A well-run whistleblower hotline should be the lifeblood of compliance throughout an organization.
This is why it’s critical to build a comprehensive whistleblower hotline process. Fail to do so and your compliance team will lack the insights needed to effectively oversee corporate conduct and could ultimately put the organization at risk. A proper whistleblower hotline will help employees’ concerns be heard, allow compliance to better understand the pulse of the business, and uncover bad actors.
So, how exactly does a compliance team establish a whistleblower hotline? What are the intake channels? Are hotlines required? And most importantly: How can you put hotlines and internal reporting systems to their best use? Let’s dive right in.
What is a Whistleblower Hotline?
If you are asking yourself, what is a whistleblower hotline? Let’s first remember what a hotline is not. It is not simply a dedicated phone number that employees call to report a concern.
Sure, you can use a traditional telephone line as one aspect of your whistleblower hotline program. Just about every large company does, and just about every large company should—but under several important whistleblower laws and regulations, you don’t actually need to use a phone line.
For example, the Sarbanes-Oxley Act only requires corporate boards to “establish procedures for the receipt, retention, and treatment of complaints.” But neither SOX or the SEC rules that put the law into effect use the word “telephone” or “hotline.” They only say the company should establish a system that’s effective in bringing employee concerns to the audit committee.
So you don’t need to use a phone hotline if you’re confident that you can maintain a good complaints intake system without one. That’s just a hard argument to make in hindsight if your phone-less system leads the company to miss a major issue and regulators start asking about the wisdom of that original decision.
In other words, the “hotline” is just the compliance industry short-hand for “a system that allows employees to bring concerns directly to management or the audit committee.” A phone line can be one avenue to submit issues, but so can email, online portals, or even conversations with managers.
A hotline isn’t a single thing any longer. It’s a multi-channel system to keep management aware of potential concerns.
What are Intake Channels?
When it comes to intake channels, there are three main methods organizations rely on. You will likely need a combination of channels, based on the industry, size, and cultural environment your business operates in, to capture the highest number of concerns possible.
Various legislation also has different approaches to intake channels. The EU Whistleblower Directive allows reports to be made either orally or in writing, or upon request, in an in-person meeting. The 2002 Sarbanes-Oxley Act does not specify in which form reports may be made.
It’s wise to remember that there are cultural issues at play when it comes to the usage of different channels: younger generations may be more accustomed to digital communications and feel comfortable filling out a web-based form while others expect to be able to pick up the phone to relay their concern. The goal is to capture as many concerns as possible so by providing multiple channels you make it easier and more likely that employees (and third parties) will speak up.
Why Have a Whistleblowing Hotline?
That’s why an internal reporting system—call it a whistleblower hotline or whatever you want—is so crucial today. Yes, that system is a regulatory requirement to help prevent fraud, corruption, workplace harassment, and much else.
But more than that, a strong internal reporting system is instrumental in helping your company keep its corporate ear to the ground. Corporations face tremendous volatility and risk today. We need every bit of help and intelligence about those threats that we can get.
That’s how I thread the needle between our new menace of coronavirus and the age-old chestnut of talking about whistleblower hotlines. Whistleblower hotlines aren’t a regulatory burden we’re forced to deploy. They are a cornerstone of risk management, where regulatory compliance is just one of many risks we need to keep in check.
For example, we’ll need employees to report when they are feeling ill, or when they suspect a coronavirus outbreak might be happening at a company facility. We’ll also need employees to report all their “usual” concerns about improper payments or corrupt deals or harassment, although they may be submitting reports from their homes rather than an office phone. We’ll need them to warn us about cybersecurity threats, potential supply chain bottlenecks, competitors planning to merge, and lord knows what else.
Quite simply, management should want employees to warn them about anything. The more information the C-suite gets, the better its ability to identify true risks and respond astutely.
Internal reporting systems are the means to make that responsive ideal come into being. That’s why hotlines (which includes all methods of intake) are so useful. That they fulfill regulatory requirements is nice too, but a strong internal reporting system truly is a strategic advantage, too.
Are Whistleblower Hotlines Required?
In many cases, yes—but certainly not in all cases. Public firms in the U.S. have been required to have procedures in place since the entry into force of the 2002 Sarbanes-Oxley Act. So if your organization has a public offering on the horizon, it might be a good time to get your whistleblower hotline process in order.
The recent passage of the EU Whistleblower Directive, which will take effect in 2021, requires many European companies to have a hotline in place. The legislation requires all businesses operating in the trading block—including those headquartered outside the EU—with more than 249 employees to install internal reporting mechanisms allowing their employees, and in many cases also designated third parties, to lodge complaints anonymously.
Notably, under the directive, whistleblowers will be allowed to bypass internal channels and report straight to the authorities without fear of retaliation if they do not trust the internal channels. Moreover, the directive contains language prohibiting organizations from stifling potential whistleblowers through the use of non-disclosure agreements in addition to other wide-ranging protections against retaliation. This makes it even more critical for companies to create a whistleblower hotline process that is user-friendly and easy for their employees (and third parties) to actually use.
What are Other Hotline Considerations?
As much as hotlines, anonymous email addresses, and secure web forms are crucial to internal reporting, compliance officers need to consider a few other components that accompany the whistleblower hotline. Among them:
- A case management system: Once a person makes a report via the hotline, the company needs a disciplined approach to investigating the issue, determining the proper course of action, and assuring that any needed actions (new controls, discipline, disclosure to regulators) actually happens.
- Training: Employees need to trust that an anonymous hotline really is anonymous. They need to know how to use it—including when not to use it unless you want a flood of complaints about somebody’s moldy food in the breakroom. Managers also need training about how to handle a complaint once it enters the system.
- Executive messaging: If you want employees to trust the company and use the hotline, they need to believe management is sincere. So the more senior leaders can talk about ethics and the importance of speaking up; the more they can provide real examples of how the company values good business practice—the better.
All of these factors, working cohesively, is how a company generates awareness of risks and motivates employees to call the hotline with what’s on their mind. Given everything compliance programs need to manage—and everything that all of us are enduring right now—the more an organization can make full use of its whistleblower hotline, the better.
Are Whistleblower Hotlines Really Anonymous?
At times, employees (or third parties) wanting to report potential wrongdoing may wonder if they are able to file anonymously. Fear of retaliation or other consequences are very real obstacles that compliance officers should help reporters to overcome.
Protecting reporters from retaliation inside the organization is certainly one of the most challenging aspects of any internal reporting program. One part of the challenge is distinctly human: how do you foster a culture of ethics in your organization which makes it clear that any form of retaliation is not tolerated? One part of the solution heavily leans on buy-in from the top, but also middle management.
In order to have the most claims submitted through your whistleblower hotline program, it’s essential to have anonymous reporting as an option. Fortunately, with the right ethics and compliance hotline provider, you and your employees can rest easy knowing that everything will remain anonymous. Providers can create a unique case identification number that allows follow up through chat functionality, which is often needed. Internal reporting solutions really help anonymous reports become a viable possibility and enable further communication after the initial report.
Why Your Company Needs a Whistleblower Hotline
Beyond whistleblower hotlines being increasingly required by legislation (such as the EU Whistleblower Directive), facilitating internal reporting kicks off a virtuous cycle within organizations. In fact, increased whistleblower reports are correlated with better business outcomes, having a world-class internal reporting system in place should be a top priority to facilitate employees and third parties coming forward.
However, this process by itself isn’t enough: you will need a comprehensive ethics program, and indeed a culture of ethics instilled into your business for your process to function properly. Do this well and it can lead to trust among your employees which will encourage them to speak up if they do come across misconduct.
Our investigations process is a great solution to all your internal reporting and case management needs. To read more on the topic, we highly recommend checking out The Ultimate Guide to Internal Reporting & Investigations. Not only does the eBook cover the most common case management challenges but it also includes a checklist of features you should look for in an ethics and compliance hotline provider.