As the use of whistleblower programs continues to grow, many organizations find themselves struggling to manage burgeoning caseloads. As a result, serious fraud investigations can be delayed (with mounting losses) while less consequential complaints are being investigated. The lack of a timely, systematic, and repeatable process for evaluating and prioritizing whistleblower tips that contain allegations of ethical breaches can also expose an organization to increased regulatory risk.
While there is no single “right” method for following up on whistleblower complaints, the most effective approaches often resemble the medical triage programs that hospitals and first responders use to allocate limited resources during emergencies or crises.
Here are some useful guidelines for designing and implementing a fraud triage system.
The Growing Use of Whistleblower Programs
Despite extensive fraud detection measures, closer management scrutiny, and increasingly sophisticated technology, the most common fraud detection method is still the simplest: somebody notices something suspicious and decides to speak up. According to the Association of Certified Fraud Examiners’ (ACFE) 2020 Report to the Nations on Occupational Fraud and Abuse, more than 40.0% of the cases reported in their study were uncovered as the result of tips (usually from an employee, supplier, or customer) —more than internal audit 15% and management review 12% combined.
The ACFE study also demonstrates that dedicated reporting hotlines are particularly effective. In organizations where such hotlines were in place, 49.0 % of the cases reported were uncovered through tips, compared with only 31.0% percent of the cases in organizations without hotlines. These results are consistent with patterns that have been recorded in the ACFE’s biennial survey since its inception 20 years ago.
In approximately 33% of cases where a tip was made, the whistleblowers did not use a formal reporting mechanism. Instead, they reported their suspicions directly to supervisors, investigators, or other interested persons. Source: ACFE
On a broader scale, as a matter of best practice, the COSO Internal Control-Integrated Framework and various other enterprise risk management (ERM) frameworks and guidance from the Institute of Internal Auditors (IIA) also emphasizes the importance of establishing and maintaining effective whistleblower programs.
In addition to their demonstrated effectiveness, whistleblower programs have also been promoted through recent regulatory actions. For example, one section of the Dodd-Frank Wall Street Reform and Consumer Protection Act directs the Securities and Exchange Commission to make monetary awards to individuals who voluntarily provide information leading to successful enforcement actions that result in monetary sanctions over $1 million.
A few years earlier, the Sarbanes-Oxley Act of 2002 required the audit committees of publicly traded companies to establish procedures to enable employees to submit confidential, anonymous information regarding fraudulent financial reporting activities.
Dodd-Frank and Sarbanes-Oxley are only two examples out of a broad range of laws that encourage – and often mandate – whistleblower programs. A 2013 study by the Congressional Research Service found no fewer than 40 federal whistleblower and anti-retaliation laws, designed to protect employees who report misconduct. Eleven of those 40 laws were enacted after 1999.
On February 21, 2018, the U.S. Supreme Court issued an opinion in Digital Realty Trust, Inc. v. Somers. This long-anticipated case clarifies who is protected as a “whistleblower” under the Dodd-Frank Act’s anti-retaliation provisions. It states that to qualify as a “whistleblower” under Dodd-Frank, individuals now have a clear incentive to report all sorts of observations to the SEC before reporting those observations through their company’s internal reporting infrastructure.
Under Dodd-Frank, an individual is only protected from retaliation if he or she has reported potential violations to the SEC before they separate from the company.
Such laws not only make whistleblower programs more common, but they also make the timely resolution of tips even more critical, as we are about to explain.
Responding to Tips – Why Timeliness Matters
Dodd-Frank, Sarbanes-Oxley, and the various regulatory structures that were established to implement them are helping to mold a corporate environment where undervalued and under-appreciated compliance professionals and in-house counsel are incentivized to “blow the whistle.” Such incentives can help create a self-regulating environment, but they also make it essential that corporations establish a timely and effective process for remediating complaints.
For example, to carry out its mandate under Dodd-Frank, the SEC established a separate Office of the Whistleblower. Since the beginning of the whistleblower program, the Commission has awarded approximately $387 million to 67 individuals. Despite an unusual year challenged by a lapse in appropriations, in FY 2019, the SEC awarded roughly $60 million in whistleblower awards to eight individuals whose information and cooperation assisted the Commission in bringing successful enforcement actions. Three award recipients in FY 2019 were located abroad or reported conduct that was occurring abroad, demonstrating the international reach of the program.
In FY 2019, the Commission received more than 5,200 tips, its second-largest number of whistleblower tips in a fiscal year. It made its third-largest award to date—a $37 million award to a whistleblower who provided significant evidence and assistance that enabled the agency to bring the matter to an efficient and successful resolution. This award followed a $50 million award to joint claimants in March 2018 and a $39 million award to a whistleblower in September 2018.
Under this program, there are exceptions if at least 120 days have passed either since the auditor (excluding external auditors who obtained the information during the audit of an issuer) or accountant properly disclosed the information internally (to their supervisor or to another person in the organization who is responsible for remedying the violation (i.e., the audit committee, chief legal officer, chief compliance officer, or their equivalents), or since they obtained the information under the circumstances indicating that the entity’s officers already knew of the information. Then they can report the lapse directly to the SEC and be eligible for a sizable whistleblower award – from 10 percent to 30 percent of any fines or sanctions that are collected. The program’s website prominently features headlines such as “SEC Issues $17 Million Whistleblower Award” and “SEC Awards More Than $5 Million to Whistleblower,” to cite only two of many recent examples.
Since the inception of the Whistleblower Program, the SEC has ordered wrongdoers in enforcement matters brought with information from meritorious whistleblowers to pay over $2 billion in total monetary sanctions, including more than $1 billion in disgorgement of ill-gotten gains and interest, of which almost $500 million has been, or is scheduled to be, returned to harmed investors.
With incentives like that, it should be no surprise that whistleblower complaints are on the rise. Yet in most cases, such awards would not have been available if the companies involved had resolved the initial fraud complaints within 120 days.
Unfortunately, our experience indicates that, while many companies invest in tips hotlines and similar whistleblower programs, a large portion of them fail to invest adequately in an allegation review process for promptly evaluating, prioritizing, and responding to the whistleblowers’ tips in a systematic, repeatable, and defensible manner. As the number of tips grows and investigators’ caseloads expand, complaints end up sitting in a queue waiting to be investigated. Simultaneously, the company remains vulnerable to the risks the tipsters were warning about, and the SEC timeline is running.
A 2020 study of customers of the compliance software company NAVEX Global found that Case Closure times had blipped up to 45 days from 40 days in 2018. This metric is important given that, under specific agency whistleblower provisions, an organization will have limited time to complete an internal investigation.
Moreover, when the various fraud cases are compared, cases involving suspected accounting, auditing, and financial reporting fraud took the longest to resolve by far – 56 days!
In other words, the average case closure time for cases of suspected financial fraud was almost halfway to the 120-day deadline – the point at which employees are incentivized to report the case directly to the SEC and expose the company to additional, sizable sanctions.
Hidden and Direct Costs of Delayed Response
Even setting aside potential SEC sanctions, delays in investigating whistleblower tips are costly in other ways. Delayed responses to tips can cause employees and other potential sources to lose confidence in the hotline or other whistleblower program, undermining the effectiveness of the compliance and ethics program and adding further complexity to the risk management effort.
Most companies expend considerable time, effort, and resources in creating compliance and ethics programs. Failing to establish a system for dealing with allegations or tips promptly can mean those expenditures are probably wasted.
There are also direct costs associated with delays in handling tips. The losses resulting from a fraud scheme are directly related to how long the scheme goes on. The ACFE’s 2020 Report to the Nations found that the median losses for frauds that were uncovered in six months or less was $50,000. But at the other end of the scale, schemes lasting more than five years caused a median loss of $740,000. Simply put, the longer perpetrators can continue, the more financial harm they can cause.
The absence of an effective program for handling whistleblower complaints promptly and effectively can have a significant and direct financial impact – in addition to the regulatory, employee relations, and reputational risks such a shortcoming entails.
A Triage Approach
While there is no single, one-size-fits-all method for following up on whistleblower complaints, the most effective approaches are similar in many ways to medical triage programs, such as those implemented by hospitals and first responders during emergencies to help medical professionals prioritize the treatment of patients.
In medical triage, those with severe, life-threatening injuries are treated ahead of those whose conditions are less severe. Similarly, a fraud triage program helps risk, audit, and fraud professionals prioritize the investigation of tips and whistleblower complaints. Those that indicate serious, material risks are addressed differently and more aggressively than those that reflect mere misunderstandings, minor errors, personal grievances, or false tips, all of which could tie up investigators unnecessarily.
Under a fraud triage program, the same principles apply. Hotline tips or complaints that do not indicate fraudulent behavior can be delegated to human resources, IT, or other line or support functions capable of handling them more efficiently. Meanwhile, complaints that involve suspected fraud but which are less significant in terms of financial losses, control failures, or other risks may be set aside temporarily. At the same time, larger, more material cases receive immediate attention.
Proper Staging of the Allegation – the Critical First Step
A swift and thorough triage process leads directly to a more appropriate and timely response. The specifics of that response will vary, of course, depending on the nature and severity of the case. Still, the fundamental elements of the treatment include forming the right team to investigate, understanding root causes, and providing timely disclosure to all constituencies.
Before such a response can be planned and executed, however, the tip or allegation must be evaluated or “staged” based on a consistent set of criteria. Navigant’s fraud governance framework identifies five such stages:
Stage1 allegations have a low threat level and do not suggest a breakdown of internal controls. Tips that get grouped into this stage do not have a financial or reputational impact. These may include employee-to-employee disputes, isolated cases of small-scale employee theft, normal policy complaints, misunderstandings, and personal disagreements that are often raised through a whistleblower program.
In most cases, these complaints are best handled by human resources or management personnel. Note: Human Resources and management should be trained on proper investigation protocols, including the escalation process. A basic level of review should be performed and documented to corroborate that no further investigation is warranted. A branch or office manager could perform this review and documentation. For an employee who is the target of such a complaint, management should consider placing such an employee on a temporary legal hold, which triggers the retention of email and other documents until the risk of retaliatory litigation has passed.
These allegations are more severe and often indicate some deficiency in the design of internal controls. Examples include business rule violations such as recurring employee theft or patterns of falsifying expense reports. If the allegation is substantiated, then the result of the remediation process is a change to a business process or business rule, followed by an enhancement of the company’s preventive or detective internal controls.
Because they indicate a deficiency in internal controls, such allegations are escalated to the internal audit function to understand the control environment better. Internal audit should evaluate what controls are currently in place and determine where the internal controls’ breakdown occurred.
It is also important to assess if the allegations are signs of a bigger problem or if they could have an impact on financial reporting. If financial reporting is affected, sensitivity testing must be performed to calculate the low case, medium case, and worst-case financial impact.
Internal audit’s review also might identify multiple violations. Again, the employees affected should be put into a legal hold, which triggers the retention of email and other documents until the risk of litigation passes. In some cases, employee termination may be warranted.
These allegations are serious, generally involve an override of internal controls, and thus are at a minimum a severe deficiency. But they have only a minimal impact on the financial statements or the company’s reputation. More severe allegations in this category include fraud, embezzlement, and bribery involving employees or mid-level management.
Such cases require the same level of investigation as Stage 2 cases, along with an internal investigation that usually is conducted under the direction of the general counsel, involving compliance and internal audit. In some instances, the investigation might need to be performed independently by a function or person not directly involved in the control environment.
These are serious allegations that could have an impact on the completeness and accuracy of the audited financial statements, and that could indicate a material weakness in internal controls. They do not, however, appear to involve any member of the senior management team.
Such cases are generally addressed through an internal investigation, usually under the direction of outside counsel operating under privilege. The investigation often involves the use of independent, outside experts as well.
These are serious allegations that involve one or more members of the senior management team or are severe enough to damage the company’s reputation. The receipt of allegations in this stage usually places the company into crisis management mode and could result in the restatement of audited financial statements or added regulatory scrutiny.
In such instances, the board generally should engage outside counsel and forensic investigation experts to initiate a privileged and confidential fact-based investigation. The external auditors may also be involved, and disclosure to the SEC may be required.
It’s important to note that, in both Stage 4 and Stage 5, engaging outside experts is generally necessary. Other critical elements of Stage 4 and Stage 5 responses include having a qualified and experienced investigation team, along with a time-phased work plan that minimizes disruptions to the organization’s day-to-day business as much as possible.
The investigators will begin with fact-finding interviews to help them evaluate who else to interview and when. The investigators will also help the company identify a list of custodians who will be interviewed to understand where their data was being saved (for example, on email servers, mobile phones, or other devices, flash drives, cloud servers, and network folders).
Generally, a large-scale data collection effort will then ensue to search and preserve all potentially relevant information. The goal is to determine who knew what and when, and how high up the chain the knowledge went.
The investigation will also assess if the audited financial statements be relied upon, so that counsel and board members can determine what disclosure requirements might apply. Also, where internal control issues are noted, outside counsel can recommend and assist in recommending new or enhanced policies, procedures, and controls.
Ownership, Responsibility, and Follow-Up
The triage staging system described here is not the only plausible methodology an organization can use for evaluating allegations of wrongdoing and planning appropriate responses. Other thought leaders in the field have proposed evaluating tips according to various other criteria such as the severity of the allegation, the specificity of the information it contains, and similar factors.
Ultimately, whatever triage process and framework is chosen, it will need to be customized to reflect the company’s particular situation and its specific industry. In many instances, boards may choose to combine elements from several approaches.
Regardless of the specific criteria upon which the system is based, the importance of maintaining written policies and procedures cannot be overstated. Moreover, but in all cases, it is important that the responsibility for developing, implementing, and maintaining the triage response system be clearly defined.
The assignment of this responsibility will vary as well, depending on the size and nature of the organization, its governance structure, the volume of whistleblower complaints, and other factors. It could fall to internal audit, compliance, the corporate general counsel, a board committee, a designee of the CFO, or some other person or group – but in all cases, it’s essential to have a designated individual or business function that is responsible for initially capturing complaints and performing the triage o the allegation(s).
Once the framework is set, and data is being collected, it’s also important to step back and periodically assess what the data is saying. For example, if the complaint hotline is bombarded with a high frequency of inconsequential complaints related to minor personnel disputes, uniform violations, or employees complaining about having to work a holiday, it may be time to provide additional training on how the complaint hotline is to be used.
An increase in sexual harassment complaints or complaints related to substandard working conditions could provide an early warning of a potential leading indicator for a class action lawsuit. Similarly, an increasing number of reports of low-dollar employee theft are usually signs of a larger cultural problem.
A study states individual behaviors in crises do not correspond to everyday life behaviors, which makes sense. One example many of us can relate to is the 2008 Financial Crisis. During the Financial Crisis, behaviors like anxiety, fear, confusion, and disbelief, pushed some to make poor decisions and cross ethical boundaries.
For a variety of reasons, individuals may overlook ethical violations and not report the alleged bad behavior.
Don’t ignore exit interviews regardless if they need to be conducted remotely. Employees exiting might have some interesting things to share, including overriding of controls, or worse, misconduct!
Here are some questions I like to ask during an exit interview:
- What can we do to make the organization better?
- Do you have any hesitation raising issues or concerns about ethics, compliance, or other practices? If yes, why?
- If your issue was not being addressed, would you seek out other higher ranking folks with the hope they would listen and take action?
- Do you know we have a code of conduct? Do you think others know, and if they do, are they living up to it?
- Are you aware of any ethical lapses or fraud in the organization? If yes, please explain.
Evaluating the data and trends captured in your complaint system can help you make decisions that could prevent the next “big event.” In that sense, a practical, well-designed, and consistently executed fraud triage effort can pay even more significant dividends that go beyond the direct benefit of helping you evaluate and prioritize tips and complaints more efficiently.
I welcome your comments and suggestions and invite you to read other articles on the topic of whistleblowers within my blog – http://www.boardandfraud.com
Modified from my 2018 post.
The Whistleblower Program was created by Congress on July 21, 2010, in Section 922 of the Dodd-Frank Act.