Whistleblowing rules are changing. International legislation and legislative bodies—including Sarbanes-Oxley in the US, Sapin II in France, and the UK Financial Conduct Authority—increasingly mandate that companies implement whistleblower hotline programs. The downside is that a number of opportunistic providers have entered the market.
Under pressure to improve compliance methods, many companies move to discharge their responsibilities quickly and focus their procurement decision on price—without a proper cost/benefit analysis. This approach can quickly backfire.
Arguably, the normalized (i.e., per employee) cost across all the whistleblower hotline providers is pretty similar. That’s why the procurement decision should focus on capability, service, reputation, performance, innovation and similar measures. In this post, I cover what to look for in a whistleblower hotline, and explore the advantages of an integrated platform approach for receiving and processing whistleblower calls.
Why a Whistleblower Hotline is Essential
British Telecom (BT) is a UK FTSE100, high-profile global company with a good record of corporate governance. However, in January 2017, $10.5B (20%) was wiped off the company’s stock market value after it admitted that a scandal at its Italian division was far worse than initially thought and would cost $690M. The company had just told investors the cost would be $190M. BT subsequently spent $19.5M in just a three-month span investigating the scandal.
As Gavin Patterson, BT’s CEO said, “… management didn’t find the problem, nor did internal audit or external audit.” In fact, the company discovered the problem through a whistleblower call to the company’s hotline.
Conduct a few minutes of online research and you’ll find BT had every type of Code of Conduct and policy in place. But none of these was enough to stop what was, by any measure, a major and sophisticated fraud.
Companies often make the (false) assumption that they don’t receive many whistleblower hotline reports (whether phone call, email, webmail, letter or proxy/manager reports) because they don’t have many problems. However, research shows that companies should receive a median of around 1.4 reports per 100 employees annually, which equates to 280 for a 20,000-employee company. A more effective hotline can be a critical trigger factor in driving higher reporting levels.
Why Procurement Must Look Beyond Price
To keep costs down, companies might choose a whistleblower hotline provider that uses a multifunction call center and think nothing of it. But there is a stark difference between outsourcing sales calls and third parties effectively managing whistleblower calls.
Imagine someone bullied by their manager and wanting to make a whistleblower hotline report about it. They’re faced with a tough decision for numerous reasons, such as conditioning to not question authority, fear of exposure, fear of retaliation, and so on. But they decide to make the call, despite complex dialing instructions and having to pay for it because they’re making the call from home. The employee is in tears and struggling to get out their words between sobs. But the call center operator, whose fluency is poor, shows little empathy and treats them like a ‘transaction.’ The employee loses their nerve and disconnects.
As this example of a whistleblowing incident shows, a hasty purchasing decision largely focused around price can directly impact hotline performance, along with the level, type and volume of reported information received.
It Takes More Than a Spreadsheet to Manage Cases
Some assume they can manage whistleblower hotline report cases using a relatively simple spreadsheet and email-based database. Imagine trying to handle the following critical aspects of a reported case using just a spreadsheet:
- Case escalation and timing
- Attachment/evidence management
- Case security and access management
- Reporter contact management (where the reporter isn’t anonymous)
- Case handler/contributor notification management
- Company case handling and timing
- Case closure
- Case analysis, statistics and root cause/pattern analysis
- Reporting customization and production
Focus on Case Management
Procurement and compliance officers face a dizzying array of choices when it comes to an outsourced whistleblower hotline. The market includes more than ten principal providers, headquartered both in the US and Europe, with arguably two or three leaders in the field. While many offer similar hotline capabilities and facilities, with some capability and combination variations around intake channels, their case management systems differ.
The above list of case management tasks can be handled effectively with the right processes and tools. ‘Smart escalations’ are just one example of the growing sophistication of whistleblower hotline case management. This capability allows you to set up rules so cases are auto-routed—with minimal manual intervention—to the appropriate handler. Moreover, it can deal with issues such as report diversion if a handler is implicated or conflicted in some way in the report.
The best case management systems also support root cause analysis and the ability to draw inferences in terms of roles, responsibilities and preventative actions required, such as focused training and communications.
Studies show that case closure timescales currently hover around a median of 42 calendar days (6 weeks). As a result, effective case management is crucial to maintain employee confidence in their hotline, and to keep pace with rising reporting volumes.
Most Fall Short on Integration
The key shortcoming of many, if not most, whistleblower hotline systems is in the area of integration. Many providers are unable to deliver a platform level of integration because their product set was created through acquisitions rather than purpose-built design. Integrated whistleblower hotline systems can provide crucial compliance insights and analytics on wide-ranging issues such as retaliation by automatically comparing whistleblowers with appropriate retaliation indicators.
The latest industry research shows that as whistleblower reporting levels increase, so does retaliation. While any form of retaliation is serious, some incidents of retaliation around the world have been grave, with serious and long-term personal and professional consequences for the individuals concerned. Though most companies maintain an anti-retaliation policy, it is essentially only passive prevention.
That’s where an integrated system matters. Assume the hotline and case manager system use the same core platform as the compliance insights system. Let’s also assume the disclosure management system—used for disclosures associated with conflicts of interest and gifts, travel and entertainment—is a component of the same integrated platform. With an integrated system of this sort, the organization could easily and immediately perform enhanced analysis and arrive at better insights, such as whether a hotline report had already been created about a conflict disclosed by an individual.
Other Procurement Considerations
The compliance function should also take these considerations into account when making a procurement decision:
Shared or dedicated? Sharing hotline numbers can be cost effective, but may prove disadvantageous in terms of operator experience and retention. In addition, moving to an alternative provider down the line can be particularly complex.
Data protection regulations
International companies with global operations may need to comply with a range of differing data privacy requirements. An experienced vendor can provide expert advice about ways to ensure the compliance operation isn’t compromised by a breach of the relevant prevailing regulations.
Some providers offer deep expertise in implementing hotlines and maximizing their benefit through employee communications and a host of other practical techniques.
Whistleblowing hotline buying guides tend to focus on reporting channels, service options, corporate philosophy, hotline processes, security and data protection issues. None addresses the issues facing companies wanting more than just a ‘tick-the-box’ approach to their hotline.
With more careful consideration, a well-chosen hotline—particularly an integrated one leveraging a range of data sources—can deliver significant additional benefits to the compliance program.
In the BT case, the fraud occurred over at least a three-year period. How long would it have continued without the intervention of a whistleblower?