Sarbanes-Oxley has turned the attention of top management to a loss prevention standard, the anonymous hotline.
Twenty years ago, the concept of providing an anonymous, third-party hotline for reporting theft and other abuses was a tough sell. Fortunately, a handful of progressive loss prevention professionals, primarily in the retail and food service industries, were able to convince their companies to buy this new tool. Over the next ten years, hotlines gained acceptance as peers shared success stories.
By the early 1990s, most retailers large enough to have a loss prevention professional had a theft hotline of some type. Even as hotlines became widespread, it was rare for a company to promote the hotline to home office employees, and it was certainly not a topic on the agenda for the board of directors.
Hotlines have truly come a long way. Corporate scandals like Enron, WorldCom, and Tyco inspired the Sarbanes-Oxley Act, and hotlines became a hot topic. Sarbanes-Oxley’s whistle blower protection language requires publicly traded companies to offer employees a process for reporting financial irregularities while remaining anonymous. In this legislation, congress acknowledges the value of anonymity in enabling employees to take action to end a cycle of wrongdoing, especially if it is perpetrated at the highest levels of the organization. Anonymous hotlines open a unique line of communication that enables management to learn from front-line employees about all the many issues that threaten profitability or your corporate reputation.
Sarbanes-Oxley has created a new wave of interest in hotlines, driven by the boards of directors. Loss prevention professionals are likely to be the most knowledgeable managers in the company regarding best practices in offering a hotline that will achieve a variety of corporate objectives.
The situation becomes more complex as finance, legal, human resources, and audit join loss prevention as consumers of information provided through an anonymous hotline. Loss prevention is likely to have the most experience managing an effective hotline, making this an apt time to think about best practices in operating an anonymous reporting mechanism.
Hotlines 101
The most effective way to learn about internal theft or fraud is to provide employees, suppliers, and other stake holders with a variety of methods for reporting their concerns about illegal behavior. Interactive communication, like a face-to-face conversation or a hotline interview, generates more detailed information than one-way communication, like an anonymous note. While some individuals may feel comfortable coming forward through an open-door policy, others may not. The hesitation some employees feel about revealing their identity may be due to fear of retaliation for reporting a peer or manager. In these situations, the hotline interview is the best option for the company, because an interview conducted by an experienced interviewer results in the most actionable information possible.
When many shrink cases are investigated, it is learned early on in the investigation that coworkers were aware that something was not right and had information that could have led to earlier detection of the fraud. What was not present within these organizations was a hotline.
The lack of a hotline allows for illegal activities to go undetected longer and increases the magnitude of the loss. According to the Association of Certified Fraud Examiners (ACFE) 2002 Report to the Nation, fraud that is reported via a tip resulted in losses that were 50 percent less than fraud that was detected via other methods. This is presumably because the fraud schemes were uncovered at an earlier point via the inside information. The ACFE also reports that the leading method for detecting fraud is a tip from an employee, a supplier, or another interested party. Clearly fostering tips is in the best interest of every retailer.
Sarbanes-Oxley has changed the nature of managing anonymous communication channels. What was once the domain of loss prevention has now become a broader effort involving legal counsel, auditors, and the board of directors.
As you consider options for opening lines of communication between employees and loss prevention, there are many questions you should ask that will help you implement an effective procedure.
Do you have an anonymous hotline?
Although theft hotlines are a proven tool for loss prevention, there are some chains that still do not have an anonymous hotline. An open-door policy and a suggestion box are both good ideas, but they are not enough. The financial investment in a hotline is small in comparison to the potentially disastrous results of malfeasance that continues undiscovered. Beyond the obvious financial benefit of stopping fraud in its early stages, a hotline can give the company the opportunity to limit liability regarding offenses such as discrimination. Finally, in the case of a white-collar crime, uncovering and dealing with issues before they are exposed in the media can protect the company’s reputation from a disastrous blow.
Is the hotline run professionally and answered by a trained interviewer?
Many companies set up a hotline number that is routed to a junior employee or a voice mailbox somewhere in the company. There are several issues with this solution. The most serious is that employees may not be comfortable calling an internal number, because they may fear their identity will be traced. Other issues include inconsistent handling of sensitive calls and callers encountering voicemail. An anonymous caller is generally fearful and cautious about leaving a recorded message. If they do leave a message, it is likely to lack important details that enable the company to investigate the allegation. If the caller is reporting a Sarbanes-Oxley issue, such as audit irregularities, an internal hotline leaves the company vulnerable to charges of covering up an issue involving management.
There is no substitute for human interaction when dealing with an anonymous caller, because there may never be another chance to gather the information. An anonymous caller may feel threatened and be in an emotionally charged state. Because of this, he or she tends to give information in a disorganized manner and is likely to leave out details that will help you investigate the allegation. A professional interviewer will ask questions that help the company gain enough information to be able to investigate. The goal should be to get complete and accurate information during the interview, so that you can conduct a meaningful investigation of the allegation.
Are complaints received around the clock?
To be effective, hotline callers must reach a live interviewer 24 hours a day, 365 days a year. Nearly 50 percent of hotline calls happen outside of regular business hours, and these calls deserve the full attention of an experienced interviewer. Many employees can’t or don’t want to call from work, and they won’t usually leave a message. So the best way to ensure your hotline yields quality information is to have a professional interviewer available to answer the call 24/7.
How many hotline numbers do you really need?
Many retailers are finding themselves in the situation of having multiple hotlines that employees use to report different issues. For example, there may be one phone number for reporting harassment, another for reporting theft, and a third for safety issues. Multiple numbers are typically difficult to communicate and confusing to employees. They may not understand which number to call for the issue that concerns them, so employees will use whichever hotline number they know to report any issue that makes them uncomfortable.
Offering one hotline for a host of complaints makes communication simple for callers. At the same time it reduces the burden of communicating about the hotline. A professional hotline provider should be able to automatically disseminate reports to different departments within your organization based on the type of issue reported, so that the appropriate people learn quickly about complaints that pertain to their area.
Issues like discrimination and sexual harassment are high-liability situations that need to be addressed rapidly. If you offer a theft hotline that turns away these calls because “this isn’t the right number to call,” you may alienate the employee, who has made the difficult decision to take action. Most companies prefer to learn about any high-liability issue as early as possible, so damage control can begin and potential legal action can be averted. Simply having a general ethics hotline in place gives the company an opportunity to limit their liability regarding offenses such as harassment or discrimination.
Do employees know their options for reporting illegal or unethical activities?
A common failing of an ethics program is insufficient communication to employees about their options for reporting issues. They must be periodically reminded of open-door policies, ethics officers and ombudsmen, and the anonymous hotline number. It is important to provide options for reporting illegal activities and then to make sure they are aware of those options. For retail organizations, where turnover is a constant challenge, communication must be repeated several times a year, and should be a permanent topic for new employee orientation.
Do employees know which behaviors are not acceptable?
A comprehensive hotline program includes frequent communication to employees about the behaviors that are unacceptable. Posters in break rooms, articles in employee newsletters, and pages on corporate intranet sites all help to create awareness of ethical issues and act as a preventative device. This communication reinforces the employee’s perception that the company wants to know about illegal and unethical activities, and helps an employee decide to make the call.
Employees may need special communication from the company that explains the nature of issues related to shrink. Define terms like “time-card fraud” and “kickbacks,” which may not be clear to all employees. If your hotline is intended to support Sarbanes-Oxley compliance, you should create educational tools that clarify what activities constitute falsification of company records, accounting irregularities, and insider trading. Finally, emphasize that the Sarbanes-Oxley Act makes it illegal for the company to retaliate against an employee who reports accounting or audit irregularities. The new law includes substantial penalties for executives found guilty of whistle blower retaliation, including sentences of up to ten years in prison.
Should the hotline offer rewards for information?
Employees are motivated to speak up about illegal activities if they know they can be rewarded for doing so. It is interesting to note that not all hotline callers are anonymous. Approximately 50 percent of hotline callers give their names, and roughly one-third of hotline callers report they have previously informed management of the situation. These callers use the hotline as an additional mechanism for reporting issues they feel have not been handled adequately through face-to-face reporting. If a problem of shrinkage persists and management has not acted upon internal reports, the offer of a reward can only be more encouragement for the concerned employee to report any wrong doing.
A properly communicated and managed reward program can be highly effective. Consider the case of one leading national retailer that recently conducted a compelling test of rewards. They offered two different hotline numbers, one offering a reward for information and the other without rewards. The company’s hotline provider managed the reward program so that anonymity could be preserved throughout the entire cycle of paying out the reward. The hotline with the reward program showed the average dollar amount for each case uncovered increased by 250 percent. The reward program has now been implemented across the entire chain.
What levels of management should be notified about allegations?
One of the most important aspects of having a hotline is deciding where to send information that is received. If you are expanding your LP hotline to handle Sarbanes-Oxley issues, dissemination of reports becomes a very sensitive issue. Top management found guilty of retaliating against a whistle blower facestiff penalties. Report dissemination procedures should protect employees from retaliation and protect management from accusations of improper handling of the investigation.
To ensure that allegations reach the right people, rather than being intercepted and covered up, hotline incident reports can be automatically routed to one or multiple members of management within the corporate structure. A report dissemination routine should be set up with the hotline administrator so that the appropriate investigators receive reports of theft or shrink.
Dual dissemination can help ensure complaints don’t fall through the cracks. A system of dual dissemination involves having an ethics or compliance officer receive copies of all reports as a secondary layer of dissemination, beyond the report sent to the person responsible for investigation. For example, reports of internal theft would be sent to a designated loss prevention manager as the primary recipient of the information, with a copy to the ethics officer as the secondary recipient. Dual dissemination acts as a protective device in case a report is sent to the accused party. If a report is received by only one person, and that person has a motive for preventing an investigation, the system is vulnerable.
Anonymous hotlines open a unique line of communication that enables management to learn from front-line employees about all the many issues that threaten profitability or your corporate reputation.
Is there a process for sending questions to anonymous callers after they hang up?
The critical issue when dealing with an anonymous caller is gathering enough information to begin an investigation. One of the most important aspects of an anonymous hotline is a process in which the caller is given a unique code that correlates to his or her report and is asked to call back after a predetermined interval. This enables the employee to call back to offer additional information while maintaining anonymity. This also gives investigators a chance to review the information and provide questions that will be asked of the caller if he or she calls back as agreed. This process can be very helpful as an investigation unfolds. While the call-back process can enhance an investigation, roughly two thirds of anonymous callers never callback, so the quality of every interview is of critical importance.
How do we document our response to a tip, especially if it is a Sarbanes-Oxley issue?
The Sarbanes-Oxley Act requires a process for the “retention and treatment” of complaints of financial irregularities. It is important to understand the company will continue to receive anonymous information through a variety of channels, including voice messages, letters, and faxes. Information received through any channel should be funneled to the same people who receive hotline reports. Ideally, this information should be maintained in the same case management system with hotline reports to provide insight into all issues reported, regardless of the source. Given the risks of failing to comply with this legislation, now is probably a good time to review how you document investigations. If you don’t already have a centralized case management system for documenting investigations, your hotline administrator can provide a tool that will make it easy for all investigators to document activities in a single system, improving the consistency of your documentation.
Should we publicize the hotline to anyone other than employees?
The short answer is yes. Hotlines area well-established tool for detecting illegal activities, and the best return on investment from a hotline will come from spreading a wide net. If the company is being swindled by a supplier, chances are there are employees working for the supplier who know about it and are bothered by the illegal activity. Listing the hotline number on checks issued to suppliers is an inexpensive action that has helped other companies uncover fraud.
Loss prevention professionals are likely to be the most knowledgeable managers in the company regarding best practices in offering a hotline that will achieve a variety of corporate objectives.
In the same vein, investors may be aware of a corrupt buyer who receives kickbacks from a vendor, and publishing the hotline number offers them a convenient way to communicate to the board. Informing investors about a hotline number tells them you’ve complied with this aspect of Sarbanes-Oxley and validates the company’s commitment to uncovering fraud.
The ultimate goal is to give employees, suppliers, and other stakeholders every possible means for coming forward, so they report information to top management or to the board of directors, rather than turning to the media. The hotline will likely uncover more sensitive situations from employees than are reported face-to-face, but it is far better to learn about these situations from a hotline than from a surprising telephone call to the CEO, or worse, from a newspaper headline. When a concern is reported internally, the company can investigate and take corrective action, potentially avoiding the additional threat of devastating negative publicity.
What is the best way to launch a hotline?
Like any new initiative, a hotline will be destined to fail if it is not launched properly. The initial communication should include an announcement by top management about the goals of the program and the reason for implementing it. Employees should be told that the company is providing every opportunity to report problems and that the information will be sent to top management and/or to the board of directors. Information about the program should be posted on the company’s intranet site, in break rooms, and should be introduced in face-to-face meetings wherever practical. Every employee in the company should receive a letter or flyer announcing the program, and ideally this packet should include a business card that they can keep in a wallet or purse as a reminder of the phone number. New employees must receive this information as part of their orientation.
Finally, the purpose of the hotline program should be mentioned in periodic “refresher” communications. An experienced hotline provider will be able to assist you in developing effective messages and vehicles for launching the hotline, and can develop a plan that is appropriate based on the unique needs of your organization. Planning for ongoing communication should happen at the inception of a hotline, to ensure that awareness of this communications tool remains strong. If reminder messages are not included in the initial launch plan, the program will lose steam.
Are time-sensitive incidents promptly disseminated?
Although many hotline reports do not require immediate notice 24/7, sometimes high-risk situations are reported that dictate immediate response. These incidents or allegations should be considered prior to hotline implementation, so the management team has a shared understanding of how such a situation will be handled. Procedures that must be followed when time-sensitive issues are reported should be set up during the planning stages. The group responsible for setting up the hotline must agree upon a list of issues that are sufficiently critical to require immediate notification 24 hours a day.
Reports generally resulting in immediate notification include:
- Threat of physical harm to employees or customers,
- Threat of business interruption, and
- Notice that a high-risk incident is expected to happen within the next 24 hours.
A comprehensive hotline program includes frequent communication to employees about the behaviors that are unacceptable.
When a report is designated for escalation, the hotline provider should call company representatives immediately by referring to predetermined list of key contacts’ home and cell phone numbers. In the case of a report received at 11 p.m. on a Friday night, immediate notification enables the company to take preventative action rather than discover the report on Monday morning, which may be too late to address the issue.
The key to effective fraud prevention is not just quick detection, but rapid response to reported incidents. Waiting until the next business day is not the practical way to address incidents. Any delay allows for the potential loss of evidence. For example, if an employee was reported for having plans to pick up stolen merchandise that was earlier placed in a dumpster, local police could be notified after the report was escalated. If the incident is addressed the next business day, the thief has the time to pick up the stolen goods as originally planned.
Sarbanes-Oxley has changed the nature of managing anonymous communication channels. What was once the domain of loss prevention has now become a broader effort involving legal counsel, auditors, and the board of directors. This cross-functional group would do well to heed the advice of experienced LP professionals as they establish channels of communication for employees who wish to remain anonymous.