Is Your Hotline AAA-Rated?

How can you tell if your hotline is as good as you think? There are three key aspects to hotlines that must each be designed and operating effectively for the overall mechanism to work well: availability, accountability, and attractiveness. Each of these is vital just as engine oil, transmission fluid and brake fluid are all vital to a car's safe and effective operation. In a car without functioning warning lights you can run out of any one of these without knowing it until you meet with a costly breakdown or even a fatal accident. For hotlines, warning lights are optional equipment. Many organizations skip at least two of them, oblivious to the resulting high risk.

Availability

The flood of SOX publicity has informed many organizations about how to create a hotline that is truly available. Employees may not want to call from their desks during working hours, in case they are overheard or readily identified. A good hotline will:

• be available 24x7x365;
• have multilingual capability (even in the U.S.);
• offer phone, e-mail, Web, fax and snail mail options;
• be open to employees, suppliers, customers and the general public; and
• be brought regularly to the attention of potential callers.

These points are explained in detail in Best Practices for Ethics Hotlines, which is available for free download at www.EthicsLine.com. These are relatively easy to get right. The next two key aspects are progressively harder.

Accountability

The hotline must be accountable to the audit committee, board of directors or others charged with governance. They need to be able to see that all calls are being responded to appropriately without management filtering or hiding sensitive calls. A general counsel should not be able to conceal from the audit committee a hotline call concerning wrongdoing by the CEO. Unfortunately this has happened in practice.

Having a good hotline that is seen to be fully accountable requires:

• outsourcing the hotline to an independent provider accountable to the audit committee;
• pre-assigned distribution of call reports (occasionally direct to the audit committee) based on subject, seriousness and involvement of senior management;
• having the hotline provider and internal staff log into a single shared database all calls and other reports received by whatever means, internally or externally;
• coding reports consistently by subject matter to ease review of call mix and facilitate reviewers' focus on more serious items;
• documenting in the database the resolution of all reports;
• making the database and summaries available for the audit committee to review securely online at any time; and
• having the audit committee review and evaluate periodically the call volume, call mix, nature of calls, and efficacy of call resolution.

It would be burdensome for an audit committee to review paper reports of all calls in a large company, and call summaries are of limited value. Online review of a system with simple drill-down capability makes both high-level and some detailed review practical, providing the audit committee an invaluable window into the tone of the organization.

Attractiveness

Even the best hotline system can be useless if it is unattractive to call. Does management treat hotline calls as annoying problems, or as opportunities to enhance the integrity of the organization? Do they focus more on resolving the reported problem or on finding out the identity of the caller? Do people who make calls in good faith get thanked, even if their concern turned out not to be correct? Or do even vindicated callers get hunted down by management and punished through termination, relocation to some distant outpost, or reassignment to an unpleasant or make-work job?

For some deep psychological reason, human beings dislike and mistreat whistleblowers, even though these people are doing us a favor by alerting us to problems. We need to change our behavior to honor and praise people who speak up or make hotline calls in good faith to draw attention to serious concerns. The mere lack of punishment or discrimination against them is not enough. A report last year indicated that 101 out of 102 federal government whistleblowers who had appealed their termination were denied reinstatement. That is unlikely to encourage whistle-blowing in the federal government.

A good hotline is one where:

• all callers are thanked for their calls;
• self-disclosed callers who report significant issues receive recognition, privately or publicly as appropriate;
• management's focus is on the problem, not the caller;
• callers in good faith are protected from retribution;
• the audit committee monitors treatment of whistleblowers;
• the audit committee evaluates call volume and mix compared to comparable organizations and over time to help assess the attractiveness of calling; and
• most importantly of all, all employees are surveyed periodically to measure their belief in management's commitment to integrity and their willingness to speak up or use the hotline if they identify potential wrongdoing.

Aggregated employee survey results can be compared over time to measure improvement. Comparison of operating units' scores can identify units where local management has done a particularly good or bad job in setting the right tone at the top. This could feed into management performance reviews and compensation as well as alert top management and the audit committee to units needing remediation.

One of the benefits of using an independent hotline provider with a large client base is that, with appropriate confidentiality measures and permissions, the provider can compare one client's overall call volume and call mix with that of comparable (unnamed) companies. Differences in call volume and mix can be pointers to potential issues. But guard against gaining too much comfort from seeing a similar call pattern at another company, since employees at both organizations may be equally reluctant to call.

AAA-Rated Hotlines

By considering accountability and attractiveness as well as availability, you can more clearly see whether your hotline merits an AAA rating.

There are four key indicators that suggest your hotline is probably good:

• The audit committee periodically reviews surveys of all employees that measure their belief in management's commitment to integrity and their degree of willingness to use the hotline;
• All reports of potential wrongdoing from whatever source, as well as the follow-up and disposition, are logged in a single database that is reviewed periodically by the audit committee;
• The hotline is outsourced to an experienced independent provider; and
• Management is in practice supportive of those who speak up or make hotline calls in good faith.

The corollary is that there are four key indicators that suggest your hotline may well be non-investment grade:

• You don't perform such employee surveys across the company, or the results are poor;
• There is no complete source of data on all reports of potential wrongdoing;
• The hotline is operated internally by someone who reports to management; and
• Management's attitude toward hotline callers is to shoot the messenger

As with credit ratings, action in the right place can help make your hotline AAA-rated and significantly improve its effectiveness in deterring and detecting wrongdoing in your organization.

Have you heard the one about the anonymous whistleblower hotline? After-hours calls go to a voice mailbox. They will call you back the next business day – if you leave your name and number. That's a pretty bad joke. But it's also a true story about a large organization that rolled out its new hotline when Sarbanes-Oxley (SOX) came into effect.

There's also the one about the CEO who boasted of how his company's new hotline had proven the high degree of integrity at his company: Since the launch of the hotline 6 months previously, they had received no reports of wrongdoing at all.

Many organizations have hotlines that are needlessly weak or even ineffective, and they often don't even know it. There are no up-to-date, authoritative standards for hotlines. This has forced SEC registrants and their auditors to use an unusually high degree of judgment in evaluating the effectiveness of hotlines for Sarbanes-Oxley ' 404 reporting. Non-registrants are even more vulnerable to “phantom hotline syndrome.”

How can you tell if your hotline is as good as you think? There are three key aspects to hotlines that must each be designed and operating effectively for the overall mechanism to work well: availability, accountability, and attractiveness. Each of these is vital just as engine oil, transmission fluid and brake fluid are all vital to a car's safe and effective operation. In a car without functioning warning lights you can run out of any one of these without knowing it until you meet with a costly breakdown or even a fatal accident. For hotlines, warning lights are optional equipment. Many organizations skip at least two of them, oblivious to the resulting high risk.

Availability

The flood of SOX publicity has informed many organizations about how to create a hotline that is truly available. Employees may not want to call from their desks during working hours, in case they are overheard or readily identified. A good hotline will:

• be available 24x7x365;
• have multilingual capability (even in the U.S.);
• offer phone, e-mail, Web, fax and snail mail options;
• be open to employees, suppliers, customers and the general public; and
• be brought regularly to the attention of potential callers.

These points are explained in detail in Best Practices for Ethics Hotlines, which is available for free download at www.EthicsLine.com. These are relatively easy to get right. The next two key aspects are progressively harder.

Accountability

The hotline must be accountable to the audit committee, board of directors or others charged with governance. They need to be able to see that all calls are being responded to appropriately without management filtering or hiding sensitive calls. A general counsel should not be able to conceal from the audit committee a hotline call concerning wrongdoing by the CEO. Unfortunately this has happened in practice.

Having a good hotline that is seen to be fully accountable requires:

• outsourcing the hotline to an independent provider accountable to the audit committee;
• pre-assigned distribution of call reports (occasionally direct to the audit committee) based on subject, seriousness and involvement of senior management;
• having the hotline provider and internal staff log into a single shared database all calls and other reports received by whatever means, internally or externally;
• coding reports consistently by subject matter to ease review of call mix and facilitate reviewers' focus on more serious items;
• documenting in the database the resolution of all reports;
• making the database and summaries available for the audit committee to review securely online at any time; and
• having the audit committee review and evaluate periodically the call volume, call mix, nature of calls, and efficacy of call resolution.

It would be burdensome for an audit committee to review paper reports of all calls in a large company, and call summaries are of limited value. Online review of a system with simple drill-down capability makes both high-level and some detailed review practical, providing the audit committee an invaluable window into the tone of the organization.

Attractiveness

Even the best hotline system can be useless if it is unattractive to call. Does management treat hotline calls as annoying problems, or as opportunities to enhance the integrity of the organization? Do they focus more on resolving the reported problem or on finding out the identity of the caller? Do people who make calls in good faith get thanked, even if their concern turned out not to be correct? Or do even vindicated callers get hunted down by management and punished through termination, relocation to some distant outpost, or reassignment to an unpleasant or make-work job?

For some deep psychological reason, human beings dislike and mistreat whistleblowers, even though these people are doing us a favor by alerting us to problems. We need to change our behavior to honor and praise people who speak up or make hotline calls in good faith to draw attention to serious concerns. The mere lack of punishment or discrimination against them is not enough. A report last year indicated that 101 out of 102 federal government whistleblowers who had appealed their termination were denied reinstatement. That is unlikely to encourage whistle-blowing in the federal government.

A good hotline is one where:

• all callers are thanked for their calls;
• self-disclosed callers who report significant issues receive recognition, privately or publicly as appropriate;
• management's focus is on the problem, not the caller;
• callers in good faith are protected from retribution;
• the audit committee monitors treatment of whistleblowers;
• the audit committee evaluates call volume and mix compared to comparable organizations and over time to help assess the attractiveness of calling; and
• most importantly of all, all employees are surveyed periodically to measure their belief in management's commitment to integrity and their willingness to speak up or use the hotline if they identify potential wrongdoing.

Aggregated employee survey results can be compared over time to measure improvement. Comparison of operating units' scores can identify units where local management has done a particularly good or bad job in setting the right tone at the top. This could feed into management performance reviews and compensation as well as alert top management and the audit committee to units needing remediation.

One of the benefits of using an independent hotline provider with a large client base is that, with appropriate confidentiality measures and permissions, the provider can compare one client's overall call volume and call mix with that of comparable (unnamed) companies. Differences in call volume and mix can be pointers to potential issues. But guard against gaining too much comfort from seeing a similar call pattern at another company, since employees at both organizations may be equally reluctant to call.

AAA-Rated Hotlines

By considering accountability and attractiveness as well as availability, you can more clearly see whether your hotline merits an AAA rating.

There are four key indicators that suggest your hotline is probably good:

• The audit committee periodically reviews surveys of all employees that measure their belief in management's commitment to integrity and their degree of willingness to use the hotline;
• All reports of potential wrongdoing from whatever source, as well as the follow-up and disposition, are logged in a single database that is reviewed periodically by the audit committee;
• The hotline is outsourced to an experienced independent provider; and
• Management is in practice supportive of those who speak up or make hotline calls in good faith.

The corollary is that there are four key indicators that suggest your hotline may well be non-investment grade:

• You don't perform such employee surveys across the company, or the results are poor;
• There is no complete source of data on all reports of potential wrongdoing;
• The hotline is operated internally by someone who reports to management; and
• Management's attitude toward hotline callers is to shoot the messenger

As with credit ratings, action in the right place can help make your hotline AAA-rated and significantly improve its effectiveness in deterring and detecting wrongdoing in your organization.