How effective is your whistleblower programme?

As part of our ongoing commitment to knowledge sharing between the professionals that we are working with- our colleagues have kindly shared what they believe are the best steps to carry out when auditing whistleblower programmes.

Whistleblowing is the act of revealing inappropriate activities, often anonymously, to parties within or outside the organization with the purpose of alerting individuals who can take corrective action. It is preferable for Whistleblowing to occur within the organization, so management can correct the issue without the negative effects caused by the crisis that public disclosure often causes.  Whistleblowing programs should provide a mechanism for employees, contractors, and vendors, to discreetly and anonymously disclose their concerns without the fear of reprisals.

The Sarbanes-Oxley Act of 2002 Section 301 requires publicly-traded companies to have a Whistleblowing program.  But, how do we know if the program is effective? After all, the purpose of these programs is to encourage the disclosure of questionable accounting, internal controls, health, and safety, or fraudulent activities that may negatively impact the organization, its customers, shareholders, employees, investors, or the public at large. But if potential whistleblowers fear they will suffer retaliation, harassment, alienation, intimidation, discrimination, job loss, stress, or emotional hardship, they will be reluctant to contact the ethics hotline to report problems.

Developing the Audit Program: Like any important program, processor control, whistleblowing hotlines should be audited. The following are key steps that should be considered when auditing these programs:

1. Review the program’s protocol: Make sure there is clear and specific guidance on what to do and whom to contact when an allegation is received. The protocol should also include escalation provisions to address emergency situations.

2. Examine allegation file: Verify that information is collected fully and consistently so investigations are not impaired. Auditors should also verify that the whistleblowers’ identities were protected.

3. Review the composition of the investigative team: This is important to make sure it is multi-functional. The response team should be prepared to take quick and decisive action in the event of questionable activities, so the investigation can be conducted without delays. The investigative team should be highly qualified, cross-functional in their backgrounds, and have high integrity.

4. Verify the autonomy of the program: The whistleblower program must be independent by having a direct reporting line to the board or other high-level oversight function.

5. Review performance report: This step is essential to make sure all reports are accurate, useful, produced timely, and shared narrowly. The oversight board (or audit committee) should agree on the content and frequency of reports. Employees’ opinions are essential to the success of whistleblower programs because if they are unaware of it, or refuse to use it, the program is a failure.

6. Review references to key documents: The whistleblower program should be mentioned in the employee manual, code of ethics, and code of conduct to make sure the whistleblower program is referenced in these policy documents.  This will add to the program’s legitimacy and make it a permanent component of the organization’s corporate governance infrastructure. It should be clear that retaliation is forbidden.

7. Verify access to the program: Make sure the phone and fax numbers, e-mail address, and web links are correct, operational 24 hours a day and 7 days a week, and staffed by qualified individuals.

8. Confirm the qualifications of case management staff: Staff should be able to handle stressful situations, communicate with whistleblowers professionally, be discreet and in general have superior customer service skills to collect sufficient and actionable information so fair and thorough investigations can be conducted.

9. Survey employees: The objective is to determine if employees are aware of the program, believe in its usefulness, feel safe from retaliation, and believe that the organization is committed to integrity, transparency, fairness and compliance.

10. Verify advertisement of the program: Make sure the whistleblowing program is advertised in high-traffic areas. Advertising can also include business cards, magnets, mouse pads, mugs, key chains and the company’s newsletter.  Awareness can also increase by including a note in company contracts and purchase orders, providing reminders during staff meetings, and during the annual Code of Ethics and Conflict of Interest recertification processes.

Internal auditors should audit their organizations’ whistleblowing program to make sure perceptions, practices and awareness are as expected and the program is working as it should.”

Audit International are specialists in the recruitment of Auditors and various Corporate Governance Professionals including Internal Audit, Compliance, IT Audit, Data Analytics etc across Europe and the US.

If you would like to reach out to discuss your current requirements, please feel free to reach us on 0041 4350 830 95