Notes on Compliance Hotline Analytics

Today I want to return to that compliance program benchmarking survey released last week by KPMG and White & Case. The report includes several findings about how companies handle their internal whistleblower hotlines that warrant our attention, given how important the hotline can be to your overall culture of compliance. 

Essentially, the findings are these: that companies spend more time measuring employees’ awareness of the whistleblower hotline, but not necessarily employees’ comfort with actually using the hotline. That might be a significant mistake, because employees are more concerned about whether they can trust the whole internal reporting process rather than the mechanics of exactly how one is supposed to file a report. 

Let’s start with the good stuff. The solid majority of respondents to the KPMG-White & Case survey (200 senior compliance professionals) said they pepper their workforce with numerous messages about the company’s whistleblower hotline and other compliance escalation procedures. Whether the delivery vehicle was training, internal reminders, or an anti-corruption code of conduct, at least 75 percent of respondents said, “Yep, we do that.” 

That’s welcome news, but all companies should be pointing out the availability of the whistleblower hotline; those are table stakes for the modern compliance program. The more important question for compliance officers is how well your hotline program actually works. That is literally one of the Justice Department’s three fundamental questions about compliance programs: “Does the compliance program work in practice?”

Well, for the hotline to work in practice, employees need to use it — and for employees to use it, they first have to trust it. So how are companies trying to assess their employees’ comfort with the hotline system? 

In rather scattershot and inconsistent ways, according to KPMG and White & Case. 

Finding Employees’ Comfort Zone

Figure 1, below, gives a good sense of the challenge here. Altogether, 51 percent of respondents said they measure employees’ awareness of the hotline, but only 36 percent measure employees’ comfort level with using the hotline. Moreover, those efforts correspond (rather predictably) to company size: the larger the company, the more likely it was to say yes, it measures employee awareness of the hotline; the smaller the company, the less likely. 

I get it; smaller companies have fewer resources, and they can’t be expected to do everything. Still, when you don’t assess employees’ awareness of the hotline, you risk misunderstanding the culture of compliance your business truly does (or does not) have. Even if you simply ask your whistleblower hotline vendor for help or ideas — which I’m sure most vendors would be happy to provide, presumably for a fee — that’s a step in the right direction.

The survey also asked about employees’ concerns with using the whistleblower hotline. Those answers are in Figure 2, below.

Why are those answers so interesting? First, because the top two (fear of retaliation; belief that nothing will be done) are pretty much the same reasons cited in research conducted by Ethisphere in 2019; clearly there’s something to it. 

Second and more important, however, is that these top concerns are all about employee trust in the compliance program. When they cite fear of retaliation, concern that nothing will get done, or fear that their confidential reports won’t stay confidential, they’re really telling us that they don’t believe the whistleblower program will work to protect them. 

Indeed, notice that all those fears are more pronounced at larger companies — you know, the ones  with more compliance resources. I don’t find that surprising. Larger companies are more impersonal. They rely more on policies and procedures to operate, rather than on specific people that employees see and know. Larger companies make a bigger ask of employees to “trust the system,” when employees have relatively less power to use that system for their own protection. Of course those employees would be more suspicious and cynical of whistleblower programs than their colleagues at smaller businesses. 

Why This Matters

This matters because it dictates the questions a compliance officer should be pondering as you evaluate your hotline program. That is, if the key to success is more about employees trusting the hotline system, then you need to think about issues broader than the mechanics of how your hotline actually works. For example, you need to think about disciplinary enforcement, executive messaging, and investigation protocols; those are the block-and-tackle fundamentals of a hotline program that convince employees the system can be trusted. 

That’s not to say the mechanics of setting up toll-free phone numbers in various countries isn’t important, or the posters in the breakroom touting the hotline, or the training you offer for how to submit a complaint. Of course the mechanics are important too. But mechanics will only clear the path for a corporate culture of compliance; trust is what gets employees to walk that path.