On paper it looks easy.  In practice, it is much harder.  In a multi-level organization, how do you encourage internal reporting and make sure important issues are raised to the appropriate level in an organization?  This is an often over-looked issue and one that needs attention.

A specific protocol and policy needs to be designed and communicated within the company.  The policy has to reiterate the company’s commitment to responding to internal reports of suspicious misconduct – a potential violation of law or breach of the company’s code of conduct.

To the extent possible, employees should be encouraged to report to their immediate supervisor (unless he or she is suspected to be involved).  Once the report has been made, the company has to decide who will investigate the incident and how to treat the employees under suspicion.

The procedures need to: ensure that further loss will be prevented;  how to establish and secure the evidence needed to evaluate the complaint; notify the relevant authorities; minimize and recover any losses; take disciplinary action against those involved; review the reasons for the incident, the measures taken to prevent a recurrence, and implement actions to strengthen procedures.

All reports should  be treated seriously. To encourage employees to fulfill their obligations, these reports may be made anonymously. Moreover, corporate policy is to keep confidential the identities of all employees reporting suspicious conduct or potential violations.

The company should establish a list of contact persons across the organization who are available to provide advice and to receive reports of suspected misconduct.  An anonymous hotline should also be established and publicized.

Once a report has been made, and assuming further investigation is warranted, the Company should explain how it will investigate such allegations.  The General Counsel should be  responsible for overseeing all investigations relating to potential violations of law and of corporate policies, however, it may be deemed appropriate for work to be carried out by external investigators as determined by the General Counsel, senior management or the Board, depending on the seriousness of the allegation.  The Company’s investigation protocol should conform to the same standards and in accordance with law.  Investigation results will not be disclosed to or discussed with anyone other than those who have a legitimate need to know. This is important in order to avoid damaging the reputations of suspected persons, but subsequently found innocent of wrongful conduct, and to protect from potential civil liability.

Managers need to be trained on how to receive complaints and how to treat any employee reporting suspected misconduct.  Specifically, managers need to:

1.  Listen to the concerns of staff and treat every report seriously and sensitively.

2.  Reassure the person making the report that they will be protected from victimization, reprisals, or other adverse consequences arising as a result of the report.

3. Explain the company’s reporting procedure:

            a.  The person receiving the allegation (internal or [anonymous]) will make a written report summarizing the matter.

            b.  The written report will be sent to the General Counsel, as appropriate, who will initiate appropriate action.  The General Counsel will communicate this decision to the person making the complaint as soon as possible (internally or anonymously).

4. Obtain as much information as possible from the staff member, including any notes and any evidence they have that may support the allegation. They will not interfere with any evidence and ensure it is kept in a safe place.

5. Contact the General Counsel to confer about the nature of the allegations and the appropriate next steps.

6. Draft a written report, in conjunction with the General Counsel, if deemed necessary, summarizing the details of the alleged violation, including: relevant dates; nature of the incident report, i.e., phone call, letter, email, fax, etc.; details of person making the report (name (unless anonymous), position and business/department, length of time they have been in this position; relation to  person involved in alleged violation; and details of the alleged violation.  The report should not include a conclusion or judgment about the allegations.

In cases where an individual is suspected of wrongdoing and a subsequent investigation does not substantiate, it is important that the potential damage to the individual’s reputation is minimized. Whoever originally reported the suspected misconduct will be informed that the investigation has revealed no wrongdoing.