(For related information on communicating about a Help or Hotline see "Hotline Communication")

Before communicating about the existence of a hotline, the organization first needs to answer several procedural questions about what will take place once the “phone” rings. There are a number of choices, potentially involving multiple areas outside the compliance function. Once decided, the best practice is to memorialize those choices in a formal policy and procedure document that can be published to the organization at large and, if necessary, produced for regulatory review.

As in all policy writing, clarity will increase the likelihood of the agreed to process working in actual operation. Transparency about the chosen process will increase the likelihood that callers will pick up the phone. Does your hotline policy answer each of these questions?

A. Who will answer the calls?

There are two basic alternatives and one hybrid model that have been used by others.

  • Some organizations “answer” the hotline internally through the compliance office or a voicemail system. The advantage of inhouse, live answering is that it may be possible to provide answers to inquiry calls during the first interaction – that’s both efficient and builds the credibility of the Compliance function as a resource. That value is diminished or lost in a “voice mail” set up or if the function is not sufficiently staffed to be able to answer the majority of incoming calls in person. Inhouse answering may also make anonymity more difficult. There may be an additional cost to lease or develop a case management system in which multiple individuals document reports, investigations and resolutions.

  • Many organizations now use an outside vendor to provide 24/7 live person answering. These services are available at varying rates, often include multilingual capacity and use trained staff comfortable with asking follow-up questions. A mechanism for the reporter to call back and get a message back from the organization is usually included. There may be a greater belief in the possibility of true anonymity with outsourced services. There’s also the availability of escalation based on the content of the call – so a truly urgent matter doesn’t “sit” on voicemail. These services also usually include the possibility of reporting via an Internet portal – a significant benefit for reporters when the organization operates 24/7 or across multiple time zones. A web based case management system is usually a bundled part of the service.

  • A hybrid model is used by some, with a hotline that is answered by inhouse staff during business hours and forwarded to the vendor on nights and weekends.

B. Who will triage reports for further action?

There is an essential triage function as part of operating a hotline. Some calls may be simple requests for information; others may allege serious misconduct. The organization needs to determine who will conduct the triage and then provide sufficient staffing to support it. In many organizations this role falls to the Compliance / Ethics / Integrity function. Others have used and do use:

  • Human resources

  • General Counsel / legal department

  • Hotline Triage Team with representatives from various departments

  • Compliance / Ethics Committee

  • Vendor categorizes calls and triages to identified contacts within the organization

C. Who responds by providing information / investigating / documenting the result ?

Besides the Compliance function, other departments that have been tasked with this role are Internal Audit, HR, Security, Legal, IT. Sears and Roebuck used an interesting model in which HR triaged reports back to involved District Managers for investigation. Potential retaliation was checked with an annual survey about employee views of management.

D. What’s the investigation protocol?

The organization should set expectations for (a) a response to the caller, (b) completion of preliminary investigation, and (c) completion of investigations. If too long passes without a response or obvious action, the caller believes that s/he is being ignored and becomes less likely to call again or convince others to do so. Standard times include 2 days for an immediate response, 30 days for a completed investigation – but your setting may require faster resolution.

E. Where will the activity and outcome be documented?

The organization should consider developing or purchasing a case management system which allows “assignment” of particular cases to investigators and documentation of what takes place in response to each report. Whether the chosen system is electronic or manual, the records should be included in the organizations’ routine document destruction plan.

F. Who ensures that follow-up occurs?

Follow-up is as essential as triage. The organization needs to assign responsibility and authority to make sure that it follows whatever process it has chosen to implement.

G. What, if anything, will be measured?

Metrics are easy to generate – difficult to interpret – for this type of process. Those collected by others include:

  • Total number of contacts (including inquiries, requests for guidance and information)

  • Number of inquiries vs. allegations

  • Issue types and trends in level, location, type of issue, etc.

  • Where the calls refer to (areas of the organization)

  • Route of submission (phone vs. Internet)

  • Number of anonymous calls (as a percentage of calls)

  • Percent of substantiated allegations

  • Types of follow-up action taken

  • Timely case closure times

Internal benchmark data should be kept and evaluated along with knowledge of what events may have affected the numbers – for example a recent training effort or publicly known investigation. External benchmark data is difficult to obtain, but may be available from a vendor contracted to provide the call service. Someone will surely ask “are we getting ‘enough’ calls?”

H. Who will know what is reported?

At what level of detail? Generally summary data is presented on a routine basis to those in the organization responsible for Compliance and Ethics, including a management committee and a Board level committee. Statistics and high level examples should be shared with the whole organization to increase the perception that taking the risk to report results in action.

Choices Made by Others:

Usage Reports:

Additional Hotline Operation Resources on the Web:

SHARED by Toolbox members:

  • < Click "edit" above and start typing here>