Hot Tips for Hotlines

​A RETAIL CLERK, whom we’ll call Mary, was intrigued when she received an envelope in the mail from a large financial services provider. Inside the envelope was a W-2, which indicated that Mary had earned a total of $459.62 in compensation from the company the previous year. Mary was puzzled. She had applied for a position with the company many months earlier but did not get the job. Curious as to why she had received the statement of earnings, she telephoned the company’s headquarters and was directed to the company’s whistleblower hotline.

Based on Mary’s information, the company launched an internal investigation that uncovered the misdeeds of a district manager whom we’ll call Donald. Donald had access to employment application information and the company’s computerized personnel system. He also had the authority to approve hirings and termination decisions.

The company found that Donald was creating false employees. He then instructed the payroll department to give these workers’ paychecks to him so that he could disburse them. Donald endorsed each check by forging the fake employee’s name and depositing the money into his own account. Donald would then delete the false employee’s information from the personnel system. His scheme worked until he forgot to delete Mary’s information.

When the company investigated the hotline tip, it uncovered 12 more fake employees who had been paid thousands of dollars. The incident led to major changes in the company’s hiring, payroll, and paycheck distribution policies.

This real-life example clearly demonstrates the importance of a whistleblower hotline. The hotline, which should be available to employees, vendors, and the public at large, can provide a crucial mechanism for reporting fraud or other serious irregularities.

To establish an effective whistleblower system, companies should evaluate the level of service they need, offer periodic training, designate an employee to respond to complaints, develop a protocol to prioritize incidents, and report the results of their program to outside agencies.

Evaluation

The first step is to evaluate what level of service a company needs. A company can set up an in-house department to oversee the hotline or it can purchase a service from an outside vendor. In either case, the hotline program should include the same features.

A basic hotline program should consist of a toll-free telephone number, a means of doing initial analysis and classification for each complaint, reporting of each complaint by e-mail or other means, and monthly summaries of all complaints by category. The cost of these services from an outside vendor may range from 50 cents to one dollar per employee annually.

When purchasing a service, companies should be aware that a program with low fees may be little more than a message system that prompts the callers to state concerns and optionally leave their names and call-back numbers. While this type of system can offer savings, the chief disadvantage is if the complainant needs to be contacted and fails to provide contact information.

The more sophisticated systems include call center employees who are available to answer the phone around the clock. These employees should be trained in hotline interview techniques and should use a detailed questionnaire to guide the interview process.

Callers should be encouraged to identify themselves and provide contact information so that further information could be obtained if an investigation is initiated. The caller’s identity should be kept confidential.

Training

Companies should offer periodic employee training and education about the existence of the hotline once it is established. Methods for publicizing a hotline include annual messages from senior executives emphasizing the company’s support for the program and printed messages on pay statements advising employees of the hotline. The outreach program must emphasize that any caller’s identity will remain anonymous and that no one will face retaliation for reporting information.

Companies should also make sure that vendors’ employees are aware of the hotline. The company can use vendor invoices, personal correspondence, company letterhead, and other literature to get that message out. Increased vendor awareness may help uncover bribes, kickbacks, and theft of intellectual property.

Training can make all the difference in cases where a trusted employee is breaking the rules. The anonymity of a hotline can provide the distance an employee needs to report a coworker’s misdeeds. For example, a local business using a third-party hotline service received an anonymous call that the company accounting manager appeared to be demonstrating some classic signs of financial difficulty. The caller reported that the manager frequently attempted to borrow money from coworkers, received daily telephone calls from collection agencies, and often referred to his extensive gambling losses. The caller also identified several unverified accounting entries relating to a series of cash disbursements to a vendor.

As a result of the hotline call, an audit was performed. The audit confirmed that the accounting manager had misappropriated more than $80,000 in company funds over three years without detection. The accounting manager admitted to the thefts, lost his job, and was sentenced to prison. He was also ordered to make full restitution of the embezzled funds.

Because this manager had been a trusted, well-liked employee, he had been allowed to circumvent traditional controls designed to ensure that there was an adequate separation of duties in the authorization, payment, and recording of financial transactions. The company’s well-publicized hotline, however, convinced one employee to provide the information necessary to uncover this fraud.

Investigate

Companies should establish an independent point of contact to review, investigate, and report allegations received through the hotline. Depending on the size and nature of the business, that contact may be an ethics or compliance officer, a head of security, or a director of investigative services. Regardless of the title, the designee must have access to the CEO, audit committee, or owner and must be free of the layers of management that might block the flow of information between this independent investigator and the decision makers, such as the audit committee.

Prioritize

A critical part of any hotline program is a protocol for prioritizing. This step should include drafting a corporate policy setting out who is notified following a hotline call. In some cases—especially those that may result in immediate harm to employees, clients, customers, or members of the public—immediate notification is required. Fraud, employee misconduct, tips involving the code of ethical conduct, and accounting irregularities are other high-priority classifications. Additionally, allegations of employee discrimination that may cause the company to be in violation of state or federal law must get priority.

Report

Companies must periodically report hotline results directly to audit committees, directors, and internal and external auditors. Reports should include discussion of calls concerning allegations of fraud, embezzlement, accounting irregularities, management misconduct, employee discrimination, violations of the company’s code of conduct, and other violations of law. These reports allow a company to demonstrate that it vigorously supports its hotline program. They also ensure that audit committees and boards of directors are aware of problems that may indicate a need for more oversight or tighter protocols.

The procedures provide proof that the company is in compliance with the Sarbanes-Oxley Act, which requires that all publicly owned companies establish procedures to provide a confidential, anonymous process for reporting issues of fraud or other improprieties.

Some problems uncovered via hotline reports may require disclosure to the government and shareholders, cooperation with law enforcement officials and prosecutors, and appropriate administrative actions related to employees and executives found to be in violation of the law. Companies should also consider informing the employee population about investigator’s results.

According to the Report to the Nation on Occupational Fraud and Abuse released in 2008 by the Association of Certified Fraud Examiners (ACFE), tips have historically been the most common means of detecting fraud. The survey found that more than 46 percent of the occupational fraud cases were initiated through tips; a 12 percent increase over the 2006 results.

The most recent report concluded that increased emphasis by businesses on promoting and monitoring whistleblower reporting systems has significantly increased the effectiveness of these programs in the detection of fraud.

Whistleblower hotlines can help any type of business root out fraud and abuse. Companies can be successful if they take time to evaluate what type of service they need, conduct periodic training, assign an employee to oversee the program, prioritize complaints, and report the results of their program to outside agencies.

Frederick J. Cantz Jr., CPA, CFE, is director, financial and operational audits, for the University of Medicine and Dentistry of New Jersey in Newark, New Jersey. He is a member of the ASIS International Economic Crime Council.