effective case management: using reports & data to make a compliance difference
DESCRIPTION
An effective case management system can be an organization’s canary in the coal mine. To ensure that warning signs are recognized and allegation and incident reports are used to improve and assess compliance efforts, this session reviews the critical steps and best practices. We explore the best ways to capture, organize, plan, investigate, respond and analyze the reports from case management systems. Among other topics, we discuss: What reports belongs in the case management system Creating awareness and proper use of case management Roles and responsibilities of case managers How to analyze, report against and use the data you have collected to spot trends, successes and failures Attendees can expect to gain the tools and best practices to apply to their own case management systems, including how to increase the value their case management system provides to their organization. Presented by: Randy Stephens, Vice President, Ethical Leadership GroupTRANSCRIPT
CLIENT CONFERENCE
Using Reports and Data to Make a Real Compliance Difference
Effective Case Management
CLIENT CONFERENCE
CLIENT CONFERENCE
Agenda
Why you need a Case Management system
Maximizing the Case Management system
o Capture
o Organize
o Plan
o Investigate
o Respond
o Analyze
Take aways
o Creating Awareness
o Addressing Management Concerns
o Best Practices
2
CLIENT CONFERENCE
It Supports and Enables an
Effective Compliance Program
Why you need a Case Management
System
3
CLIENT CONFERENCE
Organizational Benefits of Case Management
Benefits include:
Provides an early warning of issues or problem
locations (some are 24/7/365)
Meets standards set forth in USFSG and OECD
Easy collection of all reported issues and events regardless of source (Helpline,
website portal, or through other methods such as open door conversations, exit
interviews, etc.)
Visibility into potential risk areas to your business via standard reporting and robust analytics
o May suggest training or policy opportunities
Mitigation of global risk through support for international data privacy regulations
Process consistency via configurable workflow automation and process controls
4
CLIENT CONFERENCE
Capture Organize
Plan
Investigate
Respond
Analyze
Maximizing the Case Management System
5
CLIENT CONFERENCE
Why is an Effective Intake/Management Process
Important to the Helpline Process?
Helps address problems before they progress
Increases employee trust in the process
Drives closure to investigations so employees understand that
problems are handled
Protects the company (and employees) through its contribution to
prevent, detect and correct misconduct
Reduces fear of retaliation through ongoing monitoring and prompt
handling of such allegations
Helps to prevent legal action against
the company for negligence
6
CLIENT CONFERENCE
Why is an Effective Intake/Management Process
Important to the Helpline Process?
Provides a confidential place for employees to clarify policy and discuss
or report concerns
Provides a communications channel beyond the rumor mill
Directs employee questions to the appropriate resource
Is an opportunity to provide guidance before a poor decision is made
Use of a third party provider may make employees more likely to call
and provide identity and more details
Is the last internal stop for whistleblowers!
7
CLIENT CONFERENCE
Important Elements of the Helpline
Process
Confidentiality and anti-
retaliation
Urgent Response or Escalation
requirements
Seemingly Out of Scope
Allegations
Requests for anonymity
Documenting credible concerns
Potential bad faith allegation
Keeping the Reporting
Employee informed
Managing and Closing the Case
Interviewing witnesses
Documenting interviews
8
CLIENT CONFERENCE
Protecting Confidentiality
Absolute confidentiality is very difficult to
guarantee.
Confidence built over time, but can be destroyed
by a single incident.
Follow “need to know” rule
The caller has a strict duty to keep the issue
confidential.
Investigators and witnesses must also keep
confidentiality.
9
CLIENT CONFERENCE
Protecting Confidentiality
Information obtained during intake, information from investigator and fact
that employee reported an allegation is confidential
May only share with designated officials
o Investigator
o Corporate Compliance Headquarters office
o General Counsel’s office
Exceptions to designated officials
o Prior consent of CCO, local Organizational Unit Head and/or Regional
General Counsel
o National laws require communication with government authorities,
without time to consult CCO
o Others who need to know
10
CLIENT CONFERENCE
Capturing Initial Allegations Who can report?
o Employee or ex-employee?
o Contractor?
o Supplier?
In-person initial report - proper locations for receipt
o Conference room without windows
o Somewhere away from other people
o Place where you cannot be overheard
Contact report from third party provider, e.g. GCS
o Telephone or Web report transmitted
Other Contacts
Postal mail
Inter-office
Fax
Phone call
Note under the door
11
CLIENT CONFERENCE
Capturing Initial Allegations
Case Management Format
o Ad hoc
o Excel
o Specialized, Dedicated Case Management system and resources
• In-house design
• Third party provider, e.g. Navex Global’s “Issue and Event Manger”
What’s in a name?
• Helpline, Check-in line, Alertline, Integrity Line …
Identified vs. Anonymous
EU and regional differences
12
CLIENT CONFERENCE
Seemingly Out of Scope Allegations
The Helpline process is intended for intake of all kinds of misconduct
Includes serious issues and those that seem less than serious, such as
general Human Resource issues
You may ask if they have tried another resources before calling you
Treat all callers with same professionalism
Often a caller will contact the Helpline with a more minor issue to see
how you handle it before bringing a more serious concern
13
CLIENT CONFERENCE
On a related matter… Your Code, Helpline
and EU Privacy Concerns
Beginning in 2007, several data protection and privacy laws and
cases, especially in Europe, have had a significant impact on
Helplines and what should and should not be said about them in
Codes and policies.
In light of these developments, it is necessary for organizations
with operations in the EU to add specific language to their
Codes, or provide supplemental material or links that include
specific guidance for employees in the EU.
14
CLIENT CONFERENCE
Regional Approaches to Issue Handling
Some countries have implemented rules regarding:
o Notification of Helpline implementation
o Third party operation of Helpline
o Anonymity
o Scope of reportable issues
o Confidentiality of information
• Permitting access to own information
• Limiting international transfer of information
• Local information storage and investigation of issues
• Short documentation retention periods
o Alleged violator’s right to due process
15
CLIENT CONFERENCE
Capture
Organize Plan
Investigate
Respond
Analyze
Maximizing the Case Management System
16
CLIENT CONFERENCE
Organize
Allegations
o Make the categories meaningful and reportable
• Conflicts of Interest – Financial
• Privacy
• Avoid “Miscellaneous” or “Other”
Report Sources
o Telephone
o Web
o Face to Face
Districts/Regions
Priority
Anonymous vs. Identified
17
CLIENT CONFERENCE
Capture
Organize
Plan Investigate
Respond
Analyze
Maximizing the Case Management System
18
CLIENT CONFERENCE
Plan
Define rolls
o Lead Case Manager
o Investigator
o View Only
Assignment Protocols
o Be consistent
o Address potential conflicts
• i.e. No fact finding or investigations of direct reports
Ensure handling by trained Case Managers and Investigators
o Avoid “on the job training”
Have targets for timing of assignments, investigations and closing
19
CLIENT CONFERENCE
Capture
Organize
Plan
Investigate Respond
Analyze
Maximizing the Case Management System
20
CLIENT CONFERENCE
Investigate
If time permits, please attend the session on Investigations delivered by Andy
Foose for an in-depth discussion of:
7 Steps to Investigate Alleged Employee Misconduct
Step 1: Decide Who Should Investigate
Step 2: Choose the Appropriate Investigator(s)
Step 3: Examine Documentary, Electronic & Physical Evidence
Step 4: Conduct and Document Your Interviews
Step 5: Reach a Conclusion and Write the Report
Step 6: Take Prompt Corrective Action
Step 7: Wrap Up and Handle Challenges from the Complainant and the Accused
21
CLIENT CONFERENCE
Capture
Organize
Plan
Investigate
Respond Analyze
Maximizing the Case Management System
22
CLIENT CONFERENCE
Respond
One of the most critical elements of the Helpline and Case Management System
Missteps at this juncture can undermine credibility in the program
Responses should be:
o Measured
o Consistent
o Timely
• Studies show that reporters want to feel heard
• May avoid external whistleblower contacts
23
CLIENT CONFERENCE
Ensure that the response is never retaliatory
Retaliation is a negative
action taken towards an
employee as a result of an
issue raised in good faith.
Retaliation is not when an
employee is being held
appropriately accountable for
performance or behavior.
24
CLIENT CONFERENCE
What is “retaliation?”
Employees say:
o Not greeting a coworker
o Poor work assignments
o Sudden changes in performance
reviews
o Lower than average raise or bonus
o No longer socializing with a coworker that called the Helpline
o Making derogatory comments about employees that reported
o Threats or verbal or physical abuse
25
CLIENT CONFERENCE
September 2012 Retaliation Survey Results
NAVEX Global™, conducted a September 2012 workplace retaliation
survey of ethics and compliance officers, human resources, internal
auditors, legal counsel and other senior executives. (For complete
results and to download a copy, go to www.navexglobal.com)
Highlights of the survey:
1. Organizations lack transparency when it comes to sharing ethics
and compliance data.
2. The definition of retaliation is maturing, both among senior
executives and employees.
• No longer just firings or demotions
3. Data is the key to improving ethics and compliance programs and
impacting the bottom line.
26
CLIENT CONFERENCE
Prevention: Develop Non-Retaliation Policy
Written prohibition against retaliation
Address sanctions for violators
Apply evenly and consistently
Included subtle and overt acts
More than a statement in the Code of
Conduct
Train for managers and employees
Communicate it!
Demonstrate it!
27
CLIENT CONFERENCE
Prevention: Training and Communications
Include a statement, or better, detailed
discussion of retaliation in training courses
Leadership statements and tone prohibiting
retaliation and reinforcing seriousness of non-
retaliation policy
Publish sanitized case studies dealing with
retaliation and describing actions taken
Build trust within the organization
28
CLIENT CONFERENCE
Monitoring for Retaliation
Assess likelihood of retaliation
o Investigation team assesses likelihood of retaliation for each participant in an
investigation
o Periodically ask high likelihood employees if they have experienced retaliation
Monitor key indicators
o Performance management documentation
o Compensation adjustments
o Disciplinary actions
o Performance improvement plans
o Demotions and transfers
o Planned terminations
o Resignations
o Job assignments and utilization
o Consider post report survey of reporter
29
CLIENT CONFERENCE
Capture
Organize
Plan
Investigate
Respond
Analyze
Maximizing the Case Management System
30
CLIENT CONFERENCE
The Missing Step Is…Business Analytics
Periodically analyze your issue/event data to identify any trends and patterns
1. Prevent violations 2. Avoid liability 3. Minimize fines
Data
Analysis
31
CLIENT CONFERENCE
The Missing Step Is…Business Analytics
Periodically analyzing your issue/event data to identify any trends and patterns
o Overlay employee engagement survey data points
o Are there allegation types that occur more frequently than you’d expect?
o Is there an issue type that has increased since the prior period (quarter/year/rolling 12-month average)?
o Are there locations or business units that have a disproportionate number of complaints?
• Overall
• Of a particular issue type
• High or low (both can be problematic)
o Do your investigations start promptly once an issue is received?
• How long does it take for an issue to be assigned once it’s been received?
• How long does it take for the investigator to open the assignment?
• How long does it take for the investigator to complete the investigation?
• Overall, by region, by issue type
32
CLIENT CONFERENCE
Data Analysis Illustrated
Periodically review incident data to identify trends or patterns
Depending on findings, revise policies, adjust structure, improve
training, make greater use of awareness materials and follow-up
training, etc. to help your program improve its results.
Data Analysis is far easier when all data is kept centrally and not
dispersed
o It’s even easier if you use a good case management system,
since that system will allow you to track investigation progress,
keep all relevant documentation, as well as analyze results
quickly and easily
33
CLIENT CONFERENCE
Track All Sources
34
CLIENT CONFERENCE
Source Summary
35
CLIENT CONFERENCE
Industry Benchmarking Measures
36
CLIENT CONFERENCE
Incident Summary
37
CLIENT CONFERENCE
Trending of Reports by Location
38
CLIENT CONFERENCE
Anonymity Over Time
39
CLIENT CONFERENCE
Case Duration Tracking Example
40
CLIENT CONFERENCE
Silos
Avoid the silo trap
o separate spreadsheets for each division because the divisions do not want other divisions to see their data.
• A good system will allow you to restrict access for each user
o Individuals who are only supposed to see particular locations or allegations, will only see those locations and allegations
Functionality like “Workgroups” allow you to group individuals together for the handling of particular issues (H.R., Legal etc.)
41
CLIENT CONFERENCE
• Assessing your Helpline
and Case Management
• Dealing with Management’s
concerns
• Advice and Best Practices
Take Aways
42
CLIENT CONFERENCE
Some Helpline Assessment Techniques
Internal audits of process and
documentation of random cases
Third party evaluations
Investigator statistics analysis
“Secret Shopper” call to Helpline
Helpline data analysis
CLIENT CONFERENCE
Deal with Management’s Helpline Fears
Anonymous calls
Vindictive callers
Personal agendas
Bad news – now what?
Answer shopping
Bypassing the
management chain
Gossip
Turf battles
44
CLIENT CONFERENCE
Some Advice and Best Practices
Use as a supplement to, not a substitute for, other communication channels
Avoid the use of references to “Helpline”
Offer advice and guidance as well as opportunity to
report
Monitor for retaliation
Protect the caller and the
accused equally
45
CLIENT CONFERENCE
More Advice and Best Practices
Commit to and conduct timely investigations
Be responsive – initial call back/initial resolution/final resolution
Ensure training and investigation protocols in place
Use matter tracking systems
Don’t refuse any types of calls
CLIENT CONFERENCE
Final Advice
Never assume anything
o “I know him and he is a good person”
Don’t discount anything
o “He’s a disgruntled employee.”
Remember, even a broken clock is right twice a day.
Train Case Managers and Investigator to never editorialize
o “Mr. X becomes angry easily. It will not take much to make him angry again.”
Documentation is your saving grace
o Accuracy
o Details
o Recollection later
It is difficult for most people to come forward to share a concern
o What’s important to one employee may seem trivial to you
Avoidance leads to escalation
Zero calls is not a good thing
Be vigilant about non-retaliation
47
CLIENT CONFERENCE
Other Virtual Conference Presentations of Interest
Unified Platforms and Ecosystems
Bob Conlin
Effective Workplace Investigations
Andy Foose
Policy Management Deep Dive
o Code of Conduct – Best Practices,
Ed Petry
CLIENT CONFERENCE
Questions?
Thank You
49