Originally, this post was intended to answer the simple question: “What is a whistleblower hotline?”. That seems a bit trite in our difficult times, so let me expand the focus a bit. Over the past few weeks, COVID-19 has turned the world upside-down. Everyone is struggling to understand how to adjust to life with a potent new risk racing around the world; and we’re trying to keep our prior concerns, business objectives, and jobs moving forward as much as possible.
So today, let’s try to tie both those issues together as we continue our look at the building blocks of a corporate compliance program. How can we put hotlines and internal reporting systems to their best use, as enterprise organizations begin to navigate this new, difficult world?
Begin With the Whistleblower Hotline Basics
First, let’s remember what a hotline is not. It is not simply a dedicated phone number that employees call to report a concern.
Sure, you can use a traditional telephone line as part of your whistleblower hotline program. Just about every large company does, and just about every large company should—but under several important whistleblower laws and regulations, you don’t actually need to use a phone line.
For example, the Sarbanes-Oxley Act only requires corporate boards to “establish procedures for the receipt, retention, and treatment of complaints.” But neither SOX or the SEC rules that put the law into effect use the word “telephone” or “hotline.” They only say the company should establish a system that’s effective in bringing employee concerns to the audit committee.
So you don’t need to use a phone hotline if you’re confident that you can maintain a good complaints intake system without one. That’s just a hard argument to make in hindsight if your phone-less system leads the company to miss a major issue and regulators start asking about the wisdom of that original decision.
In other words, the “hotline” is just the compliance industry short-hand for “a system that allows employees to bring concerns directly to management or the audit committee.” A phone line can be one avenue to submit issues, but so can email, online portals, or even conversations with managers.
A hotline isn’t a single thing any longer. It’s a multi-channel system to keep management aware of potential concerns.
Keep the Corporate Ear to the Ground
That’s why an internal reporting system—call it a hotline or whatever you want—is so crucial today. Yes, that system is a regulatory requirement to help prevent fraud, corruption, workplace harassment, and much else.
But more than that, a strong internal reporting system is instrumental in helping your company keep its corporate ear to the ground. Corporations face tremendous volatility and risk today. We need every bit of help and intelligence about those threats that we can get.
That’s how I thread the needle between our new menace of coronavirus and the age-old chestnut of talking about whistleblower hotlines. Whistleblower hotlines aren’t a regulatory burden we’re forced to deploy. They are a cornerstone of risk management, where regulatory compliance is just one of many risks we need to keep in check.
For example, we’ll need employees to report when they are feeling ill, or when they suspect a coronavirus outbreak might be happening at a company facility. We’ll also need employees to report all their “usual” concerns about improper payments or corrupt deals or harassment, although they may be submitting reports from their homes rather than an office phone. We’ll need them to warn us about cybersecurity threats, potential supply chain bottlenecks, competitors planning to merge, and lord knows what else.
Quite simply, management should want employees to warn them about anything. The more information the C-suite gets, the better its ability to identify true risks and respond astutely.
Internal reporting systems are the means to make that responsive ideal come into being. That’s why hotlines (which includes all methods of intake) are so useful. That they fulfill regulatory requirements is nice too, but a strong internal reporting system truly is a strategic advantage, too.
Don’t Disregard the Other Parts
As much as hotlines, anonymous email addresses, and secure web forms are crucial to internal reporting, compliance officers need to consider a few other components that accompany the whistleblower hotline. Among them:
- A case management system: Once a person makes a report via the hotline, the company needs a disciplined approach to investigating the issue, determining the proper course of action, and assuring that any needed actions (new controls, discipline, disclosure to regulators) actually happens.
- Training: Employees need to trust that an anonymous hotline really is anonymous. They need to know how to use it—including when not to use it, unless you want a flood of complaints about somebody’s moldy food in the breakroom. Managers also need training about how to handle a complaint once it enters the system.
- Executive messaging: If you want employees to trust the company and use the hotline, they need to believe management is sincere. So the more senior leaders can talk about ethics and the importance of speaking up; the more they can provide real examples of how the company values good business practice—the better.
All of these factors, working cohesively, is how a company generates awareness of risks and get employees to call the hotline with what’s on their mind. Given everything compliance programs need to manage—and everything that all of us are enduring right now—the more an organization can make full use of its whistleblower hotline, the better.