center can’t speak the language of employees.
How GAN Integrity Can Help
If your compliance hotline accepts submissions in multiple formats, integrates into a larger case management system, supports data analytics, allows you to interact with reporters, and actually works in practice then you are likely headed in the right direction. However, many programs cannot boast that they align with each of these critical points.
If you are looking to enhance your current hotline provider and process, we highly encourage you to explore our robust solution. Our investigations process is enterprise-ready and will streamline reporting and case management in unparalleled ways. Book a demo today to see how to customize a solution to meet the unique needs of your organization.
Matt Kelly is an independent compliance consultant and the founder of Radical Compliance, which offers consulting and commentary on corporate compliance, audit, governance, and risk management. Radical Compliance also hosts Matt’s personal blog, where he discusses compliance and governance issues, and the Compliance Jobs Report, covering industry moves and news. Kelly was formerly the editor of Compliance Week. from 2006 to 2015. He was recognized as a "Rising Star of Corporate Governance" by the Millstein Center in 2008 and was listed among Ethisphere’s "Most Influential in Business Ethics" in 2011 (no. 91) and 2013 (no. 77). He resides in Boston, Mass.