Always on duty

An anonymous whistleblower hotline should be a critical weapon of any organization’s anti-fraud arsenal. Fraud examiners should understand some of the key success factors that make hotlines good tools in fighting fraud.

In July 2019, Capital One revealed that it had been victim of a data breach in which the personally identifiable information of more than 100 million applicants and customers, including bank account numbers and Social Security numbers, were stolen or compromised. According to The New York Times coverage of the breach, a former employee of the cloud services provider used by Capital One committed the fraud. The company became aware of the issue when a tipster wrote to a Capital One security hotline to warn some of the bank’s data appeared to have been leaked. A subsequent investigation into the tip led to discovery of the breach. (See Capital One Data Breach Compromises Data of Over 100 Million, by Emily Flitter and Karen Weise, The New York Times, July 29, 2019, and The 5 most scandalous fraud cases of 2019.)

The 2018 ACFE Report to the Nations showed that tips were the most common way in which occupational fraud is initially detected. (Tips have remained one of the most common sources of detection since the ACFE began publishing the report in 1996.) The ACFE also reported that fraud losses were 50% smaller at organizations with hotlines than those without.

An anonymous whistleblower hotline should be a critical weapon of any organization’s anti-fraud arsenal. Fraud examiners should understand some of the key success factors that make hotlines good tools in fighting fraud, and they should be able to discern whether the hotlines at their organizations are operating effectively because a tip that saves a company from a potential disaster could come from anyone at any time.

Hotline benefits

The presence of anonymous hotlines empower all employees or external parties to report suspected wrongdoing without fear of retaliation, which makes everyone in organizations allies in fighting fraud. Hotlines are relatively inexpensive and easy to implement and maintain. (See How much does a whistleblowing hotline cost? ExpoLink, Feb. 8, 2017.)

In some cases, reporters will lay out a complete picture of fraud or other bad actions occurring. However, in many other cases, a reporter will only provide a clue or the tip of the iceberg.

Hotlines are most effective when they work in concert with other, more proactive fraud detection methods, such as audits and data analytics, and when we integrate them into our organizations’ larger emphasis on ethical conduct.

Key success factors

You should be confident that your hotline is in good order. Speak with hotline personnel and internal auditors, and observe firsthand the hotline’s workings. At the most basic level, reporting channels (phone, digital, etc.) should be operational and communications routed properly. Instructions must be simple enough so that all hotline users can follow them easily and intuitively. (See How to Audit Whistleblower Programs, by Hernan Murdock, May 22, 2018, MISTI Training Institute.)

Here are some critical success factors for hotlines.

Support

Hotline support includes sufficient resources and qualified, trained staff members. The hotline’s senior leader, who should be apparent to all, must ultimately own and be accountable for the hotline. That person and the hotline program must have the authority to act.

Communication

For a hotline to be effective, employees must be aware of it, understand its purpose and know how to use it — all of which requires a good communications strategy. Ideally, your organization will incorporate promotion of the hotline into a broader communication effort about your ethics and anti-fraud efforts. This will help users think of the hotline as a key part of the company’s commitment to enforcing the code of conduct and not just as a means for reporting bad behavior. (See What Is A Whistleblowing Hotline? by Karin Henriksson, WhistleB Blog.)

Regularly advertise your hotline in high-visibility areas. (See How to Audit Whistleblower Programs.) The various external parties with which the organization interacts can also be valuable sources of tips about fraud so they should also know about and understand your hotline program. According to survey respondents in the Report to the Nations, nearly one-third of tips that led to fraud detection came from people outside the organization, including customers, vendors and competitors.

According to Henriksson in her WhistleB blog, a robust communication plan should incorporate user awareness but also capitalize on a hotline’s effectiveness as a fraud deterrent. The greater the general awareness of the hotline, the more likely a potential fraudster will be dissuaded from trying inappropriate or illegal behavior.

Privacy/confidentiality

Hotlines handle sensitive issues and information, so organizations must respect and protect the privacy of reporters and protect them from retaliation. This fosters trust in the hotline and protects organizations from potential financial, legal and reputational damage.

Of course, whistleblower suppression against reporting employees — retaliation or dismissal — is illegal. (See Whistleblower Suppression & The Wells Fargo Scandal, by Aaron Hall, Aaron Hall Attorney, Sept. 21, 2016.) Therefore, in any investigation of possible fraud based on a tip from a hotline, make sure you know if your organization protected the reporter’s privacy and freedom from retaliation, which is in the best interest of both the reporter and the organization.

Follow-through

Following through with reports is one of the most critical aspects of a successful hotline. As Tim Marshall and Michael Sheehan write in a paper for the DLA Piper Employment group, “Individuals are more likely to speak out … if they can be confident that their report will be acted on, that they will be protected against retaliation and that their employer is serious about weeding out corruption and mismanagement.” (See Whistleblowing: An employer’s guide to global compliance.) Organizations should acknowledge all reports, periodically update reporters and close cases in a timely manner.

Enhanced fraud risk management

While an investigation and resolution of each case reported to a hotline is important in and of itself, an effective whistleblower hotline should also inform an investigation of larger issues. In some cases, reporters will lay out a complete picture of fraud or other bad actions occurring. However, in many other cases, a reporter will only provide a clue or the tip of the iceberg. So, it’s imperative that fraud examiners maintain a two-way working relationship with hotline personnel. Being tuned in to what types of reports are coming into the hotline — while still respecting reporter privacy — can help fraud examiners understand where further investigation is needed.

The whistleblower hotline, always on duty, is one of the fraud examiner's best resources.

As Mustafa Yusuf-Adebola, CFE, wrote, “Collating and recording all relevant data for established and unestablished cases on the whistleblowing platform can help anti-fraud professionals proactively address fraud indicators, assist in updating in-house training courses, and help in increasing employees’ fraud awareness and reviewing of company policies.” (See 4 Challenges to Creating an Effective Whistleblowing Policy and How to Overcome Them, ACFE Insights, Dec. 5, 2017.)

One of your best resources

The whistleblower hotline, always on duty, is one of a fraud examiner’s best resources. With tips still the most likely source for catching fraudulent activity, we should engage with our hotline and be attuned to the types of activities reported and how hotline personnel are following through with cases. Conversely, failure to heed the concerns raised by employees and other reporters is one of the greatest risks organizations can face.

Kevin M. Alvero, CFE, is senior vice president-internal auditing at Nielsen. Contact him at kevin.alvero@nielsen.com.