TOP

hotline distrust

factors

leading to

Understanding why no one calls

Because of worldwide laws, hotline-reporting programs are ubiquitous. But many fail because employees don’t trust them. Here’s how to ensure you have a quality system that concerned employees will use without fear of retribution.

James Nordgaard, head trader at Paradigm Capital Management, was concerned. He saw some potential securities law violations at the company, and he couldn’t chalk it up to mistakes. On March 28, 2012, he made a whistleblower submission to the U.S. Securities and Exchange Commission (SEC) under the Dodd-Frank Act. And then on July 16, he notifed the frm’s founder and president plus the COO that he’d reported the violations to the SEC. That’s when Nordgaard’s troubles began.

On July 17, Paradigm told Nordgaard that it was temporarily reliev-ing him of his day-to-day trading and supervisory responsibilities. The frm later reassigned him as a “compliance assistant” to investigate the very conduct he reported as a whistleblower to the SEC.

By Ryan C. Hubbs, CFE, CIA, CCEP, PHR, CCSA; and Julia B. Kniesche, CFE, CPA, ACAMS

After the frm demoted Nordgaard, he worked some from home; Paradigm agreed to his request to use his per-

sonal email address for work business. But when he later sent a business report from his personal email account to

Paradigm’s CCO, the company told him that he’d violated the terms of his confdentiality agreement.

Nordgaard had had enough. He resigned on Aug. 17, 2012. On June 16, 2014, the SEC charged Paradigm and its

owner with engaging in prohibited principal transactions and then retaliating against Nordgaard. The company

agreed to pay $2.2 million to settle the charges. On April 28, 2015, the SEC announced a maximum whistleblower

award payment of $600,000 to Nordgaard in the agency’s frst retaliation case.

(See “SEC Announces Award to Whistleblower in First Retaliation Case,” April 28, 2015, http://tinyurl.com/

hh5tb86; “S.E.C. Fines Hedge Fund in Demotion of Whistle-Blowing Employee,” by Alexandra Stevenson, The New

York Times, June 16, 2014, http://tinyurl.com/ln7oy5y; “SEC Gives More Than $600,000 to Whistleblower in Retalia-

tion Case,” by Rachel Louise Ensign, The Wall Street Journal, April 28, 2015, http://tinyurl.com/jc5l8bh; and the SEC’s

charges, http://tinyurl.com/jskogd5.)

34 FRAUD MAGAZINE JULY/AUGUST 2016 FRAUD-MAGAZINE.COM

Top 10 factors leading to hotline distrust

When winning is losing

From the beginning of recorded history,

whistleblowers have been subject to false

allegations, retribution from manage-

ment and supervisors, and even dismiss-

al. Retaliation cases such as Nordgaard’s

give life to corporate phrases that haunt

potential whistleblowers: “kill the mes-

senger,” “pick your battles” and “career-

limiting moves.” Still, whistleblowers

are often driven by the motivation to

do the right thing so they can sleep at

night. And in the case of Paradigm, the

law not only provided the whistleblower

with support but also provided him with

fnancial compensation.

Bribes, payoffs and kickbacks are

often parts of doing business when cor-

porate cultures are focused more on win-

ning and hitting targets than operating

ethically. Even more alarming is that orga-

nizations’ cultures of silent complacency

will often dissuade ethical employees who

aren’t directly involved in misconduct to

not report problems.

Employees often ignore company

hotlines because they witness top man-

agement’s indiference to ethical business

conduct. When employees see manage-

ment retaliating against would-be whistle-

blowers, the message at the operational

level is clear: Mind your own business,

don’t ask questions and keep your head

down if you want to keep your job.

So when government investigations

ensue and signifcant fnes and penalties

are later levied, executive management

and the board ask, “Why didn’t anyone

report this sooner?” The answer is simple:

The focus on “winning at all costs” locally

results in a culture of noncompliance at all

levels. An ethics hotline reporting system

becomes meaningless when employees

can’t trust that local management will

take appropriate action.

Today’s guidance

The guidance and mandates for compa-

nies on hotline reporting programs are

numerous, overlapping and broad. The

U.S. Federal Sentencing Guidelines and

Sarbanes-Oxley Act, plus international

guidelines from the European Union,

stock exchanges and even the United Na-

tions deem reporting hotlines a necessary,

good business practice.

The U.S. Dodd-Frank Act, enacted

in July 2010, attempts to strengthen ac-

countability specifcally by providing pro-

tections for those who come forward as

whistleblowers but also allows regulators

to respond to misconduct through fnes

and legal actions.

While the goal of whistleblowing

hotlines might be to identify and correct

wrongdoing, they don’t guarantee suc-

cessful, efective and trustful programs.

Trust is the primary determining fac-

tor as to whether an employee will come

forward with a concern. Management

might try a quick-fx reaction to a messy

investigation with more hotline posters

or ask the CEO to use the word “compli-

ance” in every presentation or meeting.

But employees often view these ploys as

mere window dressing.

Organizations can use hotline-report-

ing program metrics and call volumes to

measure the overall usage, but the num-

bers don’t always tell the full story. Low call

volumes might indicate a lack of overall

trust in the program and not that employ-

ees have few problems to report.

Why is trust so important?

Employees might view the reporting of

concern via hotlines as potential “lose-

lose” scenarios. If an employee chooses

not to report, and an outside source

later discovers misconduct, the organi-

zation might face both fnancial losses

and reputational damage that it could

have avoided.

However, if the employee does report,

and the organization’s culture of trust is

lacking, he or she might face retaliation,

including termination. The employee

weighs these possibilities and decides

that remaining gainfully employed is the

better option.

According to the ACFE’s 2016 Report

to the Nations on Occupational Fraud and

Abuse, 39.5 percent of identifed frauds are

initially reported by tips. (See ACFE.com/

RTTN.) This suggests that organizations

operating inefective hotline reporting

programs risk failing to identify ongoing

frauds. If employees don’t feel comfortable

reporting fraud and corruption concerns

to the organization they simply won’t.

Some whistleblowers have said they

wished they’d never come forward. “Hell,

no, I wouldn’t do it again,” said William

Bush, an aerospace engineer in the Na-

tional Aeronautics and Space Administra-

tion (NASA). “I ruined my life, my wife’s

life. And I wouldn’t do it anonymously,

either. There is no protection whatsoever,”

he said, referring to continual harassment

and retaliation he received after whistle-

blowing on a private NASA directive.

(See “Whistleblowers: Who’s the Real

Bad Guy?” by Barbara Ettorre, American

Management Association, May 1, 1994,

http://tinyurl.com/hwy44md.)

Employees’ lack of trust in the report-

ing process also can create an unhealthy

work environment and eventually result

in organizational issues such as poor

employee performance and motivation,

employment lawsuits, legal and regu-

latory actions, loss of assets, external

whistleblower complaints, poor customer

perception or brand reputation, and high

employee-turnover costs.

Top 10 factors leading to distrust

Organizations can try to purchase or

fabricate employees’ trust by deploying

catchy phrases or slogans. However, from

the time an employee reports a concern

until the case is closed, an organization’s

reporting program must demonstrate

FRAUD-MAGAZINE.COM JULY/AUGUST 2016 FRAUD MAGAZINE 35

confdentiality, professionalism and fair-

ness. If an organization is continuously

faced with external whistleblower reports

or a lack of internal reporting by employ-

ees, management must consider where the

process might be broken and why employ-

ees believe the hotline reporting process

isn’t trustworthy.

These factors often cause a hotline

reporting process to be inefective:

1Employees don’t

understand the

system

“Who answers the hotline number?” “Will

they know that I fled a complaint if I fle

anonymously?” “Will they tell my boss that

I reported a concern?” and “Where does my

complaint go? And who reviews it?” These

are just some of the questions employees

might have. Doubt and uncertainty can

impede an employee’s decision to report

a concern. The more information an or-

ganization can share about the program

to increase transparency, the more likely

an employee might be to come forward.

2 Inadequate resources

and poor program

design

Organizations demonstrate they value the

reporting of concerns by spending money

on well-designed hotline programs with

professionally trained efcient respond-

ers and investigators, fully integrated case

management systems and all of the neces-

sary support tools and resources. Anything

less will engender employee mistrust.

3 Lack of personalization

of an employee’s

concern

Reporting a concern can be a very per-

sonal experience for an employee. The

whistleblower might be a victim, have

witnessed signifcant wrongdoing or be

taking a personal chance by coming for-

ward and doing the right thing. So if a

concerned employee only hears a recorded

message or an automated response (press

“1” for …) on the frst call, he or she (and

colleagues) might view the whole program

as machine-like and indiferent.

Qualifed and experienced compli-

ance or investigative professionals must

immediately follow up on reported con-

cerns. Concerned employees need support

and reassurance that they’ve done the right

thing, the organization will address their

concerns and they’ll be protected from

retaliation. An organization can achieve

this through a code of conduct that articu-

lates the expectation of behavior, including

ethics and compliance policies that com-

municate anti-retaliation commitments.

4 Improper handling

and lack of training

Mishandling of complaints and poor train-

ing of hotline call takers and investiga-

tors can cause a (1) Type I reporting error,

in which the organization conducts an

inadequate investigation and rules that

wrongdoing occurred when it didn’t or

a (2) Type II reporting error in which the

organization fails to act or investigate

when the concerned employee has cred-

ible information.

An example of a Type I error could

be a human resources professional ruling

that sexual harassment had taken place

when it didn’t. A Type II error could be

an investigator who wasn’t knowledge-

able enough to understand a complaint of

fnancial statement fraud and corruption

yet ultimately closes the case for “insuf-

fcient information.”

An organization can signifcantly re-

duce both of these error types and the as-

sociated risks when it includes skilled in-

vestigators early in the reporting process.

Employees who experience mishandled

complaints might share their dissatisfac-

tion with colleagues.

5 Management

involved in hotline

Because local frontline management

are rarely trained as investigators, they

shouldn’t help determine if an employee

concern has merit, is factual or warrants

a full-fedged investigation. Local man-

agement might be the problem or — at

the very least — might be complicit in

allowing the concerns to occur or go

unaddressed.

Local human resources profession-

als might also appear to employees to be

closely aligned with management. They

also might be inadequately trained and

show bias or favoritism.

To ensure transparency, indepen-

dence and objectivity, often it’s most ef-

fective to use a third party to administer

the hotline. (See “Six tips for building a

trusted hotline reporting program and

culture” on page 37 for more on out-

sourced programs.)

At the point when a concern becomes

part of an investigation the organization

36 FRAUD MAGAZINE JULY/AUGUST 2016 FRAUD-MAGAZINE.COM

Top 10 factors leading to hotline distrust

can involve management, including in-

ternal audit, compliance/legal and hu-

man resources — depending on the type

of complaint.

6 Too many reporting

mechanisms

Hotlines should be the primary entry point

for all concerns regardless of who reports

them or how organizations identify them.

Unfortunately, organizations who want to

ease the process encourage employees to

also alternatively report through email,

web portal, in writing or in person to such

departments or individuals as compliance,

internal audit, legal, employee relations,

safety, environmental, human resources,

ombudsmen, ethics ofcers, supervisors

and union steward. Confusing messages!

“Companies struggle to determine

exactly who owns the proactive and re-

active responses to fraud within their or-

ganizations,” write Dan Torpey, CPA; and

Mike Sherrod, CFE, CPA, in “Who owns

fraud?” in the January/February 2011 is-

sue of Fraud Magazine (http://tinyurl.com/

j7pedfx). “Confusion can reign, causing

a lack of trust in the proactive anti-fraud

program for management and employ-

ees, a dangerous defciency in sharing of

knowledge, and inefcient responses to

fraud,” Torpey and Sherrod write.

Anybody but trained hotline depart-

ment personnel might not understand

detailed, multiple-risk elements ranging

from a human resources issue to a po-

tential fnancial statement fraud. While

organizations may ofer reporting mecha-

nisms beyond just the centralized hotline

— such as a web-based reporting platform

for anonymous reporting — regardless

of how concerns are submitted, a profes-

sional, centralized, clearly articulated

program helps streamline reporting, in-

crease communication and awareness,

decrease confusion and build trust.

7Too much emphasis on

“credible” complaints

Employees fle fctitious and malicious

complaints against organizations and col-

leagues to fend of pending terminations,

get others into trouble or retaliate for some

perceived personal sleights. Unfortunately,

hotline program workers have to respond

to erroneous or malicious complaints.

Some organizations might attempt to

reduce meritless complaints by communi-

cating that employees should only report

“credible” or “good faith” complaints. Oth-

er organizations might go a step further by

saying that employees could be subject to

disciplinary action for fling complaints

that aren’t credible. However, tactics like

these — regardless of the trust level —

might dissuade employees from reporting

any concerns. “Credible” and “good faith”

are subjective terms that management

will evaluate.

Organizations’ best approach is to

encourage employees to report all issues

with no hint of the risk of disciplinary ac-

tion. If an organization feels a complaint

is without merit, it can document and dis-

miss it after it performs limited diligence.

8 Obstacles of negative

incidents and

retaliation

When an employee is mistreated for fol-

lowing the organization’s reporting policy,

the hotline program can sustain severe

damage to its credibility and viability as

a safe and secure mechanism. The dam-

age from mismanagement and reprisals

— immortalized on the internet, in court

records or public documents — can create

a devastating silent “do not report” culture.

Organizations should communicate

they have a zero tolerance policy for retali-

ation and will deal with it swiftly and pub-

licly. They might need to conduct ongoing

communications and awareness campaigns

to make programs as transparent and trust-

worthy as possible especially if employees

know about previous retaliations.

9 Inconsistent

outcomes

Organizations must demonstrate that

consistent and fair outcomes are routine

regardless of people, relationships or sce-

narios. Employees will learn through the

grapevine if the organization delivers fair

and consistent discipline, regardless of

how confdential the organization hides

investigation outcomes. Of course, if em-

ployees view outcomes as fair, they’ll feel

more compelled to report concerns. (And

the emphasis is on feel; these are emotional

decisions for employees.) Employees know

that inconsistency equals personal risk.

Actions speak

louder than

words10

Employees critique, judge and evaluate

what an organization says about its

FRAUD-MAGAZINE.COM JULY/AUGUST 2016 FRAUD MAGAZINE 37

hotline- reporting program by what it

does rather than what it says. Does it

follow policies and procedures as de-

signed? Does it really have a zero toler-

ance policy on retaliation? Are outcomes

really consistent, fair and proportionate?

Does it truly allow employees to report

concerns anonymously?

Six tips for building a trusted hotline

reporting program and culture

Organizations implement and maintain

trusted hotline reporting programs difer-

ently depending on their sizes, cultures,

geography and several other factors. And

they must decide if they’ll construct their

hotlines in-house or outsource them.

Organizations fnd many benefts to

outsourcing from experience and exper-

tise to the appearance of independence,

which can increase employees’ trust. Ho-

tline providers’ built-in frameworks allow

24/7 accessibility. And they normally ofer

services in many languages.

Smaller organizations might believe

that insourcing is the lower-cost option.

However, establishing an insourced pro-

gram requires investment in hardware,

software and personnel, among other costs.

As we say in factor No. 5 on page 35,

whether an organization’s hotline-report-

ing system is in-house or outsourced,

management must remain independent

and only should become involved if it be-

gins an investigation.

Outside consultants, including fraud

examiners, can help an organization de-

vise a fraud examination plan and help

implement continuous improvements

from lessons learned as cases are resolved.

These tips, which build on the previ-

ous top 10 factors, can help:

1. Training and awareness. Increased

awareness of the program will help

build employees’ confdence in it.

An organization should continu-

ally strive to help employees know

how the hotline-reporting program

works, why the organization believes

in it, who operates it and why it’s a

critical part of the compliance cul-

ture. Organizations should include

hotline frequently asked questions

(FAQs) and answers in all employee

new-hire and supervisor training.

2. Ongoing communication.

Communication about a hotline-

reporting program, recent compli-

ance issues and messages from

management should be routine and

commonplace.

3. Accessibility. Information on a

hotline program and how to report a

concern should be within one click

of the organization’s intranet or

external website. An organization

should communicate program in-

formation in as many languages as

necessary to provide coverage. Web-

based reporting platforms should

be available to facilitate anonymous

reporting and allow for the inclu-

sion of attachments.

4. Transparency. Prominently

display your organization’s hotline-

reporting and investigation process

including the expertise and contact

information of your trained inves-

tigators, what employees should

expect, plus the organization’s

responsibilities to cooperate and

protect against retaliation.

5. Profciency and objectivity. As

we’ve written above in the top dis-

trust factors, those who manage the

hotline and investigation processes

should be technically profcient,

professional, well trained and ex-

perienced in handling reporting of

concerns. The organization should

also install adequate systems, pro-

cesses and technologies to support

the investigators and, ultimately,

the employees. This includes con-

ducting an in-depth and routine

annual training program for the

organization’s investigative, legal,

human resources and compliance

staf.

6. Assessment. Ongoing assessments

should answer these questions:

› How do employees currently view

the hotline-reporting program and

corporate culture?

› Are the organization’s investigation

program and reporting structures

properly designed?

› Are the ethics hotline policies,

procedures and technology meeting

the needs of the organization and the

employees?

› Are investigations and the resulting

disciplinary actions consistent with

the organization’s desired culture of

compliance?

› Are independent reviews conducted

by internal audit or external profes-

sionals with oversight by an audit

committee?

› Are all complaints and resolutions

disclosed to and discussed with the

external auditors?

Trust, trust, trust

The Dodd-Frank Act pays awards to eli-

gible whistleblowers who voluntarily pro-

vide the Securities and Exchange Commis-

sion (SEC) with original information that

leads to a successful enforcement action

yielding monetary sanctions of more than

$1 million. The award amount is required

to be between 10 percent and 30 percent

of the total monetary sanctions collected

in the SEC’s action or any related action

such as in a criminal case. 

The table on page 38 shows the number

of whistleblower tips received by the SEC’s

Ofce of the Whistleblower since the incep-

tion of the whistleblower program in 2011.

critical part of the compliance cul- orga

Organizations should

communicate they

have a zero tolerance

policy for retaliation

and will deal with it

swiftly and publicly.

38 FRAUD MAGAZINE JULY/AUGUST 2016 FRAUD-MAGAZINE.COM

Top 10 factors leading to hotline distrust

(See the “2015 Annual Report to Congress on

the Dodd-Frank Whistleblower Program,”

http://tinyurl.com/p3k5gdj.) As we can see,

Dodd-Frank might encourage employees to

bypass internal reporting processes.

FY11* FY12 FY13 FY14 FY15

334 3,001 2,328 3,620 3,923

* Because the whistleblower rules became efective

Aug. 12, 2011, only seven weeks of whistleblower

data is available for fscal year 2011.

During fscal year 2015, the SEC’s Ofce of

the Whistleblower received almost 4,000

concerns — the most since the program’s

introduction. From fscal year 2012 — the

frst year for which full-year data was avail-

able — to fscal year 2015 the number of

whistleblower tips received by the SEC has

grown by more than 30 percent. So it’s in

an organization’s best interests for employ-

ees to frst report internally within quality

whistleblowing programs they can trust.

Most employees want to do the right

thing, and organizations need to do what

they can to help support and encourage

employees to report. Failures in employee

reporting today can result in signifcant

operational and reputational hurdles to-

morrow. If you use these recommended

tips to strengthen your program they

could help place your organization in a

position where it never has to ask itself

the question, “Why didn’t anyone call

before?” n FM

The views expressed here are those of the

authors and aren’t necessarily the views of Ernst

& Young LLP, EY or other EY member frms.

Ryan C. Hubbs, CFE, CIA, CCEP,

PHR, CCSA, is a senior manager, fraud

investigation and dispute services at

Ernst & Young LLP. He has more than

15 years of experience, has conducted

hundreds of corporate investigations

and thousands of employee interviews

in cases involving human resources

concerns; health, safety and environ-

mental events; compliance violations;

and fraud and corruption. His email

address is: Ryan.Hubbs@ey.com.

Julia B. Kniesche, CFE, CPA,

ACAMS, is a senior manager, fraud in-

vestigation and dispute services at Ernst

& Young LLP. She has more than nine

years of experience advising clients

on complex issues related to fnancial,

economic and accounting matters.

Kniesche has served large corpora-

tions, special committees, law frms

and governmental entities in conduct-

ing forensic accounting investigations

and risk assessments and advising on

dispute matters relating to fraud and

corruption. Her email address is:

Julia.Kniesche@ey.com.

Save time and money when you enroll in the Automatic Dues Renewal Service

• Receive a 10% discount on your ACFE dues

each year you are enrolled in the service.

• Your dues are automatically paid each year —

no need to write a check or pay online.

• No interruption of member benefts and services.

• Environmentally friendly — eliminate paper statements

and postage.

Automatic Dues Renewal

Visit ACFE.com/AutoDues and start saving today

Where Saving Time and Money Meet