Remote compliance investigations have become a challenge since the onset of COVID-19 nearly six months ago. Ethics and compliance teams everywhere—plus legal teams and HR teams—have been talking about how to conduct remote compliance investigations, and the topic is showing no signs of abating, since it looks like we will all be working from home for quite some time (seems like forever).
So how do you conduct remote compliance investigations efficiently and effectively? How is it different from a non-remote investigation? How do you collect the information you need to conduct a thorough investigation? How do you get meaningful participation remotely?
While I don’t have all of the answers, we at Convercent believe that the essence and nature of an investigation doesn’t change just because the circumstances are different, yet these new circumstances will undoubtedly force us to be agile when it comes to investigative processes. The following tips and considerations can help alleviate the anxiety of remote investigations for both those conducting the investigations and employees who are filing concerns that need to be investigated.
1. Adapt Your Compliance Investigation Process & Policy:
In that order. The first step to successful remote compliance investigations is to acknowledge to yourself and your employees that how to conduct a remote compliance investigation will be different. Thus, adapting and revising your process first, then your policy to reflect the new process and publicizing the new process is key. The only way for employees to trust the process is to know your process. There will be some differences, even if nuanced, yet communicating those differences can (and will) have a monumental impact on employees’ comfort in raising concerns during this time. We must continue to protect our whistleblowers and, in addition to ensuring there are proper avenues for them to report, what happens after they file a report is to of mind for them…so tell them.
2. Understand & Communicate Your New Risks When Conducting Remote Compliance Investigations:
What changed for your company during COVID (and beyond)? Were supply chains disrupted or employees laid off? What is the impact of decreased revenue or what will be the effect of pressure to perform? Whatever your changes in risk may be, understanding the nature of those risks and where they manifest themselves in your current circumstances will help you share the same with employees so that you aren’t neglecting reporting issues just because they don’t understand how the issues they were traditionally used to seeing have changed. Employees only report on risks they understand, and, in remote environments, the risks have changed.
3. Think About How You’ll Gather Evidence for a Remote Compliance Investigation:
As part of the policy and process revisions, we must also determine how we will gather and review documents in a remote world. Coordinating with IT to understand their capabilities and limitations is essential to understanding any potential limitations on your process. Where is information stored? Is it all digitized? Do you have remote access to employee’s computers? Can your computer handle a remote push of large data access? Do you need a document review system? Syncing with IT before you need them will make all the difference.
4. Conduct Interviews Discreetly:
How to schedule interviews can be the biggest challenge when everyone is remote. While body language and context clues can still be examined via video conference, employees’ schedules are packed with Zoom meetings. The sometimes-necessary element of surprise of an investigation interview is difficult to achieve. So how do you schedule a “last-minute” remote meeting with an investigation subject—and do it ethically? You should not deceive the witness, but instead, review that person’s calendar daily to “pop in” or call the individual and ask them to cancel a current meeting to accommodate your interview. Whether the person is a cooperating or adversarial witness will be even more key to addressing how to coordinate the interview in the right manner.
5. Maintain Confidentiality:
Confidentiality has been mentioned repeatedly in regards to how to conduct remote compliance investigations; however, it is often mentioned as it relates to working from home, other persons that may be in an employee’s house, and having control over who hears the investigation interview or how they use the information presented during that interview (i.e. whether it raises data protection or privilege concerns). This should be considered, but ethics and compliance practitioners must also consider how to reassure the person raising the complaint that their concern will be addressed within the organization with the strictest confidence. This means not setting public calendar meeting invitations, emailing sensitive documents, or discussing the concern with more than one or two necessary individuals. Instead of emails, consider phone calls to gather facts, SFTP transfers, and lower-touch methods like technology platforms to manage the investigations.
So, in the end, what’s so different about how to conduct remote investigations versus “normal” investigations? It’s really preparation and communication: Preparing yourself and your employees for the process and gaining their consent, communicating the differences in the risks you previously trained them to identify and how those map in our current environment, anticipating how you’ll gather evidence and conduct interviews discreetly, and ensuring the most essential tenet of confidentiality is still maintained is all that matters … as if that was a lot?!?!
Get the Definitive Guide to Compliance Case Management
No matter what investigative procedures you’re following, using technology to centralize and streamline those procedures will protect you down the road. If you don’t already have the systems or documentation in place to demonstrate your procedure to a regulator, you’re likely to run into trouble. Get our guide to case management, where we’ll walk you through some low-effort, high-reward changes you can make to modernize your program.