Developing an Ethics Hotline in Three Critical Stages

The most common detection method for fraud is a tip, according to the ACFE’s 2012 Report to the Nations on Occupational Fraud & Abuse. Other methods don't even come close – more cases are detected through tips than the next four detection methods combined, which included management review and internal audit.

With this knowledge, the case is already made for the necessity of including a reporting system among any corporation’s internal control structure. Yet, the effectiveness of a hotline may hinge on how it is developed and implemented.  Waheed Alkahtani, CFE, CISA, Saudi Aramco auditor, walked attendees through the development process of a hotline system in his Monday morning session, “Corporate Hotline Establishment: A Step Toward Transparency."

First, Alkahtani explained that the key requirements for a successful ethics hotline are “simplicity, ease of use, transparency, security, confidentiality and evident independence by reporting incidents to the general auditor.” He said that building an effective program does not happen overnight – rather, it needs to grow and be improved and refined over time.

Most important, according to Alkahtani, is identifying and following the three critical stages of hotline development. They are:

Stage One – Planning

The planning stage involves research, reviewing hotline best practices and deciding on creating an in-house system or working with a service provider, among other considerations. The final decisions will mostly hinge on the type of organization and existing structure for internal controls to help determine the best process.

Stage Two – Deployment

Establishing the phone, email, website and fax reporting mechanisms.

Stage Three – Administration

Determine how each tip will be handled and the process for initiating an investigation.

There was some engaging discussion with the audience regarding the system by which tips should be passed along and ultimately processed. Some attendees pointed out differences in the ways some companies handle the reporting process.

“The problem is structure; it varies from one company to another,” Alkahtani said. Some organizations, for example, want representation from different departments involved in the internal controls process. Saudi Aramco, by contrast, has an investigative team under the general auditor to investigate tips. Alkahtani stressed that this was a system that emerged as the best fit for Saudi Aramco, but might not be the choice for every company.

Alkahtani explained that not all tips will actually be relevant to the purpose of the hotline. He got some laughs when he related one such instance: An individual called to complain that Saudi Arabia’s soccer team had just lost 7-0 to Australia.

“He just called to say, ‘our team lost, and I’m feeling frustrated,’ ” Alkahtani recalled.

Fraud or not, sometimes a person just needs to vent.