I was looking at the results of our recent web survey about what compliance teams consider to be the most important topics for 2012. (My colleague Clark Bosley recently blogged about it here.) One of the main items up for discussion was “internal reporting of misconduct,” and in my mind, that should be the number one answer across the board. If you don’t have a solid way to know when things go wrong (or when people do the wrong thing), then is there much of a need to have a code of conduct, or policies or regulations in the first place?
Maybe that’s a bit of a strong position to take, but the way I see it, maintaining a “speak up” culture is very empowering to your employees. When it comes to ethical GRC, everything is connected. When it comes to making sure your employees know that they can report bad behavior, anonymously and confidently, your ethical culture is connected, too. Your code has more value, your policies carry more weight, and people retain what they learn and want to understand even more when ethics issues are at hand. They know that they can make a difference. Our recent Quarterly Fraud Index showed that fraud reporting is at an all-time high, which very well might mean that employees just aren’t tolerating bad behavior as they might have done in the past, not when their jobs and their companies are potentially at risk.
Internal ethics reporting (versus external) is also important in light of the SEC whistleblower hotline, thanks to Dodd-Frank. What I garnered from the results of our web survey is that senior leadership is all set to address the issue of internal reporting, making sure that their employees know that an actionable hotline program is in place to handle their concerns, so that the SEC is brought into a situation more on the company’s terms, rather than being blindsided by an external report leading to an external investigation.
Internal reporting is also my number one with a bullet because of horrific events like the scandals at Penn State and Syracuse. Never mind exactly what took place and how it was discovered (no disrespect intended here), it’s just that those in a position of authority who truly care don’t want something like that to impact them, so they are willing to do more to enable an anonymous reporting structure and thoroughly communicate it to their employees.