Study: Internal Reporting Gets Busier

Some red meat for all you whistleblower hotline managers! Navex just released its annual benchmarking report on internal reporting, with some fascinating findings about the volume of internal reports, the substantiation rates for internal reports, how often outsiders use your internal hotline, and much more. 

Navex released the report Tuesday morning, and given the sheer size of Navex’s whistleblower hotline operations (this year’s report analyzes 1.86 million reports submitted to nearly 3,800 businesses in 2023), the report is always worth a compliance professional’s time just to understand how your own whistleblower activity compares to the norm. So let’s take a look at the headlines. 

Reporting volume reached an all-time high. Organizations received a median 1.57 reports per 100 employees in 2023, exceeding the previous record of 1.47 set in 2022. An increase of only 0.1 might not sound like much, but in relative terms and with such a large and diverse sample size, it’s actually quite significant. 

Median reports per 100 employees hovered around 1.4 through much of the 2010s, and then dipped to 1.3 during the pandemic. Now we’ve shot up to 1.57, an increase of 21 percent in just two years. That’s a spike. 

Plus, more organizations (23 percent) received 5 or more reports per 100 employees than any other population in Navex’s data set. Indeed, every size organization, from small companies to global enterprises with more than 100,000 employees, had report volumes rise from 2021 to 2023. 

Substantiation rates are at an all-time high too. The median substantiation rate rose to 45 percent, up from 41 percent in 2022 and well above the low-40s rates seen in the late 2010s. 

internal reporting

Navex sees this upward trend as a good thing, since it means compliance officers are hearing about more problems within their organizations. I see the point there, since research shows that higher internal reporting volumes correspond to better business performance

Still, higher rates of internal reporting and higher substantiation rates at the same time means compliance officers have a poop-ton of reports to investigate these days. That makes me worry about whether you have sufficient resources to do so. (Then again, it gives you a stronger case to argue for more resources, too.)

Third parties are a valuable source of reports about business misconduct. For the first time, this year Navex compared reports made by employees to reports made by outsiders. Turns out that reports by third parties (contract labor, employees at suppliers or business partners, and the like) are much more likely to be about business integrity issues than the reports you hear from employees. 

That does make sense; most reports from employees are about HR or workplace civility issues, which outsiders typically won’t encounter. So they’re more likely to report issues of corruption, fraud, conflicts of interest, and other problems that are very much up the compliance officer’s alley. 

That suggests that expanding awareness of your hotline to business partners and other suppliers might be a worthwhile project. On the other hand, the substantiation rate tends to be lower for this group than for reports from employees, so tread carefully. 

Who Is Reporting About What

Another interesting nugget in the Navex report is a breakdown of whistleblower reports by type. Navex tracks two dozen specific categories, from accounting fraud to product defects to workplace violence, with lots more in between. We can’t present the entire list here, but Navex does group those two dozen categories into a few larger groups. See below.

As we’ve seen for years, HR and workplace civility issues are the lion’s share of all reports. Indeed, that share has been rising in recent years, from 50 percent in 2021 to 54.5 percent in 2023. Right away, that reminds us all that compliance must always have a good working relationship with our frenemies in HR, including efficient processes to hand off HR-related reports to the HR team. 

Meanwhile, we have that small fraction of reports about accounting fraud. That fraction is getting smaller, but accounting fraud cases tend to be a bigger crisis when they happen. Accounting fraud cases have a higher substantiation rate (50 percent), and are least likely to be reported anonymously. (Because what are you going to do, retaliate against the reporter and add a Dodd-Frank retaliation complaint to your list of headaches?) 

So the issue here is whether compliance officers have the resources to tackle accounting fraud cases smartly. That is, do you have clear protocols for what is investigated by you, by internal audit, or by outside counsel? Does the company have strong forensics capability? Do you have sufficient documentation requirements so that when an accounting issue does come over the transom, you can figure out the audit trail for the transactions involved? 

We’ll have more analysis of the Navex report in future posts, since there’s plenty of material in there. Meanwhile, this is plenty to get started thinking about how your internal reporting program stacks up.

[Disclosure: I do paid work for Navex, writing guest posts and other work. Navex did not pay me to write this report, nor did anyone at Navex have advance access to review this post.] 

Leave a Comment

You must be logged in to post a comment.