(For related information on communicating about a Help or Hotline see "Hotline Communication")
Before communicating about the existence of a hotline, the organization first needs to answer several procedural questions about what will take place once the “phone” rings. There are a number of choices, potentially involving multiple areas outside the compliance function. Once decided, the best practice is to memorialize those choices in a formal policy and procedure document that can be published to the organization at large and, if necessary, produced for regulatory review.
As in all policy writing, clarity will increase the likelihood of the agreed to process working in actual operation. Transparency about the chosen process will increase the likelihood that callers will pick up the phone. Does your hotline policy answer each of these questions?
A. Who will answer the calls?
There are two basic alternatives and one hybrid model that have been used by others.
Some organizations “answer” the hotline internally through the compliance office or a voicemail system. The advantage of inhouse, live answering is that it may be possible to provide answers to inquiry calls during the first interaction – that’s both efficient and builds the credibility of the Compliance function as a resource. That value is diminished or lost in a “voice mail” set up or if the function is not sufficiently staffed to be able to answer the majority of incoming calls in person. Inhouse answering may also make anonymity more difficult. There may be an additional cost to lease or develop a case management system in which multiple individuals document reports, investigations and resolutions.
Many organizations now use an outside vendor to provide 24/7 live person answering. These services are available at varying rates, often include multilingual capacity and use trained staff comfortable with asking follow-up questions. A mechanism for the reporter to call back and get a message back from the organization is usually included. There may be a greater belief in the possibility of true anonymity with outsourced services. There’s also the availability of escalation based on the content of the call – so a truly urgent matter doesn’t “sit” on voicemail. These services also usually include the possibility of reporting via an Internet portal – a significant benefit for reporters when the organization operates 24/7 or across multiple time zones. A web based case management system is usually a bundled part of the service.
A hybrid model is used by some, with a hotline that is answered by inhouse staff during business hours and forwarded to the vendor on nights and weekends.
B. Who will triage reports for further action?
There is an essential triage function as part of operating a hotline. Some calls may be simple requests for information; others may allege serious misconduct. The organization needs to determine who will conduct the triage and then provide sufficient staffing to support it. In many organizations this role falls to the Compliance / Ethics / Integrity function. Others have used and do use:
Human resources
General Counsel / legal department
Hotline Triage Team with representatives from various departments
Compliance / Ethics Committee
Vendor categorizes calls and triages to identified contacts within the organization
C. Who responds by providing information / investigating / documenting the result ?
Besides the Compliance function, other departments that have been tasked with this role are Internal Audit, HR, Security, Legal, IT. Sears and Roebuck used an interesting model in which HR triaged reports back to involved District Managers for investigation. Potential retaliation was checked with an annual survey about employee views of management.
D. What’s the investigation protocol?
The organization should set expectations for (a) a response to the caller, (b) completion of preliminary investigation, and (c) completion of investigations. If too long passes without a response or obvious action, the caller believes that s/he is being ignored and becomes less likely to call again or convince others to do so. Standard times include 2 days for an immediate response, 30 days for a completed investigation – but your setting may require faster resolution.
E. Where will the activity and outcome be documented?
The organization should consider developing or purchasing a case management system which allows “assignment” of particular cases to investigators and documentation of what takes place in response to each report. Whether the chosen system is electronic or manual, the records should be included in the organizations’ routine document destruction plan.
F. Who ensures that follow-up occurs?
Follow-up is as essential as triage. The organization needs to assign responsibility and authority to make sure that it follows whatever process it has chosen to implement.
G. What, if anything, will be measured?
Metrics are easy to generate – difficult to interpret – for this type of process. Those collected by others include:
Total number of contacts (including inquiries, requests for guidance and information)
Number of inquiries vs. allegations
Issue types and trends in level, location, type of issue, etc.
Where the calls refer to (areas of the organization)
Route of submission (phone vs. Internet)
Number of anonymous calls (as a percentage of calls)
Percent of substantiated allegations
Types of follow-up action taken
Timely case closure times
Internal benchmark data should be kept and evaluated along with knowledge of what events may have affected the numbers – for example a recent training effort or publicly known investigation. External benchmark data is difficult to obtain, but may be available from a vendor contracted to provide the call service. Someone will surely ask “are we getting ‘enough’ calls?”
H. Who will know what is reported?
At what level of detail? Generally summary data is presented on a routine basis to those in the organization responsible for Compliance and Ethics, including a management committee and a Board level committee. Statistics and high level examples should be shared with the whole organization to increase the perception that taking the risk to report results in action.
(For related information on communicating about a Help or Hotline see "Hotline Communication")
Before communicating about the existence of a hotline, the organization first needs to answer several procedural questions about what will take place once the “phone” rings. There are a number of choices, potentially involving multiple areas outside the compliance function. Once decided, the best practice is to memorialize those choices in a formal policy and procedure document that can be published to the organization at large and, if necessary, produced for regulatory review.
As in all policy writing, clarity will increase the likelihood of the agreed to process working in actual operation. Transparency about the chosen process will increase the likelihood that callers will pick up the phone. Does your hotline policy answer each of these questions?
A. Who will answer the calls?
There are two basic alternatives and one hybrid model that have been used by others.
Some organizations “answer” the hotline internally through the compliance office or a voicemail system. The advantage of inhouse, live answering is that it may be possible to provide answers to inquiry calls during the first interaction – that’s both efficient and builds the credibility of the Compliance function as a resource. That value is diminished or lost in a “voice mail” set up or if the function is not sufficiently staffed to be able to answer the majority of incoming calls in person. Inhouse answering may also make anonymity more difficult. There may be an additional cost to lease or develop a case management system in which multiple individuals document reports, investigations and resolutions.
Many organizations now use an outside vendor to provide 24/7 live person answering. These services are available at varying rates, often include multilingual capacity and use trained staff comfortable with asking follow-up questions. A mechanism for the reporter to call back and get a message back from the organization is usually included. There may be a greater belief in the possibility of true anonymity with outsourced services. There’s also the availability of escalation based on the content of the call – so a truly urgent matter doesn’t “sit” on voicemail. These services also usually include the possibility of reporting via an Internet portal – a significant benefit for reporters when the organization operates 24/7 or across multiple time zones. A web based case management system is usually a bundled part of the service.
A hybrid model is used by some, with a hotline that is answered by inhouse staff during business hours and forwarded to the vendor on nights and weekends.
B. Who will triage reports for further action?
There is an essential triage function as part of operating a hotline. Some calls may be simple requests for information; others may allege serious misconduct. The organization needs to determine who will conduct the triage and then provide sufficient staffing to support it. In many organizations this role falls to the Compliance / Ethics / Integrity function. Others have used and do use:
Human resources
General Counsel / legal department
Hotline Triage Team with representatives from various departments
Compliance / Ethics Committee
Vendor categorizes calls and triages to identified contacts within the organization
C. Who responds by providing information / investigating / documenting the result ?
Besides the Compliance function, other departments that have been tasked with this role are Internal Audit, HR, Security, Legal, IT. Sears and Roebuck used an interesting model in which HR triaged reports back to involved District Managers for investigation. Potential retaliation was checked with an annual survey about employee views of management.
D. What’s the investigation protocol?
The organization should set expectations for (a) a response to the caller, (b) completion of preliminary investigation, and (c) completion of investigations. If too long passes without a response or obvious action, the caller believes that s/he is being ignored and becomes less likely to call again or convince others to do so. Standard times include 2 days for an immediate response, 30 days for a completed investigation – but your setting may require faster resolution.
E. Where will the activity and outcome be documented?
The organization should consider developing or purchasing a case management system which allows “assignment” of particular cases to investigators and documentation of what takes place in response to each report. Whether the chosen system is electronic or manual, the records should be included in the organizations’ routine document destruction plan.
F. Who ensures that follow-up occurs?
Follow-up is as essential as triage. The organization needs to assign responsibility and authority to make sure that it follows whatever process it has chosen to implement.
G. What, if anything, will be measured?
Metrics are easy to generate – difficult to interpret – for this type of process. Those collected by others include:
Total number of contacts (including inquiries, requests for guidance and information)
Number of inquiries vs. allegations
Issue types and trends in level, location, type of issue, etc.
Where the calls refer to (areas of the organization)
Route of submission (phone vs. Internet)
Number of anonymous calls (as a percentage of calls)
Percent of substantiated allegations
Types of follow-up action taken
Timely case closure times
Internal benchmark data should be kept and evaluated along with knowledge of what events may have affected the numbers – for example a recent training effort or publicly known investigation. External benchmark data is difficult to obtain, but may be available from a vendor contracted to provide the call service. Someone will surely ask “are we getting ‘enough’ calls?”
H. Who will know what is reported?
At what level of detail? Generally summary data is presented on a routine basis to those in the organization responsible for Compliance and Ethics, including a management committee and a Board level committee. Statistics and high level examples should be shared with the whole organization to increase the perception that taking the risk to report results in action.
Choices Made by Others:
Brody School of Medicine policy
Flowserve FAQS for Employees
Lourdes Health System policy
Maricopa Integrated Health System Hotline Poster
Medical University of South Carolina Compliance Plan, including "Reporting Compliance Issues"
Texas Tech has a Hotline Policy and an Investigations Policy
Unity Bank PLC has a procedure
University of Rochester Medical Center policy
UT Health Science Center at Houston policy
Compliance Hotlines in European and US Companies (Corporate Executive Board 2003) (includes examples from Sears, Honeywell, Guidant and Cingular Wireless)
Usage Reports:
PepsiCo actively promotes and reports usage of its “Speak Up” hotline – It had a steady rate of 10 calls per thousand employees as of 2010. Here are the 2011 results and 2012
Tullow Oil shared the 2012 statistics for its "Safecall"
Sulzer has posted quite of bit of detail on its 2011 and 2012 results
Operating Performance of the Yamaha Compliance Hotline (April 2010 to March 2013)
University of Florida's hotline call results in 2011 (page 14)
KPMG's Hotline in 2008 (page 17 - also includes examples of matters reported)
Additional Hotline Operation Resources on the Web:
Practice Note: Corporate Whistleblowing Hotlines and EU Protection Laws (Cooper and Marttila)
Tips on Hotline Security (Kusserow 2013)
The Flaws of Whistleblower Hotlines and Rewards (Kelly 2012)
Corporate Governance and Benchmarking Report (The Network 2012 )(released annually, registration required)
What Is Your Magic Number? Creation, Implementation and Administration of a Hotline (Fox 2012)
An Employer's Guide to Implementing an EU Compliant Whistleblowing Hotline (Sussman 2011)
Making It Safe to Report Wrongdoing (Tamburri 2010) (includes organizational alternatives to hotlines)
Whistleblowing in the Australian Public Sector (report of the Whistling While They Work Project)
Building an Effective Whistleblower Program (Cantz 2008)
Benchmarking: Maximizing the Benefit of Hotline Data (Penman, Global Compliance, 2008)
Best Practices in Ethics Hotlines (Malone and Childs, The Network 2008)
Six Key Elements of an Effective Hotline (Childers, Ethicspoint, 2006)
Guidance on Implementing a Fraud Hotline (FDIC 2005)
Hotline Pros and Cons (Showalter 2003)
Tips on Using Hotline Data (Peterson, SAI Global )(video)
Federal Fraud Hotline Operations (GAO 1989)
SHARED by Toolbox members:
< Click "edit" above and start typing here>