A Whistleblower Line Is Not Enough

Norman Marks, CRMA, CPA, is an evangelist for better run business, focusing on corporate governance, risk management, internal audit, enterprise performance, and the value of information. The views expressed in this blog are his personal views and may not represent those of The IIA.

 

 

Surveys show that most frauds and other inappropriate acts are discovered through tips, such as through a whistleblower line.

Some feel they have done enough if they have a business conduct policy (that is updated regularly, signed by the CEO, and to which every employee must certify annually) and a whistleblower line (where all reports are handled by internal audit or other reliable group).

But those of us who have had responsibility for investigating violations of that business conduct policy know more is needed.

The Washington Post’s recent article on the Department of Veterans’ Affairs (VA) case includes useful insights:

“The Department of Veterans Affairs is encouraging its employees to expose any wrongdoing they see, but a series of government reports has shown that many federal employees are reluctant to do so–and possibly with good reason.

“Many federal employees feel vulnerable to retaliation if they make such disclosures, according to data from two central personnel agencies, the Office of Personnel Management and the Merit Systems Protection Board.”

This highlights the first additional step that has to be taken — addressing the fear, often justified, that those who report violations of the code of business conduct will find themselves at risk. As the Post says, “nearly 30 percent of respondents felt that their lives might become more difficult if they reported inappropriate practices.” The article goes on to say “of those who did step forward and were identified as the source of a disclosure, about a third said they were threatened with or actually experienced retaliation, compared with just 7 percent who were given credit by management for identifying a problem. Forms of reprisal included firing, suspension, grade level downgrade, and transfers to different locations or to jobs with less desirable duties.”

Management at the VA seems to feel that sending a memo urging employees to report problems and demanding that nobody retaliate is enough.

It is not enough.

Here are a few thoughts:

  1. Every employee must be able to report concerns anonymously. I was always troubled when management wrote the business conduct code at my companies where employees were asked to report concerns to their manager, or to HR, before using the whistleblower line.
  2. The whistleblower capability needs to take into consideration and be tailored to meet local legal, language, and cultural considerations. This means not only translating the code into different languages and having people take calls in the language of the caller, but making it easy for all employees, contractors, and others to make the call.
  3. Training and testing the understanding by employees of the code of conduct must be effective for all employees, recognizing the challenges of language and culture. Effective means that they understand what is meant by the code of business conduct, not just what the words say. It also means that they understand that the code represents the true intent of top management and the board.
  4. Every report must be taken seriously and looked into. I was shocked at a previous employer (I was not running internal audit there) when I called to report inappropriate behavior by my manager and others. The lawyer who took the call refused to do anything until I provided information that would identify one person, me, as the source; I knew that the information I had already provided would lead any investigation in the right direction. At another company, the HR director knew the individual reporting the violation (she came forward, bravely) and disparaged both her and her statement, saying he didn’t want to investigate her claims of harassment.
  5. Every effort must be taken by investigators to protect the identity of whistleblowers. That was one of my mantras when I performed or managed investigations, and it is not that hard to accomplish.
  6. It is important for people to know that their concerns are being investigated. If possible, they should know what the resolution was — although specific disciplinary actions should be kept confidential. While many will call in to the line anonymously, I always ask the people answering the call to encourage people to give us a way to communicate with them, or to ask them to call back.
  7. Organizations need to survey their employees annually, with questions that will determine how many identify violations and how many feel they can report them without fear. It is critical that the survey results be made public and management responses be decisive and also public.
  8. Those who retaliate or fail to support an investigation should be dealt with summarily.

I welcome your thoughts on this important topic.

Posted on Jul 7, 2014 by Norman Marks

Share This Article:    

  1. Thanks Norman. I could not agree more. My investigative experience also tells me that the timeliness of our responses is equally crucial in handling the reported incidents or claims. As investigator, It is noted that anytime more than one month or more in response of a claim would undermind the effectiveness of whistleblower hotline and cast a serious doubt the ability of investigative efforts. One of the reporters even joked us the alleged subject had been promoted and became a sales star when reporting the allegation 3 months ago, and ironically our investigative plan was still on review and discussion. If I was the reporter, I wouldn't do it again. This live story leads us to another challenging subject: timeliness of investigations.
  1.  For those of us who have investigated frauds we have seen our share of those noble (and not so noble) whistleblowers being retaliated against.  The two most common retaliatory tactics I have seen all too often is “Job performance takes a nose dive” and or the whistleblower is placed under a microscope for any “infraction of a vague policy”. Pretty soon they are out on administrative leave, and then terminated. They are then left to defend their good name against a giant machine that has both the time and the resources to quash the whistleblower.  As employment goes we all know the industry circles are small and if you are that whistleblower good luck in finding employment.  Most companies will reach out informally to the applicant’s former employer and will find out why they are no longer with that entity.  Companies espouse they love ethical people however they still perceive whistleblowers to be a “NON TEAM PLAYERS” and thus pass on them for the opportunity  no matter how qualified they are for that position.  So the majority of the whistleblowers are left with all or some of the following: 1 Loss of employment income,2 Mounting bills, 3 Credit damage, 4 Marital damage due to mounting income pressures and other stressors , 5 Massive legal fees (approximately 250k to take retaliation cases to court),  6 Bankruptcy, 7 Career change.

  1.  To me the issue is 3 fold,

    1)      Whistleblower laws are shamefully inadequate when it comes to those who retaliated, as it is not treated as a criminal offense.

    2)      Ethics appears to be a punch line than something to be valued. When the metal meets the meat, people often chose to sacrifice the whistleblower than the colleague or an executive.

    3)      Social support for the whistleblower is almost zero over all, for both government agency and even more so for private industry.

    Until we fundamentally change how we react to whistleblowers and how we ensure their safety things will not change. If we really think about it after all the lectures, books, articles and CPE’s based on ethics what has that really accomplished; personally I believe very little.

  1. The culture of the organisation in the boardroom and executive suite will determine if whistleblowing policies will work. Unless it is right at the top there is limited hope for the whistleblower. Stakeholders in companies and public sector organisations need to be really examining the governance culture at the top. Unless that is working the value of the organisation will drastically fall at some stage in the future. Instead of looking at the issue below (the employees) internal auditors/risk managers should be looking at the top first as that is where the big matters will stem from. Unfortunately they are not given the right permission to go there as it is to the top to whom they report!!! The stakeholders do not want the organisations they are associated with to be involved in fraud and corruption - unless they seek out/require truly independent review then it will continue to SURPRISE and DISAPPOINT them that it is happening.
  1. The culture of the organisation in the boardroom and executive suite will determine if whistleblowing policies will work. Unless it is right at the top there is limited hope for the whistleblower. Stakeholders in companies and public sector organisations need to be really examining the governance culture at the top. Unless that is working the value of the organisation will drastically fall at some stage in the future. Instead of looking at the issue below (the employees) internal auditors/risk managers should be looking at the top first as that is where the big matters will stem from. Unfortunately they are not given the right permission to go there as it is to the top to whom they report!!! The stakeholders do not want the organisations they are associated with to be involved in fraud and corruption - unless they seek out/require truly independent review then it will continue to SURPRISE and COST them that it is happening.

Leave a Reply