Effective Whistle-blowing Hotlines by Robin Singh

JUNE 2016
WWW.INTERNALAUDITOR.ME
Tips for Developing & Operating
Whistle-blowing Hotlines
Fraud Trends in the Arab World
INTERNAL AUDITOR
MIDDLE EAST
Actively Combating Procurement
Fraud in Construction Projects
Fraud Detection
and Data Analytics
Bolstering Anti-Fraud Programs by Effectively
Identifying Anomalies & Red Flags
Insights on Governance, Risk Management and Control

From The President
Fraud Special Issue
Thanks to the efforts of the UAE Internal Auditors Association’s (UAE-IAA) Fraud
Subgroup, we have launched a Special Issue on Fraud. The articles in this Special Issue
only cover Fraud and related topics.
Fraud has always fascinated people: how it is committed, how it gets discovered and
what led the perpetrators to carry out these immoral actions in the first place. While
internal auditors are not specialised fraud examiners, our stakeholders expect us to
detect red flags and recommend prevention measures. This means that a majority of
internal auditors are involved in responding to fraud risk, albeit in differing ways and
with differing roles (For example, investigations, facilitating fraud risk assessments,
fraud awareness training, etc). In this Special Issue you will learn about a variety of
fraud related topics which include using data analytics to detect fraud, whistle blowing,
procurement fraud as well as the role of internal auditing. Internal auditors can use
these insightful articles to stay up to date and see how best to add value to the anti-fraud
efforts at their companies.
I would like to thank Meenakshi Rezdan of the Editorial Advisory Committee, who has
taken on the bulk of the editorial work for this quarter. Without her efforts, this Special
Issue would not have become a reality. In addition, I would like to thank the Fraud
Subgroup for their support ideas and encouragement. Last but not least, a special thanks
goes out to Robin Singh for his regular and insightful contributions to our magazine.
On a different note, the Institute of Internal Auditors (IIA) and the UAE-IAA have
worked extensively to prepare for the 2016 International Internal Audit Awareness
Month which takes place during the month of May each year. The objective of this
month is to actively promote internal auditing’s value to our stakeholders, to the business
community and to students & academics. In 2015, the UAE-IAA was given the Building
Awareness Champion award and we hope to achieve the same this year. I encourage all
our members to participate and help advance our profession at your workplace and local
community.
I hope you all enjoy reading this Special Issue. Please feel free to email any feedback you
may have to editor@internalauditor.me
Sincerely,
Abdulqader Obaid Ali
President
JUNE 2016
INTERNAL AUDITOR - MIDDLE EAST 01

Hotlines
BY ROBIN SINGH
Effective Whistle-blowing Hotlines
Hotline pitfalls and solutions from the
implementation stage to the commencement
of an investigation.
Whistle-blower is a term that is most
dreaded by all concerned, but in hindsight
it has a lot of benefits for everybody. Fraud
is an ongoing activity and sometimes it
comes to notice after many years. It is an
activity that is deleterious not only to the
health of a company but also to the society
we live in. In the long run thus whistleblowing
is an activity that can not only cut
down on fraud, but in the overall scenario
is a help to society. One of the methods is
setting up a whistle-blowing hotline with
an option for anonymous reporting.
WHAT ARE THE 2 MAJOR
IMPLEMENTATION MISTAKES?
Assuming it’s about the money.
Studies have shown that a majority of
whistle-blowers don’t do it for pecuniary
benefit; but for genuine well-being of the
company. Hence companies which do
not listen to internal complaints due to
assuming the motives are not genuine, lose
the benefit of information provided by a
whistle-blower and the call rates drops
dramatically and so does the faith in the
company.
Not investing in a third-party hotline.
Using an internal system will place the
reporter, the alleged, the information and
the issue / concern at high risks, simply
because administrators and the super users
will always have access to the information.
Bottom line is everyone has friends! The
purpose of anonymity, in substance, is to
put in practice a system that prevents an
individual and the associated elements
from coming to any harm (e.g. retaliation,
etc.). Thus, going with a third party
provider is the best solution.
WHAT ARE SOME OF
THE COMMON PITFALLS
FROM THE TIME A CASE IS
REPORTED TO THE TIME
OF THE FINAL REPORT IS
RELEASED?
1. Does having zero calls in a company’s
hotline convey lesser risk?
One of the key cornerstone of success for
a function like Ethics and Compliance, lies
on the back of the whistle-blowing hotline’s
success. Fewer calls could also mean that
people are afraid to report because of
management’s reaction toward them or
because people do not have faith in the
system or just because of poor marketing.
How do you avoid this?
The Ethics and Compliance function
should expand its horizon to build efficient
pipeline of interaction, information
collection points and input beyond the
hotline such that the information lands at
the desk of a Compliance Officer.
2. Thinking that employees will always
willingly report suspected fraud and/or
misconduct.
Many employees are apt to let matters rest
and not make a report in the belief that
that a report may well lead to some adverse
action against them.
How do you avoid this?
One of the cardinal principles of this
entire scenario is to ensure that employees
who are whistle-blowers are not going to
face any sanctions against anyone in the
hierarchy. In other words an employee
20 INTERNAL AUDITOR - MIDDLE EAST JUNE 2016

TO COMMENT on the article,
EMAIL the author at drobinsingh@gmail.com
Hotlines
must have the confidence that not only
will his identity be respected. This can be
best done by establishing whistle-blower
protection program in the whistle-blowing
policy which speaks about sanctions
against any staff or a senior management
involved in retaliation towards a whistleblower.
3. Should you treat anonymous reports as
unreliable?
This is a double-edged sword. Anonymous
reports are to protect employees and in no
way delegitimize the report. An employee’s
information (not his /her name) is critical
to the success of an investigation.
How do you avoid this?
One important aspect of whistle-blowing
is to ensure that vindictive reporting is
not only ignored but the person involved
cautioned against for the same. The ability
to distinguish between valid and vindictive
claim / allegation is an important part of
the zig-saw puzzle.
“Effective hotlines are the
best way to detect fraud”
4. Confusing between vindictive and
genuine complaints
The department must be able to
differentiate between the two. Failure to
do this can lead to diminishing confidence
of the employees in management and
functions like Ethics and Compliance.
How do you avoid this?
It is advisable to have an initial information
check An initial information check always
helps, e.g. if an employees named look at
the personal file, review declarations, speak
to his/her manager in confidence, etc..
The cardinal principle of jurisprudence
“Innocent until proved guilty” should be
the guiding tenet.
5. Information versus integrity / honesty.
Not being able to show a correct picture
to a non-anonymous whistle-blower can
lead to a collapse of the entire governance
structure. Don’t keep a whistle-blower in
the darkness of being able to protect his
identity when you can’t.
How do you avoid this?
Key pillar of a governance structure is
accountability with its nucleus being
integrity. Non-anonymous Whistle-blowers
should be made aware that if the case goes
for prosecution and the authorities seek
details for indictment, then his /her name
would have to be disclosed.
However, if a personnel from the
management such as board of director or
the CXO makes any attempt to identify the
whistle-blower, the Ethics and Compliance
function must make it a point to say
“STOP”. The biggest problem is, if it is not
written it is not true, so put it in the policy.
6. Identify the essence of an investigation.
The aim of an investigation is not to focus
on a single employee but take in the entire
gamut of the case and identify who all are
involved. The key is to identify, interpret
and resolve various scenarios arising from
the allegation.
How do you avoid this?
Consider creating a linked analysis and
though job descriptions of the alleged
(whom you have received direct evidence
about) and try to see whom all can be
encompassed. A wide horizon, reference
to previous complaints, advice from Legal
Counsel is essential while evaluating the
case / report (not the person!)
7. Who should control the interview?
Letting the witness or reporter lead the
interview can greatly twist the facts and the
scope of an investigation.
How do you avoid this?
Determine the objective of the interview;
Define guidelines (A one-pager) to define
boundaries in an admission seeking or
Information gathering interviews. Make it
a point to have a clear picture of the case
and identify the role of the cogs (confidants
and others) in the larger picture of the
crime. Unless you are able to join all
the dots with appropriate and adequate
evidence the alleged is “INNOCENT”.
8. Confidentiality and protecting alleged
/ suspect unless proven guilty.
Information leaks are pretty common
between Chinese walls during an
investigation. An unexpected / negligent
leak, before a conclusion, can ruin the
reputation of the accused.
How do you avoid this?
No promises should be made to any of
the parties. In a conflict of Interests case,
an information leak can be damaging to
a person’s reputation, specially “In case”
it turns out that a perceived conflict does
not exist. Place a comprehensive chapter
in Compliance Program Manual on
Investigation, the methodology, basis for
disclosing information, etc. to safeguard a
compliance officer / investigator and their
rights. Lately, with the issuance of the Yates
Memo in the United States, it is clear that
governments are defining mechanisms
to hold individuals accountable for a
corporate wrong doing, which was never
the case earlier. This can go to the extent
of prosecuting a person administering a
compliance program.
Conclusion
A hotline is single most important
contact of Compliance officer with all
the employees. The analysis of the data
and the types of concerns recorded give a
tremendous insight into what is happening
within the organization, what are the
pain points and what type of support is
needed at the bottom of the organizational
pyramid. It is imperative that a compliance
officer never stops employees from
reporting other side concerns (such as
regulatory reporting, etc.) but at the
same time it should not stretch out to
the spectrum of useless concerns. Thus,
mature management across the world are
naming it as “Helpline” rather than just
“Hotline”. Useless concerns can dilute
the analysis, final outcome and impair
the management’s sight to take diligent
decisions. Keep an eye on the same.
Lastly, For a Ethics / Compliance or a
Fraud Examiner, the buck doesn’t stop with
the implementation of the hotline but the
core work starts after the implementation
of the hotline
ROBIN SINGH, MSc.– LAW, MBA, MIT,
CFE, CFAP is Senior Ethics / Fraud Control
Officer at Abu Dhabi Health Services Company
(SEHA).
JUNE 2016
INTERNAL AUDITOR - MIDDLE EAST 21