What do you expect to happen when you gather together three-dozen compliance/auditor types from the world’s leading companies, all in one place and at one time, to talk about whistleblowing? If you said just about anything could happen, we would be in complete agreement. Yet I was pleasantly surprised last week when we hosted a three-hour workshop at the ECOA (Ethics and Compliance Officers Association) conference in Bellevue, Wash., and brought together more than 40 such personnel. My most lasting impression from the workshop was the degree of engagement of the audience, confirming my belief that at these kind of workshops, the participants learn more from each other than from the presenters.
In light of SOX compliance and the recent Dodd-Frank/SEC mandates, we focused our discussion on what needs to be in place before the whistleblower call comes in, how to handle the actual call, and the process and procedures that need to be in place to manage a proper response. The lively discussion and a healthy degree of cross-talk amongst participants and presenters alike reinforced one key truth – that culture trumps procedures every time. By this I mean that you may have an excellent process in place to handle whistleblower reports, but if it doesn’t reflect the culture, it will be ineffective. For example, if there are traditional “silos” of information which the “owner” is unwilling to share, it is very hard to get the kind of collaborative approach toward investigation and remediation that is needed, or even to get the whistleblower to speak up in the first place.
The primary requirements are, of course, consistent education, ongoing awareness efforts and lots of feedback to employees about whistleblower program results. Realigning process and procedure can be quick and even easy, but it takes a long time to change culture, and the effort has to be top-to-bottom.