Is Your Hotline AAA-Rated?

There's also the one about the CEO who boasted about how his company's new hotline had proven the high degree of integrity at his company: Since the launch of the hotline 6 months previously, no reports of wrongdoing had been reported.

Many companies and organizations have hotlines that are needlessly weak or even ineffective, and they often don't even know it. Unfortunately, there are no up-to-date, authoritative standards for hotlines. This has forced Securities and Exchange Commission registrants and their auditors to use an unusually high degree of judgment in evaluating the effectiveness of hotlines for Sarbanes-Oxley '404 reporting. Non-registrants are more vulnerable to 'phantom hotline syndrome.'

Some entrepreneurs, and their advisers, may not be impressed by the need for a hotline at an e-business, but they're mistaken about the importance of this tool in the current environment of ever-increasing regulation and scrutiny of business practices.

So, how can you tell if your hotline is as good as you think? There are three key aspects to hotlines that must each be designed and operating effectively for the overall mechanism to work well: availability, accountability and attractiveness. Each of these is vital just as engine oil, transmission fluid and brake fluid are to a car's safe and effective operation. In a car without functioning warning lights, you can run out of any one of these elements without knowing it until you experience a costly breakdown or accident. For hotlines, warning lights are optional equipment; many organizations skip at least two of them, oblivious to the resulting high risk.

Availability

The flood of SOX publicity has informed many organizations about how to create a truly available hotline. Employees may not want to call from their desks during work hours, in case they are overheard or readily identified. A good hotline will:

• Be available all day, every day;
• Have multilingual capability (even in the United States);
• Offer phone, e-mail, Web, fax and snail mail options;
• Be open to employees, suppliers, customers and the general public; and
• Regularly be brought to potential callers' attention.

These points are explained in detail in Best Practices for Ethics Hotlines, available for free download at www.EthicsLine.com. These are relatively easy to get right, but the next two key aspects are progressively harder.

Accountability

The hotline must be accountable to the audit committee, board of directors or others charged with governance. They must be able to see that all calls are being responded to appropriately, without management filtering or hiding sensitive calls. A general counsel should not be able to conceal from the audit committee a hotline call concerning wrongdoing by the CEO. Unfortunately, this has happened.

Having a good hotline that is seen as being fully accountable requires:

• Outsourcing the hotline to an independent provider accountable to the audit committee;
• Pre-assigned distribution of call reports (occasionally directly to the audit committee) based on subject, seriousness and involvement of senior management;
• Having the hotline provider and internal staff log into a single shared database all calls and other reports received by whatever means, internally or externally;
• Coding reports consistently by subject matter to ease review of call mix and to facilitate reviewers' focus on more serious items;
• Documenting in the database the resolution of all reports;
• Making the database and summaries available for the audit committee to review securely online at any time; and
• Having the audit committee review and evaluate periodically call volume, mix, nature and efficacy of call resolution.

An audit committee would be burdened to have to review paper reports of all calls in a large company, and call summaries are of limited value. Online review of a system with simple drill-down capability makes high-level and some detailed review practical, and provides the audit committee an invaluable window on the organization's tone.

Attractiveness

Even the best hotline system can be useless if it is unattractive to call. Does management treat hotline calls as annoying, or as opportunities to enhance the integrity of the organization? Do they focus more on resolving the reported problem or on determining the caller's identity? Are people who make calls in good faith thanked, even if their concern turned out to be unfounded? Are even vindicated callers hunted down by management and punished through termination, relocation to some distant outpost, or by reassignment to an unpleasant or make-work job?

For some deep psychological reason, people dislike and mistreat whistle-blowers, even though these people are doing nearly everyone a favor by bringing problems to light. We must change our behavior to honor and praise people who speak up or make hotline calls in good faith to draw attention to serious concerns. Lack of punishment or discrimination against them is not enough. A report last year indicated that 101 of 102 federal government whistle-blowers who had appealed their termination were denied reinstatement. That's unlikely to encourage whistle-blowing in the federal government.

A good hotline is one where:

• All callers are thanked for their calls;
• Self-disclosed callers who report significant issues receive recognition, privately or publicly, as appropriate;
• Management's focus is on the problem, not the caller;
• Callers in good faith are protected from retribution;
• The audit committee monitors treatment of whistle-blowers;
• The audit committee evaluates call volume and mix compared to similar organizations and over time to help assess the attractiveness of calling; and
• Most important of all, all employees are surveyed periodically to measure their belief in management's commitment to integrity, and the employees' willingness to speak up or use the hotline if they identify potential or possible wrongdoing.

Aggregated employee-survey results can be compared over time to measure improvement. Comparison of operating units' scores can identify units where local management has done a particularly good or bad job in setting the right tone at the top. This could feed into management-performance reviews and compensation, along with alerting top management and the audit committee to units that need remediation.

One of the benefits of using an independent hotline provider with a large client base is that with appropriate confidentiality measures and permissions, the provider can compare one client's overall call volume and call mix with that of comparable (unnamed) companies. Differences in call volume and mix can point to potential issues ' but guard against gaining too much comfort from seeing a similar call pattern at another company, because employees at both organizations may be equally reluctant to call.

AAA-Rated Hotlines

By considering accountability, attractiveness and availability of a hotline, you can see whether your hotline merits a AAA rating.

There are four key indicators that suggest your hotline is probably good:

1. The audit committee periodically reviews surveys of all employees measuring their belief in management's commitment to integrity and their degree of willingness to use the hotline;
2. All reports of potential wrongdoing, from whatever source, as well as the follow-up and disposition, are logged in a single database that is reviewed periodically by the audit committee;
3. The hotline is outsourced to an experienced independent provider; and
4. Management, in practice, supports those who speak up or make hotline calls in good faith.

Conversely, four key indicators will suggest that your hotline may be non-investment grade:

• You don't perform such employee surveys across the company, or the results are poor;
• There's no complete source of data on all reports of potential wrongdoing;
• The hotline is operated internally by someone who reports to management; and
• Management's attitude toward hotline callers is to shoot the messenger.

As with credit ratings, action in the right place can help make your hotline AAA-rated and significantly improve its effectiveness in deterring and detecting wrongdoing in your organization.

Have you heard the one about the anonymous whistle-blower hotline?

After-hours calls go to a voice mailbox. They'll call you back the next business day ' if you leave your name and number.

That's a pretty bad joke, but it's also a true story about a large organization that rolled out its new hotline when Sarbanes-Oxley (SOX) came into effect.

There's also the one about the CEO who boasted about how his company's new hotline had proven the high degree of integrity at his company: Since the launch of the hotline 6 months previously, no reports of wrongdoing had been reported.

Many companies and organizations have hotlines that are needlessly weak or even ineffective, and they often don't even know it. Unfortunately, there are no up-to-date, authoritative standards for hotlines. This has forced Securities and Exchange Commission registrants and their auditors to use an unusually high degree of judgment in evaluating the effectiveness of hotlines for Sarbanes-Oxley '404 reporting. Non-registrants are more vulnerable to 'phantom hotline syndrome.'

Some entrepreneurs, and their advisers, may not be impressed by the need for a hotline at an e-business, but they're mistaken about the importance of this tool in the current environment of ever-increasing regulation and scrutiny of business practices.

So, how can you tell if your hotline is as good as you think? There are three key aspects to hotlines that must each be designed and operating effectively for the overall mechanism to work well: availability, accountability and attractiveness. Each of these is vital just as engine oil, transmission fluid and brake fluid are to a car's safe and effective operation. In a car without functioning warning lights, you can run out of any one of these elements without knowing it until you experience a costly breakdown or accident. For hotlines, warning lights are optional equipment; many organizations skip at least two of them, oblivious to the resulting high risk.

Availability

The flood of SOX publicity has informed many organizations about how to create a truly available hotline. Employees may not want to call from their desks during work hours, in case they are overheard or readily identified. A good hotline will:

• Be available all day, every day;
• Have multilingual capability (even in the United States);
• Offer phone, e-mail, Web, fax and snail mail options;
• Be open to employees, suppliers, customers and the general public; and
• Regularly be brought to potential callers' attention.

These points are explained in detail in Best Practices for Ethics Hotlines, available for free download at www.EthicsLine.com. These are relatively easy to get right, but the next two key aspects are progressively harder.

Accountability

The hotline must be accountable to the audit committee, board of directors or others charged with governance. They must be able to see that all calls are being responded to appropriately, without management filtering or hiding sensitive calls. A general counsel should not be able to conceal from the audit committee a hotline call concerning wrongdoing by the CEO. Unfortunately, this has happened.

Having a good hotline that is seen as being fully accountable requires:

• Outsourcing the hotline to an independent provider accountable to the audit committee;
• Pre-assigned distribution of call reports (occasionally directly to the audit committee) based on subject, seriousness and involvement of senior management;
• Having the hotline provider and internal staff log into a single shared database all calls and other reports received by whatever means, internally or externally;
• Coding reports consistently by subject matter to ease review of call mix and to facilitate reviewers' focus on more serious items;
• Documenting in the database the resolution of all reports;
• Making the database and summaries available for the audit committee to review securely online at any time; and
• Having the audit committee review and evaluate periodically call volume, mix, nature and efficacy of call resolution.

An audit committee would be burdened to have to review paper reports of all calls in a large company, and call summaries are of limited value. Online review of a system with simple drill-down capability makes high-level and some detailed review practical, and provides the audit committee an invaluable window on the organization's tone.

Attractiveness

Even the best hotline system can be useless if it is unattractive to call. Does management treat hotline calls as annoying, or as opportunities to enhance the integrity of the organization? Do they focus more on resolving the reported problem or on determining the caller's identity? Are people who make calls in good faith thanked, even if their concern turned out to be unfounded? Are even vindicated callers hunted down by management and punished through termination, relocation to some distant outpost, or by reassignment to an unpleasant or make-work job?

For some deep psychological reason, people dislike and mistreat whistle-blowers, even though these people are doing nearly everyone a favor by bringing problems to light. We must change our behavior to honor and praise people who speak up or make hotline calls in good faith to draw attention to serious concerns. Lack of punishment or discrimination against them is not enough. A report last year indicated that 101 of 102 federal government whistle-blowers who had appealed their termination were denied reinstatement. That's unlikely to encourage whistle-blowing in the federal government.

A good hotline is one where:

• All callers are thanked for their calls;
• Self-disclosed callers who report significant issues receive recognition, privately or publicly, as appropriate;
• Management's focus is on the problem, not the caller;
• Callers in good faith are protected from retribution;
• The audit committee monitors treatment of whistle-blowers;
• The audit committee evaluates call volume and mix compared to similar organizations and over time to help assess the attractiveness of calling; and
• Most important of all, all employees are surveyed periodically to measure their belief in management's commitment to integrity, and the employees' willingness to speak up or use the hotline if they identify potential or possible wrongdoing.

Aggregated employee-survey results can be compared over time to measure improvement. Comparison of operating units' scores can identify units where local management has done a particularly good or bad job in setting the right tone at the top. This could feed into management-performance reviews and compensation, along with alerting top management and the audit committee to units that need remediation.

One of the benefits of using an independent hotline provider with a large client base is that with appropriate confidentiality measures and permissions, the provider can compare one client's overall call volume and call mix with that of comparable (unnamed) companies. Differences in call volume and mix can point to potential issues ' but guard against gaining too much comfort from seeing a similar call pattern at another company, because employees at both organizations may be equally reluctant to call.

AAA-Rated Hotlines

By considering accountability, attractiveness and availability of a hotline, you can see whether your hotline merits a AAA rating.

There are four key indicators that suggest your hotline is probably good:

1. The audit committee periodically reviews surveys of all employees measuring their belief in management's commitment to integrity and their degree of willingness to use the hotline;
2. All reports of potential wrongdoing, from whatever source, as well as the follow-up and disposition, are logged in a single database that is reviewed periodically by the audit committee;
3. The hotline is outsourced to an experienced independent provider; and
4. Management, in practice, supports those who speak up or make hotline calls in good faith.

Conversely, four key indicators will suggest that your hotline may be non-investment grade:

• You don't perform such employee surveys across the company, or the results are poor;
• There's no complete source of data on all reports of potential wrongdoing;
• The hotline is operated internally by someone who reports to management; and
• Management's attitude toward hotline callers is to shoot the messenger.

As with credit ratings, action in the right place can help make your hotline AAA-rated and significantly improve its effectiveness in deterring and detecting wrongdoing in your organization.