How To Conduct A Whistleblowing Investigation

Whistleblowing is an essential governance and risk management tool that increases the likelihood of identifying misconduct before it becomes a public nightmare. However, it also presents a complex challenge for organizations. Organizational incentive structures, inadequate processes, and the sensitive nature of conducting a whistleblowing investigation can hinder your organization from achieving a balanced outcome.

‍

This article serves as a guide to help your enterprise conduct effective whistleblower investigations. It explores the challenges you may encounter and provides techniques to avoid undesirable outcomes. Specifically, we will focus on the response you should initiate upon receiving a whistleblowing report.

‍

Our Responsibilities

‍

Case Managers or Corporate Investigators (depending on how your program is structured) must carefully review the whistleblower's report. They should avoid the temptation to apply judgment immediately, even if the report seems baseless or is of minimal risk to the organization. Failure to take reports seriously undermines your entire whistleblowing program and could prevent the full identification of the underlying risks or hinder insightful investigations before your investigation even begins.

‍

The goal of the case manager or corporate investigator “the investigator” should be to provide the whistleblower with a safe harbor, first and foremost by protecting their identity, followed by either substantiating or clearing the report as unsubstantiated in a fair and just manner. When reporters make a report, they take the risk of conveying sensitive information at a high individual risk, generally with no personal upside to doing so. For this, they deserve the investigators investment in protecting their anonymity. Whistleblowers should feel that their organization cares about their report and invests in validating the accuracy behind it. 

‍

As case managers or investigators, a large part of our role is to de-escalate the situation, allowing us to validate the contents of the report and to help the organization reduce or remove the underlying risks. At the same time, it's critical that we enter the investigation presenting realistic expectations on what can happen throughout the investigation procedure. In particular, we should set realistic expectations on the duration, not make promises regarding the outcome of the investigation and avoid the pitfall of setting expectations that the whistleblower will receive a detailed report at the conclusion. This is often not possible due to a combination of limitations, such as data protection and confidentiality for those investigated or involved,.

‍

Avoiding Retaliation 

‍

Organizations must not retaliate against reporters for bringing wrongdoing to their attention. In most developed countries, such actions are often in breach of the law.

‍

Retaliation can take various forms. The most common are employment actions, including termination, pay cuts, hours reductions, or giving the whistleblower unfavorable/impossible assignments. More extreme cases may involve verbal threats, spreading rumors about the concerned individual, sexual harassment, and social ostracism. Organizations may also use tacit retaliatory tactics to make prosecutions more difficult. For example, they may unfairly evaluate an employee or isolate them from the rest of the team to force their resignation.

‍

Various laws prevent for example, the Sarbanes-Oxley Act forbids employers from retaliating against employees for bringing financial or accounting fraud cases to public attention. The Dodd-Frank Wall Street Reform and Consumer Protection Act performs similarly, stopping financial firms from retaliating when employees highlight security law violations. Federal employees get their protection from the Whistleblower Protection Act. This statute prevents government agencies from mistreating workers who highlight wrongdoing in their organizations. 

‍

Building An Investigation Plan

‍

As the investigator you need to remember the importance of building a robust investigation plan once a report is received within your secure whistleblowing platform. This software is essential for organizing the investigation, ensuring compliance with relevant laws and regulations, and protecting the anonymity of the whistleblower.

‍

When crafting an investigation plan, the primary focus is on ensuring that the investigation is conducted in a fair, objective, and credible manner (whilst protecting the reporter's identity). The plan must be designed to withstand the scrutiny of future regulatory investigations or legal proceedings. It is crucial to demonstrate that the organization takes the whistleblowing report seriously and is committed to addressing the alleged wrongdoing if substantiated.

‍

A key aspect of the plan is determining the scope of the investigation. This involves assessing the number of individuals who need to be involved in the inquiry, for less serious issues, you may be able to conduct the investigation individually, with support of the program owner or committee. However, for cases involving serious or complex issues such as accounting fraud, you may need to bring in the right level of expertise and independent parties such as financial forensics or outside counsel.

‍

The investigation plan should also clearly define the goals of the investigation. These may include determining the extent of the wrongdoing, assessing the financial impact, understanding the human cost, whether the incident was isolated and deciding whether terminations are warranted and self-reporting to regulators required. By setting clear objectives, the investigation can remain focused and efficient.

‍

Next, we need to put in place a framework for validating the accuracy of the claim. This could include reviewing internal documentation, such as financial statements, reviewing conversation or email transcripts or interviewing parties who were present when the incident occurred.

‍

Finally, the plan must include a realistic timetable for the investigation. As a best practice, we should strive to complete investigations promptly to minimize disruption to the organization and to demonstrate our commitment to addressing the issue. However, it is also essential to be aware of any specific deadlines imposed by regulatory bodies. For example, the Securities and Exchange Commission (SEC) sets strict deadlines for financial companies during government investigations or qui tam lawsuits to prevent misstatements that could mislead external stakeholders.

‍

Bringing A Team Together

‍

Once the plan is in place, organizations should assemble their investigation team. Some investigations are conducted internally, while others include outside counsel and specialized experts. The Board, Risk or relevant oversight Committee should ensure that the teams have the necessary skills and resources to complete their investigations reaching accurate conclusions. Improper collaborations should be avoided at all costs. For example, it is critical that any parties connected to the report, such as the department manager, are isolated away from the investigation.

‍

During the investigation process, teams should consider whether to maintain attorney-client privilege. On the Confide Platform, this can be done by inviting your external counsel into the report. Even if this route is taken, companies may choose to waive this privilege under law but can wait until they complete their report before doing so.

‍

Throughout this process, the investigator should collect documents, interview witnesses, and record investigation notes within the case management system. Choosing the right whistleblowing system is critical at this stage to ensure you have the right tools to execute your end-to-end investigation, without having critical information stored across a myriad of internal systems. 

‍

In many cases, companies must conduct witness interviews. These enable them to obtain relevant information and investigate the whistleblower's report across all facets. Planning ahead of your interview is critical to ensure it is structured, avoids off-the-cuff comments, and remains professional. Prior to the interview, you should define the objective, prepare a set of questions, and manage this within a system that allows you to capture the transcript of the conversation to avoid future "he-said-she-said" scenarios. If multiple individuals need to be interviewed, plan the sequencing in advance. Generally, it is best practice, depending on the nature of the case, to interview the most junior individuals before more senior stakeholders and to conduct the interview with the accused last. If there exists significant distrust between the reporter and the organization, and the report is of a serious nature, consider bringing in impartial and independent experts, such as Confide's Incident Response team to conduct this interview.

‍

Drafting A Report

‍

The last phase is to draft a final report stating the investigators conclusions. Depending on how your program is structured, you may need to produce multiple reports for different stakeholders, such as one for your oversight committee, another for the whistleblower, and a final one for a regulator. The report should include an executive summary, information about the witnesses interviewed, the fact-finding methodology, findings, and recommendations. The author should also differentiate between so-called "known facts" – self-evident discoveries – and inferences based on "connecting the dots." This distinction adds nuance to the report and ensures relevant stakeholders and officials receive a balanced picture of the findings.

‍

As the investigator, it is crucial to understand that companies under investigation can use reports with the foundations of a solid investigation and a clear remediation plan (with progress) to gain leniency if the matter is of a serious nature and under regulatory investigation. Government departments may reduce penalties if they see evidence that the firm took internal mistakes seriously. 

‍

When drafting the final report, it is recommend to following these best practices:

‍

1. Clearly state the scope of the investigation and the specific allegations or issues addressed.
2. Provide a detailed timeline of the investigation, including the steps taken and the individuals involved.
3. Present the findings in a clear and concise manner, supported by evidence and witness statements.
4. Identify any systemic issues or weaknesses in the organization's policies, procedures, or controls that may have contributed to the misconduct.
5. Offer practical and actionable recommendations for remediation, including specific steps the organization should take to prevent similar incidents from occurring in the future.
6. Ensure that the report is written in a professional and objective tone, avoiding any speculation or personal opinions.
7. Have the report reviewed by legal counsel to ensure it is legally sound and does not expose the organization to unnecessary risks.

‍

By following these best practices and presenting a comprehensive and well-structured report, investigators can provide valuable insights and recommendations to help organizations address misconduct, improve their internal controls, and demonstrate their commitment to integrity, regulatory compliance and protecting stakeholders.

‍

Within the Confide Whistleblowing Platform, we simplify and streamline this process by allowing you to pre-define final report templates. These templates are structured to populate the key details, saving you time after a lengthy investigation.

‍

Gain Your Organizations Unfair Advantage With Confide's Whistleblowing Software

‍

Developed by seasoned lawyer and Wirecard Whistleblower Pav Gill, Confide has free whistleblowing software all organizations need to accelerate whistleblowing investigations without compromising integrity or compliance. 

‍

Confide provides a Total Compliance Platform that enables anonymous whistleblowing, fearless reporting, and early detection. Designed by professionals with a deep understanding of whistleblowing investigations, Confide is your secret weapon to whistleblowing compliance.

‍

Get in touch with the Confide team today to get started.

‍