Whistleblowing is the act of revealing inappropriate activities, often anonymously, to parties within or outside the organization with the purpose of alerting individuals who can take corrective action. It is preferable for whistleblowing to occur within the organization so management can correct the issue without the negative effects caused by the crisis that public disclosure often causes.  Whistleblowing programs should provide a mechanism for employees, contractors, and vendors, to discreetly and anonymously disclose their concerns without the fear of reprisals. 

The Sarbanes-Oxley Act of 2002 Section 301 requires publicly-traded companies to have a whistleblowing program.  But, how do we know if the program is effective? After all, the purpose of these programs is to encourage the disclosure of questionable accounting, internal controls, health, and safety, or fraudulent activities that may negatively impact the organization, its customers, shareholders, employees, investors, or the public at large. But if potential whistleblowers fear they will suffer retaliation, harassment, alienation, intimidation, discrimination, job loss, stress, or emotional hardship, they will be reluctant to contact the ethics hotline to report problems. 

Developing the Audit Program

Like any important program, process or control, whistleblowing hotlines should be audited. The following are key steps that should be considered when auditing these programs:

1. Review the program’s protocol. 

Make sure there is clear and specific guidance on what to do and whom to contact when an allegation is received. The protocol should also include escalation provisions to address emergency situations.

2. Examine allegation files.

Verify that information is collected fully and consistently so investigations are not impaired. Auditors should also verify that the whistleblowers’ identities were protected and that a case number, rather than the whistleblowers’ names, were used during the investigation and reporting.

3. Review the composition of the investigative team.

This is important to make sure it is multi-functional. Key members typically include representatives from the legal, accounting/finance, human resources, and internal audit units. An IT expert may also be part of the team or kept on retainer. The response team should be prepared to take quick and decisive action in the event of questionable activities, so the investigation can be conducted without delays. The investigative team should be highly qualified, cross-functional in their backgrounds, and have high integrity.

4. Verify the autonomy of the program.

The whistleblower program must be independent. By having a direct reporting line to the board or other high-level oversight function. A single individual should not be able to reduce the budget or impair investigations through direct means or the threat of cutbacks. This type of interference would impair the program’s effectiveness, independence and objectivity. 

5. Review performance reports.

This step is essential to make sure all reports are accurate, useful, produced timely, and shared narrowly. The oversight board (or audit committee) should agree on the content and frequency of reports, which should include at a minimum the number of allegations received; the number of substantiated allegations; a ranking of the impact of these allegations to the organization; some means to identify trends and concentrations based on location/geography, type, department; and turnaround times from notification to investigation, and from investigation to resolution.

Employees’ opinions are essential to the success of whistleblower programs because if they are unaware of it, or refuse to use it, the program is a failure.

6. Review references to key documents. 

The whistleblower program should be mentioned in the employee manual, code of ethics, and code of conduct to make sure the whistleblower program is referenced in these policy documents.  This will add to the program’s legitimacy and make it a permanent component of the organization’s corporate governance infrastructure. It should be clear that retaliation is forbidden.

7. Verify access to the program. 

Make sure the phone and fax numbers, e-mail address, and web links are correct, operational 24 hours a day and 7 days a week, and staffed by qualified individuals.

8. Confirm the qualifications of case management staff.   

Staffers doing intake should no treat this as a simple data-entry job. They should be able to handle stressful situations, communicate with whistleblowers professionally, be discreet and in general have superior customer service skills to collect sufficient and actionable information so fair and thorough investigations can be conducted.

9. Survey employees. 

Surveys are an essential procedure to determine if employees believe the whistleblowing program is credible and effective. The objective is to determine if employees are aware of the program, believe in its usefulness, feel safe from retaliation, and believe that the organization is committed to integrity, transparency, fairness and compliance. If employees are unaware of the program’s existence, doubt that reporting anomalies will result in corrective action, or fear retaliation, the effectiveness of the whistleblowing program would be in doubt.

10. Verify advertisement of the program. 

Make sure the whistleblowing program is advertised in high-traffic areas. Advertising can also include business cards, magnets, mouse pads, mugs, key chains and the company’s newsletter.  Awareness can also increase by including a note in company contracts and purchase orders, providing reminders during staff meetings, and during the annual Code of Ethics and Conflict of Interest recertification processes.

For the whistleblowing program to be effective, employees must know about it, believe that it is an effective mechanism to alert someone who can act to correct what is perceived as a problem within the organization, and feel confident that the benefits of blowing the whistle outweigh the cost of possible retaliation. Internal auditors should audit their organizations’ whistleblowing program to make sure perceptions, practices and awareness are as expected and the program is working as it should.

Interested in learning more about this and other tools and techniques? Join Dr. Murdock when he teaches Lean Six Sigma Skills for AuditorsInternal Audit School, and High-Impact Skills for Developing and Leading Your Audit Team.

Ben Sweet