Tip lines are one of the most effective tools organizations possess for detecting and preventing fraud. Fifty-nine percent of forensic and valuation CPAs participating in the AICPA’s 2011 Forensic and Valuation Services Trend Survey said internal whistleblower hotlines would lead to improvements in preventing fraud in the next two to five years. Internal tips were cited by business and industry CPAs participating in the same survey as the most common detection method for frauds that occurred at their organizations.
Because tip lines encourage and facilitate anonymous reporting, they are a proven fraud deterrent that can be successfully implemented without burdensome effort or expense. This article lays out a path for maintaining a tip line, including key features and best practices learned by public companies. It concludes with a description of different levels of service provided by web-based tip line providers, including features and estimated costs.
TIP LINES AND A CODE OF CONDUCT
Tip lines help enforce corporate codes of conduct that, at a minimum, help ensure compliance with standards, laws, and regulations. Best practices are derived from public companies that have been required to provide fraud reporting mechanisms as part of compliance with the Foreign Corrupt Practices Act and the Sarbanes-Oxley Act of 2002. In evaluating compliance and ethics programs, the Department of Justice (DOJ) and SEC are looking for programs that are thoughtfully constructed and well-implemented to help prevent, detect, and report fraud. In formulating sentences after adjudication, the DOJ and SEC review company ethics and compliance programs. A thoughtfully designed, good-faith effort can mitigate sentences.
Tip lines reinforce company policies, making it clear that unethical conduct is unacceptable, and help set a tone of control for an organization. Codes of conduct can be conceptual and values-based, or rules-based and specific. Ethics training is important to ensure that employees are clear on expectations. Training should be part of the new employee orientation process and also should be regularly reinforced along with the company code of conduct at meetings. Codes of conduct are implemented with guidance on what to do should an employee observe a violation of the code. This is where a company tip line provides support.
TIP LINE CHARACTERISTICS
Tip line design or contracting requires thoughtful planning and consideration of company operations. Does the company require multilingual services or 24-hour access 365 days per year? The following characteristics are key considerations in tip line implementation, monitoring, and governance:
Tip input. The input process must serve the needs of employees, customers, suppliers, and other stakeholders. Tip lines can accept input by mail, email, web-based systems, and fax; in person; and via toll-free operators.
Anonymity. Anonymity and continued confidentiality are critical tip line features. Just over 50% of tips come from employees. Any risk of identity disclosure could negatively affect employees’ willingness to report.
Availability. Tip lines are generally available 365 days per year, 7 days per week, and 24 hours per day. If a company operates globally, around-the-clock access is a necessity.
Multilingual. Multilingual capability is necessary for employees as well as customers, vendors, and others.
Case management. Case management functions allow the company to track a report from initiation through resolution. Lack of follow-up can increase vulnerability in the event of prosecution. Case management systems allow online access to filings; assignment of the case to the appropriate person for follow-up; assignment of priority level; actions taken and resolution; report generation; file attachment; and anonymous follow-up dialogue with the complainant for additional information.
Compliance monitoring. A corporate governance policy requires monitoring to be effective. A tip line system is effective only if tips are correctly captured, reported to the appropriate individuals, and followed up. Some tip line providers offer compliance monitoring in concert with international privacy and reporting requirements.
Internal control review. As part of a periodic review of internal control procedures, finance staff should be asked directly whether they are aware of any irregularities. The pressure of going “on the record” personally, and perhaps abiding by professional ethics, frequently elicits honest responses.
Employee awareness. Implementation of a tip line requires periodic employee training to introduce and promote its use.
Organizational placement. It is critical that the tip line be operated by an area independent of finance. Publicly held companies have a compliance officer or an internal audit department. In the absence of these departments, human resources should operate the tip line.
Responsibility for follow-up. Tracking the entry of tips, assignment of responsibility, status of investigations, and outcomes is a critical and often expensive task. Tips that are not acted upon can signal the lack of a bona fide commitment to ethics on the company’s part. Incident reporting should include the member of the board of directors tasked with monitoring security and controls. Roles and responsibilities for reporting and follow-up of internal control issues should be part of standard board reporting. Tips on material issues should receive an escalated response that immediately alerts the chairman of the board.
Audit trail. A well-documented audit trail is key to a successful defense in court and to maintaining accountability. Companies need to document the sequence of events taken in response to a tip, including dated documentation, assigned responsibility, actions taken, and final resolution.
TIP LINE SOLUTIONS
The authors examined features, functions, and pricing for a sample of tip line providers. Solutions are both cloud-based and web-based. All of the tip line companies provide anonymous, 365/24/7 access and a variety of means of accessing the tip line. Functionality ranges from companies that simply provide hotlines to those that provide tip lines in addition to a full governance, risk, and compliance program. Case management services can include a variety of features but generally refer to incident tracking from first recording the issue followed by assignment of the issue to a responsible party to final resolution. Case management also includes tracking of unresolved claims and maintaining a clear audit trail.
Language capability should be carefully considered. English and Spanish cover the first and second languages of most U.S. residents, but if a company has global operations, more extensive language capability may be needed.
Costs are generally reasonable considering the risk of loss; minimum annual fees range from $500 for up to 100 employees to $2,000 for a cloud-based software solution. Cost considerations include reporting needs for compliance, various training options, and case management options. Different pricing options frequently exist for not-for-profits.
Exhibit 1 shows the ranges of services offered, broken into three broad categories, with entry-level cost estimates for companies with fewer than 100 employees, and tip line features. All companies providing tip line services emphasized the need to contact them for more information on services, customization options, and pricing.
THE BOTTOM LINE
The overwhelming evidence in support of tip lines has spawned the development of several third-party tip line options. A good tip line can help a company defend against lawsuits, provide employees and others with an outlet for reporting ethical misconduct, and emphasize fairness in an organization. Early reporting enables companies to take corrective action before a problem creates a serious threat. Whether a small company is at the beginning of the curve and needs to develop a code of conduct and implement a tip line, or is more mature and interested in more-developed risk management solutions, several well-developed companies embody best practices and lessons learned. Given the avoidable risk, there is no time to delay.
EXECUTIVE SUMMARY
Tip lines are one of the most useful tools available to an organization for detecting fraud. Best practices for tip line design, implementation, and monitoring have developed as a result of regulatory requirements for public companies to have systems to receive and track complaints.
Fraud hotlines reinforce principles that should be part of a company’s code of conduct, stating that unethical behavior is unacceptable. Tip lines provide support for the code of conduct by giving employees a mechanism for reporting violations.
Thoughtful design and planning, with consideration of company operations, help ensure implementation of an effective tip line. Around-the-clock access, anonymity, and multilingual capabilities are key considerations.
Service providers offer cloud-based and web-based options that can be relatively inexpensive in comparison to the dollar value of the risks they can help mitigate. Basic phone, email, and mail answering services cost considerably less than services that track complaints and also provide employee education, training, audit support, and case management.
Christine P. Andrews ( candrews@salemstate.edu ) is an associate professor of accounting at Salem State University in Salem, Mass. Brian P. LeBlanc ( bleblanc@salemstate.edu ) is an instructor of accounting at Salem State University. The authors wish to thank Salem State University student Daniel Lucier for his research assistance.
To comment on this article or to suggest an idea for another article, contact Ken Tysiac, senior editor, at ktysiac@aicpa.org or 919-402-2112.
AICPA RESOURCES
JofA articles
- “What Are the Risks? Self-Assessment Tool Can Help Small Businesses Evaluate Fraud Controls,” March 2013, page 40
- “What’s Your Fraud IQ?” March 2013, page 46
- “Small Businesses, Big Risk,” Aug. 2012, page 38
- “What CPAs Need to Know About Organized Crime,” April 2012, page 38
Publications
- Common Fraud: A Guide to Thwarting the Top Ten Schemes (#PPM1202P, paperback; and #PPM1202E, ebook)
- The CPA’s Handbook of Fraud and Commercial Crime Prevention (#056504)
- Internet Fraud Casebook: The World Wide Web of Deceit (#WI9780470643631)
CPE self-study
Fraud Prevention, Detection, Response (#154140, on-demand online access)
For more information or to make a purchase, go to cpa2biz.com or call the Institute at 888-777-7077.
