Fraudulent or corrupt acts may occur in your organisation right now. They may include a wide range of behaviors such as breach of trust, employee misconduct, fraudulent statements, assets misappropriation, criminal offence, and so on. The consequences of those fraudulent activities for organizations can go well beyond the direct financial loss to include regulatory investigations and media embarrassment leading to further damage to reputation, loss of staff’s motivation, loss of customers and ultimately destruction of shareholder value.
Why would a Whistleblowing Policy help your organization in your Fraud Risk management Efforts?
Over the past couple of decades, well publicized corporate troubles and collapses such as Enron, Worldcom, NKF, Olympus, UBS, HSBC and NSA scandals just to name a few have highlighted the key role of whistle blowers in bringing to the surface these frauds. Indeed researchers agree that about 70 to 80% of fraud losses are usually committed by the internal staff of an organization and that in most of the cases, they were eventually detected because somebody from the inside or outside blew the whistle.
Indeed it is not far-fetched to assume that when someone is involved in a fraud or any kind of misconduct, there will most likely be somebody else inside or outside the organization who knows about it or at the very least suspect it. Hence when looking to uncover possible frauds in your organization, one of the key source of information could therefore be your own staff and other key relevant stakeholders such as suppliers for example. Regrettably organizations too often fail to capitalize effectivelly on their employees as a potential essential resource in their fraud detection and control mechanisms.
The sad reality illustrated by the many stories making the news headlines is that if they had used this resource properly with an effective whistle blowing policy in place, those organizations could have stopped the fraud they were the victim of much earlier and possibly saved themselves a lot of troubles and even ensured their survival.
What will happen if your organization do not have a Whistle Blowing Policy or if the Policy is improperly designed, implemented and communicated?
In such cases, people will usually NOT report spontaneously about what they see or know. They will likely keep quiet about it for a number of reasons I will explore later in this post one of them is the fear of getting themselves into troubles. This in turn will prevent the organization from identifying and hence addressing the issues until it is unfortunately too late for effective corrective actions to be taken and to avoid painful consequences..
Those who do dare to report something will usually prefer to do it anonymously often by-passing the ‘official’ reporting procedure set by the organization in order to avoid exposing themselves. Although this kind of random anonymous disclosures might be considered as better than nothing, it is in fact a real problem for organizations as it means that if the management decide to act upon it, they may have to go on “a wild goose chase” based on often too limited or even dubious information. It is also important to keep in mind that in some cases of anonymous allegations, the whistleblowers can also have malicious intentions making partially or totally incorrect allegations to promote their own agendas. If not managed carefully, those malicious allegations could destroy the reputation of the wrongly accused employee, severely affect the morale of the rest of the staff and damage the credibility of the management who mishandled the situation.
On the other side, if the management decide to do nothing about the anonymous disclosures, there possibly missing an opportunity for early detection and action on a real fraud situation leaving it as a time bomb that will inevitably explode sooner or later. Furthermore if the management is perceived to do nothing or move too slowly in its investigations by the whistle blower, the situation can get worse on that front as he/she may contact the media and/or the regulatory authorities and /or the police. Any suspicions of fraud or corruption that are brought to the attention of the media have the potential to blow off into a major public scandals creating tremendous damages to the reputation of an organization and even in some cases, possibly threatening its survival.
Why people will often not want to blow the whistle openly using official channels set by the organization?
There are a number of reasons for that and I will now review them in more details:
1 – Fear of Retaliation: The main reason is the same everywhere! FEAR! While many regulations have been enacted all around the world to provide some protection for whistleblowers such as for example the Sarbanes-Oxley Act in the United States and despite reassurance from the management in many organizations that retaliation against whistle blowers will not be tolerated, many employees arround the world strongly fear they will likely suffer from “blowing the whistle”. Indeed for those people who do blow the whistle, the consequences can be disastrous! It is an unfortunate fact to stress that far from being celebrated as corporate heroes saving their organizations from potential destruction, the data from many documented cases with my own experience as a whistleblower included shows that most whistleblowers are somewhat “punished” and often have their careers ruined by their honest actions. Many publicized cases have highlighted how whistleblowers are ostracized, bullied, over-looked for promotion, or treated so badly that they have to leave a job that has become untenable. In worse case scenario, they can even end up in prison or face life-threatening situations. Furthermore considering that the current volatile economic climate reinforces the general feeling of insecurity among employees, whether it is true or not, that their jobs are always potentially at risk, many employees fear that they will increase the likelihood of losing their jobs if they make noise and rock the boat by raising their concerns!
2 – Cultural Impediments: There are also a number of cultural factors that discourage employees from reporting the acts of misconduct they are aware of. These factors and their importance may differ from one cultural environment to the other and hence as such adding a significant level of complexity for multinational organizations to learn to manage effectively. Examples of cultural factors include the issues of Divided Loyalties and Submission to Authorities that play an important role in influencing people behaviors in many societies. The problem can be particularly acute in certain Asia countries first due to the essential importance of families and personal ties in business relationships and second because of the hierarchical nature and the importance of power distance in those societies as defined by Geert Hofstede in his research study on “cultural dimensions theory”. For example in Korea and Japan, a strict seniority system is dictating that employees must show unbounded loyalty to their superior and co-workers. This kind of environment will discourage those employees from questioning management decisions even when facing life or death situations. The Historical background of a country can also exacerbate an existing bias against whistleblowing policies as it can bring back negative memories to employees such as the horrors of the Nazi surveillance system in Germany, the denunciations of the Cultural Revolution in China, the apartheid-era informants in South-Africa and so on. All these factors are making it very difficult to make whistleblowing procedures acceptable in those countries.
3 – System & Processes issues: Corporate whistleblowing resources are often under utilized simply because from a practical point of view, they are often insufficient, badly designed and improperly communicated to the employees who are then confused about what to do with them. There is also often a basic problem of trust in the reliability and effectiveness of the system put in place especially when influencial and powerful figures are the subject of the disclosure. Potential whistle blowers who have concerns that they want to report must feel the whistleblowing policy and system can be relied on. They may feel, it is often not the case.
How to connect effectively with the people who might be aware of possible wrongdoings?
The earlier an organization can detect a fraud, the faster they can deal with it appropriately. Early detection may save the organization by allowing them to take the appropriate actions diminishing the damage to its operations, reputation and business. When the whistleblowers can be identified, the organization will be able to obtain more complete and accurate information about the allegations raised and eliminate incorrect or malicious allegations while clearly identifying the areas that need further investigations. Hence organizations should encourage whistleblowers to come forward and report suspicions of fraud and misconduct in a formalised manner through a well-designed whistle blowing policy.
The policy should be designed to really encourage employees including former employees, customers and suppliers – to raise concerns to the management using properly defined channels, rather than keeping quiet about the problem or throwing out through various means random anonymous allegations. To achieve that, it is essential to understand the issues from the whistle blower’s perspective i.e. fear of retaliation and cultural impediments and address them appropriately. This means sending a clear message to potential whistleblowers that unambiguously responds to the concerns that would otherwise stop them from coming forward. Questions potential whistleblowers will ask include: What sort of concerns I am right to raise? What evidence do I have to provide? What will you do about my disclosure? How are you going to investigate? What will happen to me? How are you going to protect me?
The organisation should be seen as responding positively to concerns raised, and acting both to protect the whistleblower and fix the issue raised. Therefore the objective of an effective whistleblowing policy should be to create an environment where people feel safe and confortable raise the concerns about possible fraud and misconduct issues they may have observed within the organisation.
With that in mind, implementing a whistle blowing policy should involve the following key steps:
- Assess the existing culture of the organisation and clarify the cultural impediments and other obstacles;
- Clarify the sort of whistleblowing policy approach that is most likely to be effective within that environment;
- Decide on the scope of the whistleblowing policy;
- Define and allocate the resources necessary both to promote whistleblowing and manage the system put in place;
- Communicate and ensure appropriate training about the whistleblowing procedure and what are the options available to those who have concerns they wish to raise;
- Managing the disclosures and subsequent investigations in a way that reinforces the message that the organisation will act on legitimate whistleblowers disclosures and treat any case of fraud or misconduct very seriously;
- Finally verify effectiveness and ensure periodic reviews of the Whistleblowing policy and procedures in place.
The Whistleblowing policy should include the following key elements:
- clarifies the wrongdoings that need to be reported in a clearly written code of code of conducts and ethics;
- Set and map the different ways by which employees can make their concerns known about suspected acts of fraud or misconduct;
- Outlines how the organization will deal with such instances;
- Ensure independent confidential investigation proceedings;
- Protect both those people who raise concerns as well as the people subject of the disclosure;
- Ensure no double standards with zero tolerance to fraud and misconduct with tough enforcement on the rules set in the policy;
- Finally it must linked to commitment to the development of a culture of ethics based on honesty, integrity and accountability.
This last point is very important. Indeed while having a robust whistle blowing policy in place is an essential best practice for the management of any organization, in addition, to be really effective, organizations need to nurture a culture in which employees will do the right thing knowing that their concerns will be taken seriously, and that the protection provided by both the law and internal corporate policies is real and effective.
To conclude, a whistleblowing policy is at the heart of a strong culture & system of corporate ethics and compliance. By promoting a strong whistleblowing policy, your organisation sends a clear message to all staff and others that compliance with certain principles and values is fundamental to the long-term success of the organisation and by this potentially discouraging some would-be fraudsters from taking actions while encouraging other employees to report concerns appropriately.
I was invited to speak and share my views on “How to Encourage Whislteblowing as an effective tool to prevent and detect fraud” during the 2013 ASLI Internal Fraud Conference in Kuala Lumpur and I thought it would helpful to share the presentation I gave at that conference. Therefore I have attached it in this post below. Enjoy and if you have any questions do not hesitate to contact me.
Risk Management Demystified 