Merritt Cogswell retires at State Internal Auditor on August 31, 2005. Many chapter members were at a luncheon held for Mettitt on 7/14/05. His Hotline articles are still quite relevant.
Chapter Board of Governors and member, Merritt Cogswell, State Internal Auditor of the Commonwealth of Virginia, had articles entitled "Fraud, Waste, and Abuse Hotlines" published in Arthur Andersen's KnowledgeSpace and in MIS Training Institute's TransMISsion Online, Audit Edition, recently. [Fall 2001.]
*****************************************************************
FRAUD, WASTE, AND ABUSE HOTLINES
By Merritt Cogswell, CIA, CFE, State Internal Auditor, Commonwealth of Virginia
(c) TransMISsion Online, Audit Edition, Volume 2, Issue 4 . Reprinted with permission of MIS Training Institute http://www.MISti.com
According to statistics, 56% of the US workforce has seen a coworker violate a policy or the law, and 75% of all white-collar crime is committed by management. Fraud, waste, and abuse cost both public and private organizations billions of dollars each year. Fraud tends to get all the attention because it's criminal and, in many cases, highly profiled. But what about waste and abuse? Together, they can cost an organization as much as or even more than fraud. Combine all three, and it adds up to a lot of lost profits or taxpayer dollars. And once you bring the Internet, e-business, and electronic transactions into play, fraud, waste, and abuse can occur much faster, in greater numbers, and at higher dollar values than ever before.
Fighting Back
Included in an organization's first line of defense against fraud, waste, and abuse are the methods it uses to learn of inappropriate behavior from employees or others. One highly effective method is to put in place a fraud, waste, and abuse hotline so that inappropriate behavior can be reported. (It should also be noted that the Organizational Federal Sentencing Guidelines passed in 1991 strongly encourage the use of hotlines.)
If set up and managed properly, a hotline can be an effective deterrent to fraud, waste, and abuse by providing employees, customers, suppliers, and others with a means to report actual or perceived wrongdoing in the workplace. For our purposes, we'll use the Commonwealth of Virginia's definitions of the three exposures:
* Fraud: The intentional deception perpetrated by an individual or individuals, or an organization or organizations, either internal or external to state government, which could result in a tangible or intangible benefit to themselves, others, or the Commonwealth, or could cause detriment to others or the Commonwealth. Fraud includes a false representation of a matter of fact, whether by words or by conduct, by false or misleading statements, or by concealment of that which should have been disclosed, which deceives and is intended to deceive.
* Waste: The intentional or unintentional thoughtless or careless expenditure, consumption, mismanagement, use, or squandering of Commonwealth resources to the detriment or potential detriment of the Commonwealth. Waste also includes incurring unnecessary costs because of inefficient or ineffective practices, systems, or controls.
* Abuse: Excessive or improper use of a thing, or to employ something in a manner contrary to the natural or legal rules for its use; also the intentional destruction, diversion, manipulation, misapplication, maltreatment, or misuse of Commonwealth resources. Abuse can be the extravagant or excessive use of one's position or authority, and can occur in financial or non-financial settings.
Getting Started
Before you establish a hotline, your first consideration is the kind of hotline you want to operate. And before you can decide this, you have to know the kind of environment that permeates your organization. Is it one of strong ethics, control, and accountability, or is it prone to management override of controls? You have to know upfront what kind of support the hotline will get from senior management. In many cases management just doesn't want to know, or ignores the situation in the hope it will go away. On the other hand, organizations with the proper tone at the top and good organizational ethics policies, standards of conduct, and conflict of interest policies that are enforced tend to welcome internal audits and investigations into wrongdoing. The key is to have support at the highest levels of the organization. You need to have a clear charter for the hotline that you can use as support when you have to make unpopular recommendations, or when, as an investigator, you need to examine issues at high levels of the organization.
There are a number of ways that you can organize a hotline: fraud only; fraud, waste, and abuse; or any combination thereof. Do you want to limit it to employees only, or include suppliers and customers, or make it a citizens' hotline? Do you want it to be anonymous, or do you want callers to identify themselves? You have to think about the answers to these questions carefully because the resource and confidentiality requirements may be different. Anonymity may result in a greater number of frivolous calls, whereas a fraud-only hotline will have a reduced number of phone-ins.
Assuring Confidentiality
For a hotline to be effective, confidentiality is essential. It doesn't matter if it's an anonymous hotline or not. If people aren't protected or perceive they are being retaliated against because they called the hotline, then you lose credibility and they won't contact you. Confidentiality is important in order to protect callers and witnesses and to protect subjects' reputations. It is fair to say that if you are operating an anonymous fraud, waste, and abuse hotline, you will get a lot of baseless allegations. You also have to protect yourself from being used as someone's tool. To maintain the confidentiality and integrity of the hotline, you must conduct effective investigations, take adequate corrective action in substantiated cases, have good policies and procedures, and always protect identities.
Reporting Mechanisms
You must also decide how you will receive allegations. Here are some proven methods and the considerations you have to weigh:
* Telephone - You have to consider hours of operation; who will answer the calls; using a toll-free number; turning off caller ID; and whether or not to outsource the service.
* Mail - If your hotline is anonymous, you can't ask questions, so you may not get the information needed to conduct an effective investigation. The mail can be used for callers to send additional information or documentation.
* E-mail - It's traceable and insecure; however, it does provide some ability to ask questions. But if employees know they're being monitored, they may be reluctant to use e-mail.
* Web site - This is a viable option in today's virtual world, but there are significant security issues. You must have it designed to capture all appropriate information: who, what, when, where, how, how much, etc. Also, if your hotline is limited to employees, how do you control it? The advent of the Web and other means of communications creates a whole new set of confidentiality issues.
Investigating Allegations
A recent CFENET Newsletter article addressed the issue of internal investigations. One of its main topics was an employer's obligation to investigate when faced with signs or suspicions of employee wrongdoing. The employer/fraud examiner must decide whether to conduct an internal investigation of the alleged wrongdoing and whether to voluntarily disclose the results to law enforcement or other government agencies. Sometimes the decision to disclose the results of an investigation isn't voluntary; often, the law requires organizations to report wrongdoing by employees or officers, and these statutory and common law duties should be taken into account when deciding whether or not to conduct an internal investigation.
And despite what may seem like an organization's obvious desire to stop the thefts, possibly recover its losses, and take steps to prevent the illegal conduct from recurring, there are convincing arguments against conducting an internal investigation. First, when employee misconduct becomes public, the news has the potential to harm the company more than the losses from the theft itself. Second, the organization may have to face criminal or civil liability or administrative fines because of an employee's misconduct, and the results of an internal investigation may be subject to discovery in a civil or criminal case. In that case, the organization's internal investigation may unintentionally provide evidence that could be used against itself.
The Freedom of Information Act (FOIA) pertains primarily to those of us in the public sector, but if you have a FOIA regulation that you have to comply with, it's important that you have some protection. As is the case with many FOIA regulations, there are always certain areas that are exempt from disclosure. You should ensure that you have an exemption for the hotline, or the information that you can provide is limited. For instance, we have an exemption that limits the information we provide depending on whether the case is substantiated or unsubstantiated.
Manning the Hotline
Having an effective hotline means having experienced personnel to take calls and conduct the investigations. Staff needs sufficient investigative experience to be able to elicit enough information to conduct an effective and efficient investigation. The interview should not be rushed; staff must be trained to think about the situation and consider what could happen in that situation, how fraud could be perpetrated, and what information, documentation, policies, etc. might be available. Staff should then ask the caller those questions. Standardized questions for repeat situations are very helpful. Earlier in the article, I mentioned that with an anonymous hotline, organizations may get a lot of calls that are nothing more than someone trying to get back at someone else for some reason or other. It is important to be very careful not to judge motivations; the information users provide could still be very valid. The State Internal Auditor's Office has an anonymous hotline and we substantiate about 25% of the cases. Another 17% of the cases, although unsubstantiated, provide recommendations for improved controls, policies, or procedures.
When the integrity and confidentiality of the hotline process is maintained, a hotline is an effective deterrent to fraud, waste, and abuse. By giving employees and citizens a way to report suspected inappropriate behavior, an organization adds another layer of protection and can take advantage of every available set of eyes.
** About the Author: Merritt Cogswell, CIA, CFE, is the State Internal Auditor for the Commonwealth of Virginia, where he has statewide oversight responsibility for 42 agency internal auditing programs. His department administers the State Employee Fraud, Waste, and Abuse Hotline and provides audit and review services upon request. Mr. Cogswell is also responsible for the administering the training program for the internal audit community.
ADDENDUM: Merritt Cogswell has served as a member of the Board of Governors of the Central Virginia Chapter of The Institute of Internal Auditors for several years, and is an active, regular participant at IIA chapter functions.
*****************************************************************************
