The importance of a business abuse line is to allow your employees to report wrongdoing to the organization in an anonymous and secure fashion. However, there is more to the existence of a business abuse or whistleblower line than just having a toll-free number. And the lack of such a tool can be harmful to your company’s well-being.
The recent headlines involving Penn State are most unfortunate. Although there is still much to be investigated and determined, it is apparent that many individuals had seen, heard and communicated to an individual, much of the misconduct involving Jerry Sandusky. I have always wondered during the trial and investigation if Penn State had a whistleblower line in place. If not, could the existence of one have revealed these issues sooner? If they did (do) have one, why was it not utilized?
A business abuse line can only be effective if properly implemented and administered. Simply having one in place is not enough to blanket a company with the ability to say they have a business abuse or whistleblower line. They must use it effectively to ensure incidents reported are properly recorded, investigated and responded to appropriately.
Focus on the following factors when implementing or administering a business abuse line.
The Intended Use of the Line
To have a successful whistleblower or business abuse line, its intended use must be clear to all and properly “marketed” to the employee population.
Is it going to be used for reporting business abuse or incident reporting (there is a difference)?
Define the business abuse categories so the line does not become a “catch-all” reporting line.
Market your line appropriately and according to the business abuse it is to be used for by employees. If need be, assign other “incident reporting” to a separate line or other means of communication.
Keeping incident reporting separate from business abuse/whistleblower lines will reduce the chance of diminishing the importance of the business abuse line and the urgency in follow up. When a call, message or email comes across from your abuse line it is viewed as urgent and requires follow up.
Additionally, when the line is used for Sarbanes-Oxley (SOX) reporting and compliance, the company needs to ensure that any calls made under the SOX (usually related to improper loans, insider trading, or other type securities violations) are being reviewed by employees not directly responsible for those financial areas. If Human Resources reports to Finance, for example, and SOX calls go to HR as part of the business abuse line, there will be a concern with SOX compliance. Some companies may keep SOX and business abuse lines separate if there are potential compliance issues.
Communication and Education
As mentioned previously, the mere existence of a business abuse line does not mean it will be utilized. Like any other program or initiative, your employees must be educated on it regularly and repeatedly. Here are some examples:
Make it part of the new employee orientation
Place information (e.g. posters) in strategic, high-traffic or highly visible areas
Provide every employee with personal, take-away information such as a wallet card or payroll statement message
Follow up regularly with multiple “marketing” efforts in company newsletters, regular email communication, etc.
Report Handling & Follow Up
The handling and follow up of a business abuse line call is most important to the success of your business abuse program and support of the line. These procedures need to be carefully established during implementation and regularly assessed for effectiveness, efficiency and compliance. Some best practices are:
Do not send all notifications to numerous people, hoping the right person will handle it.
Work with a provider who can categorize calls into call types. Set company contacts based on call type so the right person gets the call and you know who is responsible for initial acceptance and follow up.
If unable to categorize calls, limit the number of individuals who receive calls to approximately two. Let them disseminate the calls to the proper individuals. Make sure those who handle the initial calls are neutral enough to handle various types of reported calls.
Make certain all calls are properly recorded, logged and reviewed through the process of investigation and resolution.
If your system has a mechanism to follow up with a reporting party, do so. Informing them that the information has been received and is being followed up on (or resolved) is important and good for employee morale.
Document all investigations and resolutions to your calls. Review the summary of calls periodically to ensure calls are handled timely and properly.
A business abuse line is an important implementation for any company. But it is only part of the process. For it to be effective, successful and minimize risk, exposure and liability, it has to be implemented and administered properly.
Written by Tim Casey, CPP, CFI
Director of Corporate Services