FCPAméricas Blog
Best Practices for Setting Up a Hotline
4.15.2015
A hotline is an important element of a compliance program. The Resource Guide to the FCPA mentions that “an effective compliance program should include a mechanism for an organization’s employees and others to report suspected or actual misconduct or violations of the company’s policies on a confidential basis and without fear of retaliation”. Similarly, the Brazilian regulation on compliance programs sets forth that the existence of a hotline available to employees and third parties is one of the elements that will be taken into consideration when authorities evaluate a company’s compliance program.
There are certain best practices that companies should consider when establishing or enhancing their hotlines. This post highlights eight.
Define types of allegations to be received. Before setting up a hotline, companies should determine the types of issues that will be received, which may include a broad range of issues such as harassment, safety, fraud, bribery and many others that may be specific for a particular company. This definition will be very important to track and respond to allegations.
Make it available 24/7/365. Companies that have a hotline operating 24 hours per day usually receive the majority of complaints outside business hours. This seems to suggest that employees and others are more willing to use the hotline when they are away from work. Given that, companies should consider having reporting methods available 24/7/365 so that users can make contact whenever they deem it most appropriate or are most comfortable.
Make different channels available. When establishing a hotline, it is important to make different channels available. A telephone option that does not refuse some types of calls (e.g., calls from cellphones) is usually a good channel to have in place. In order to be most effective, the telephone option should not be a voice mailbox. Rather, the reporter should be able to speak to a live person. This usually improves the quality of the report and expedites the company’s response to the allegation. It should be noted, however, that not all users are comfortable using the telephone option. Therefore, it is also a good idea to have web reporting and regular mailbox mechanisms for these individuals.
Publicize the hotline. Having a hotline that is unknown to employees and third parties is the same as having no hotline at all. Therefore, once the hotline is functional, it should be communicated to employees and third parties. The following methods have been commonly used by companies to promote its hotline: email blasting, posters, newsletter, website, and training.
Ensure anonymity. To be most effective, hotlines should ensure anonymity. In most cases, this gives the reporter the assurance of confidentiality and non-retaliation. Among other things, ensuring anonymity means that the identity of the user should not be asked as a condition to receive the report (unless the user wants to be identified), that telephone calls are not recorded and that the Internet protocol of a report is not tracked.
Determine who will receive the reports. Once a report is received there should be a specific area or individuals that will receive and handle the allegations. This determination can be made based on the nature of the allegation (e.g., harassment, safety, environment, fraud, corruption) or other criteria. There should be a repository with all reports and resolutions, and such information should be limited to those with strict need to access it in order to guarantee the confidentiality. The Board or senior management should be regularly briefed about the nature of the reports received and actions taken in response. Certain allegations may require immediate escalation to them.
Accommodate language and cultural aspects. To make hotlines and other reporting mechanisms credible, companies should make them available local. An informative post titled “Considering Cultural Nuance in Your Latin American FCPA Hotline” addresses some important cultural aspects. The five pointers discussed are true regardless of which region FCPA compliance is focused
Pay attention to local laws. Companies should be mindful to local laws and regulations around data protection, retention of data, transfer of reports, among others, which can impact the operation of a hotline. Moreover, in Brazil, for example, the regulation on the evaluation of compliance programs expressly mentions that it should be available to third parties as well in order for companies to get credit for it. In fact, this is important not only for the credit but also because oftentimes third parties want to report wrongdoing but do not have a channel to do so.
The opinions expressed in this post are those of the author in his or her individual capacity, and do not necessarily represent the views of anyone else, including the entities with which the author is affiliated, the author`s employers, other contributors, FCPAméricas, or its advertisers. The information in the FCPAméricas blog is intended for public discussion and educational purposes only. It is not intended to provide legal advice to its readers and does not create an attorney-client relationship. It does not seek to describe or convey the quality of legal services. FCPAméricas encourages readers to seek qualified legal counsel regarding anti-corruption laws or any other legal issue. FCPAméricas gives permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author and to FCPAméricas LLC.
© 2015 FCPAméricas, LLC
Post authored by Carlos Henrique da Silva Ayres, FCPAméricas Contributor
Comments