Corporate leaders know what to say and when to say it – for example, a CEO may state at an employee meeting, “We want to hear your concerns. We want you to bring these concerns forward and we will address them.  We are committed to this as part of ethical culture.”

The CEO’s comment is all well and good – it is a positive step forward.  But the real question is whether the company backs up its statement through specific actions.  This cannot be accomplished through words, but really only through deeds – actions.  All  too often companies get ahead of themselves and make broad pronouncements without building the essential foundations and infrastructure needed to establish an effective employee reporting system.

The most common deficiency in this area is fairly obvious – companies confuse a hotline system with the requirement to create and track all employee reports from whatever source.  A partial view is by definition limited and ignores key data that is essential for any employee reporting system.

DOJ has been clear on this important issue.  A company has to track all employee reports from whatever source – hotline, walk-ins, supervisor reports.  This is commonly referred to as “Incident Data.”  Chief Compliance Officers are required to obtain access to all such data – meaning Human Resources has to share data with CCOs so that CCOs can stay on top of employee concerns. 

Incident data has to include the following: (1) nature of the concern; (2) source of the report; (3) type or category of report (e.g. code of conduct, bribery, fraud, harassment, discrimination); (4) number of reports; (5) geographic location of concern; and (6) brand, product or division of report.  If maintained on a regular basis and analyzed in real-time, this data provides a clear picture of a company’s culture, risks that may be developing, and areas for intervention.  It is essential for CCOs to monitor employee reporting to respond with proactive intervention strategies.

It is clear that employee reporting data is an important indicator of a company’s overall health.  In some cases, potential problems can raise significant risks if not addressed.  A real-time monitoring capability is an important element of a commitment to a proactive compliance program that can adjust nimbly to intervene and respond to concerns quickly and effectively.

A CCO needs to collect such data from across the organization through coordination with internal partners, including Human Resources, Security, Finance, Legal and other important partners. DOJ has mandated such sharing “across the levels, geographies, units or departments of a company.” If a company ignores this clear mandate, it does so with the attendant and unaddressed risks.   CCOs need to take this data, slice-and-dice it among various categories to identify trends, raise questions and follow up.

With this important tool and source of information, CCOs can report regularly to senior management and the board on the overall health of an organization.  Incident data is one of many sources of information but it is an essential aspect of any ethics and compliance program.  Corporate boards that are engaged should learn about important employee concerns, status of investigations, and trends in overall reporting data.  CCOs have to lead on this issue and educate corporate boards and senior management on the crucial function of employee reports.

As part of this effort, CCOs have to ensure that internal messaging is clear – the company wants to hear from employees, the company is committed to investigate and address any misconduct, the company will promptly and fairly conclude such investigations and mete out appropriate disciplinary actions in a fair and consistent manner.  CCOs have to view this system as a vital component of an effective ethics and compliance program. When a company fails to implement an appropriate employee reporting system, the company’s risks increase exponentially.