Interest in fraud hotlines has surged since passage of the Sarbanes-Oxley Act and its requirement that public company employees be able to confidentially and anonymously report questionable accounting or auditing matters. Private companies, however, may also benefit from establishing similar warning systems. Here are some tips for selecting and operating an effective system.

The Sarbanes-Oxley Act of 2002 (the Act) requires every publicly traded company “to establish procedures for the receipt, retention and treatment of complaints . . . regarding internal accounting controls or auditing matters.” Section 301 of the Act requires the audit committee to establish a procedure for employees to report—anonymously and confidentially—their concerns about these matters. The Securities and Exchange Commission (SEC) has issued a final rule requiring compliance by the first annual shareholders’ meeting after January 15, 2004, but no later than October 31, 2004. Failure to comply results in the company’s being delisted by the stock exchange or securities association through which its stock is traded.

This new requirement has revived interest in fraud hotlines, mostly telephone systems and Web-based tools, used to field employee allegations and complaints. Many companies established such hotlines as part of companywide corporate ethics programs in response to the Federal Sentencing Guidelines enacted in 1991 by the U.S. Sentencing Commission. According to the guidelines, the Commission can impose severe financial penalties on an entity convicted of corrupt and unethical business practices. Liability and fines can be significantly reduced, however, if the company has an effective mechanism for reporting wrongdoing, including a system “designed to detect criminal conduct by others within the organization without fear of retribution.”

Private company needs
Public companies are not alone in the need to establish complaint procedures as part of an effective internal control structure. Any organization with 50 or more employees is subject to the Federal Sentencing Guidelines. Small businesses can also benefit from establishing a mechanism for the reporting of wrongdoing. The vulnerability of small entities is evident, according to William S. Laufer, Associate Professor of Legal Studies, the Wharton School, in statistics showing that, of all corporations convicted of unethical business practices in federal courts, more than 90% are small businesses and more than 95% are privately held. In 2000, 72% of the companies prosecuted in federal courts were ordered to pay fines, according to the U. S. Sentencing Commission. The average fine was almost $1.6 million and legal costs were additional.

In 2001, the fines of 186 organizations averaged $2.2 million each. None of the organizations received a reduction in fines because they did not have an “effective program to prevent and detect violations of law” in place.

All companies, public or private, large or small, can benefit from establishing a system and fostering a culture that will help prevent, detect, and address not only auditing and accounting irregularities, but also other fraud or wrongdoing, such as bid rigging, corruption and bribery, and collusion and theft (for example, skimming revenues, fraudulent disbursements, stolen inventory).

A silver lining?
Legislators believe that the Sarbanes-Oxley Act addresses the need to protect investors from public companies’ misleading financial statements issued at the behest of corporate executives, sometimes with the assistance of external auditors. Relentless media attention, along with Congressional actions, has created the impression that the wrongdoing is widespread. On the other hand, media attention has also made many employees aware of the ramifications of such misconduct. The well-publicized spectacle of Enron employees losing their life savings because of senior managers’ misconduct vividly shows all employees the harm that can arise from indifference to the wrongdoing of others. Fraud and other misconduct can erode profits and retirement funds, and can even eliminate jobs.

A warning system that supports whistleblowers, such as a fraud hotline, encourages employees to act when others do wrong. It can inspire confidence in employees that reporting misconduct is in their best interest and will benefit them, other employees, and the company. It helps to create a culture that values ethical behavior, is committed to preventing and detecting fraud, and will respond decisively and appropriately to misconduct.

In addition to fielding tips about possible fraudulent activity, and sending the message to employees that helps to prevent and detect fraud, hotlines also play a role in ensuring that management can effectively address other illegal and unethical employee behavior such as discrimination and harassment.

In addition to incurring the financial benefits of early detection of fraud and limiting liability related to such offenses as harassment and discrimination, the hotline offers company management the opportunity to uncover and address issues before they are exposed by the media, thereby protecting the company from the additional loss of goodwill in the eyes of its customers, investors, and other stakeholders.

Selecting a system
As noted earlier, systems to allow the reporting of fraud have been in place in many organizations for several years. Some systems have been internal firm-operated programs; others are operated by vendors. Since the enactment of the Sarbanes-Oxley Act, existing vendors have significantly increased their client base and new vendors have proliferated to take advantage of the market opportunities. In response to the U.S. Sentencing Commission incentives to encourage companies to establish corporate ethics programs, many companies set up various methods of providing employees an opportunity to report wrongdoing. Some companies established the position of chief ethics officer to oversee the corporate program. Others appointed ombudsmen to address complaints and allegations of wrongdoing. Hotlines were established too.

At minimum, a hotline is an answering machine that records messages to be played back by company personnel or call forwarding systems that send calls to an in-house department. Resource limitations, however, may deter some small firms and privately held firms from having compliance programs. Practitioners should remember that these limitations also increase their vulnerability. Small firms particularly tend to be less formal in structure, culture, and means of communication and less likely to have formal training, documentation, and standards. They also tend to be more focused on customer satisfaction than on compliance.

The hotline services that sprouted up in response to Sarbanes-Oxley requirements are generally toll-free phone lines operating 24 hours a day, 7 days a week, 365 days a year. With many new players in the field, the need for caution in purchasing their services goes without saying. Recently, the Wall Street Journal reported the cautionary comment of Roger Raber, president and CEO of the National Association of Corporate Directors, Washington, DC, who said, “Nine out of 10 are new people that don’t have a track record or a client base”

Several factors are key to effective operation of hotlines:

• Around-the-clock availability. Most employees and other tipsters are unlikely to call during working hours to report illegal activity. According to hotline studies, at least 40% of calls come at night or on weekends. An unanswered call will probably discourage the tipster from calling again. A caller is likely to be at least nervous and may even feel threatened, so it’s preferable to have a trained interviewer answer calls. A nervous tipster may leave out significant details. A trained interviewer should know what questions to ask to ensure that the company gets enough information to investigate the allegation.

• Anonymity and confidentiality. Employees probably will be uncomfortable calling an internal number or reporting their allegation to an employee, who may recognize their voice or identify the caller because of some telling detail in the allegation. Confidentiality must be preserved and the caller must be protected against possible retaliation. (Sections 806 and 1107 of the Sarbanes-Oxley Act provide whistleblower protections. See the sidebar on this page.)

• Case management system. To ensure that complaints and allegations are tracked and addressed, a database of original reports will allow the hotline administrator (and when appropriate, the audit committee) to review reports. The data captured should include what was done to investigate the allegation, the final disposition, and the disciplinary or corrective actions taken. The Sarbanes-Oxley Act requires that public companies have a case management system whereby the audit committee is notified of allegations of insider trading, improper loans to executives, retaliation against whistleblowers, conflicts of interest, and accounting irregularities. Incident reports of such wrongdoing related to senior executives should be routed automatically to one or more audit committee members to help ensure that they reach the board and are not intercepted or covered up.

Launching a hotline
Like any new initiative, launching a hotline requires an effective communication program. The first step is for senior management to announce the goals of having the hotline program and the reason for implementing it. In a public company, the goal would be to give employees every opportunity to communicate to the company and to the board of directors. Every employee should receive a letter or flyer announcing the program, along with a business card with the hotline phone number. Employees should be introduced to the program in meetings, and posters around their work areas should reinforce the messages they’ve been given. New employees should receive this information as part of their orientation.

The company should document that employees have received information about the hotline and understand it. To avoid abuse of the hotline, for example, employees calling to complain about an “unfair” review or the cafeteria menu, the communication program needs to make clear the hotline’s purpose, as well as the appropriate mechanisms for addressing complaints if no wrongdoing is involved.

Finally, in planning an implementation program for this inititative, remember the guidance offered by Dominic Cingoranelli in the October issue of Practicing CPA (see “Communicating Change Initiatives”): “. . . repetition is not only all right, but also a must.”