Four Whistleblower Hotline Best Practices

Lin-Jimmy130By Jimmy Lin
From Compliance & Ethics Professional, a publication for SCCE members.

Before the Sarbanes-Oxley Act (SOX), a hotline reporting program was often viewed as a luxury rather than a necessity. However in the 12 years since the law passed, the whistleblower hotline has become an essential part of any successful ethics and compliance program. Hotlines have become a critical means for detecting any kind of misconduct within an organization and have led to high-profile investigations. They also serve as a way to gauge the effectiveness of an organization’s ethics and compliance initiatives, and can identify any program shortcomings.August CEP Cover

To realize all these benefits, however, companies must regularly re-evaluate their hotline to ensure it aligns with today’s best practices. Set aside time annually to audit your organization’s whistleblower hotline and see if it follows these four best practices.

Demonstrate trustworthiness 

Without employee buy-in, companies risk employees either not reporting misconduct or worse, reporting it outside the organization. Therefore, companies can instill confidence in their employees by demonstrating commitment to an ethical workplace and providing numerous ways employees can report their concerns. Communicate your company’s values and find ways to reward ethical behavior. Employees who believe their company values an ethical culture will be more likely trust that their reports of misconduct will be taken seriously.

[bctt tweet=”Four #whistleblower hotline best practices @SCCE”]

Give options for coming forward
Some employees may feel comfortable openly coming forward, but others may not. Fear of retaliation from managers or co-workers often scares people out of speaking up. The most effective way to learn about potential misconduct before any reputational, financial, or other serious damage can occur is to provide employees with a variety of methods for reporting their concerns. Today’s workplace calls for hotline reporting programs to be more than just telephonic in nature. Most include Web-based, text-based and other electronic reporting options.

However, companies must ensure that in every case all the critical information needed to adequately begin an investigation is gathered. Interactive communication, such as a telephone hotline interview, tends to generate more detailed information.

Maintain a clear escalation and dissemination plan
In order to guarantee all reports are addressed in an appropriate and timely manner, companies must have and maintain a clear escalation and dissemination plan. Executives and compliance officers should agree on a list of critical topics that, if reported, would require immediate escalation 24 hours per day, versus topics that can wait for normal next-business-day operations. For example, violence or physical harm to employees or customers, threat of business interruption, and notice of a high-risk incident within the next 24 hours are almost always classified as critical and require immediate escalation. Other incidents may also require immediate escalation depending on the nature of the business and threat. Create a document on the escalation process that lists key personnel to contact, how they can be reached, and how to manage high–risk reports.

Deciding where to send information that is received through the hotline is equally as critical. Best practices call for dual dissemination as a system of checks and balances to ensure complaints are not overlooked or mishandled. This often involves the ethics or compliance officer receiving copies of all the reports in addition to the person responsible for the investigation. Some companies also choose to send copies to a member of the Human Resources department. Having a clear dissemination process will ensure that an investigation is carried out in a timely manner.

Single hotline and third-party hotline considerations
Some organizations have multiple hotlines for different issues; however, this approach is not only an administrative burden, but it can also be confusing and discouraging to employees. Having more than one hotline may cause employees to feel unsure about which hotline is best suited for their concern, especially given that misconduct can cross multiple categories. Having a single general ethics and compliance hotline in place allows companies to focus their efforts on supporting and promoting awareness around just one hotline.

An internally-staffed hotline is a viable option, as long as it allows employees to report anonymously and satisfies the requirements under SOX, but there are some serious drawbacks to consider. A third-party hotline provides employees with the reassurance that their anonymity is safeguarded and has inherent objectivity. Their staff is trained on how to capture all necessary information and address employee concerns.  A third-party hotline also has well-established processes for capturing and disseminating reports.


A whistleblower hotline is a critical part of a broader program of building and maintaining an ethical company culture. Organizations must ensure their hotline is in line with today’s best practices in order to best serve employees and protect the business.

Jimmy Lin ( is Vice President of Product & Corporate Development and leads corporate and product strategies for The Network’s Integrated GRC Solutions in Norcross, GA.

Care to comment? Click here for comment-enabled version.