BUILDING A BEST-IN-CLASS WHISTLEBLOWER HOTLINE PROGRAM
INTRODUCTION
Research by the ACFE indicates that whistleblower tips are by far the most common way that fraud schemes are detected.1 Additionally, internal auditors and anti-fraud practitioners often play key roles related to their organizations’ whistleblower hotline programs— from administering the program, to assessing reports received, to performing investigations based on incoming tips, to auditing the program’s effectiveness. To provide insight and help support our respective members with these responsibilities, the ACFE and The IIA have collaborated on a study to identify key elements of a best-in-class whistleblower hotline program, especially as it pertains to fraud.
For purposes of this report, a whistleblower hotline program is defined as a program consisting of one or more mechanisms or initiatives designed to encourage and collect reports from parties with information about potential wrongdoing or misconduct.
In December 2022 and January 2023, the ACFE and The IIA conducted a worldwide survey of their members regarding the attributes and effectiveness of their employers’ whistleblower hotline programs. The ACFE and The IIA received 1,600 responses from participants around the world (Figure 1).
Of these responses, 75% indicated that their organizations have a whistleblower hotline program (Figure 2); the findings discussed in the main body of this report are based on the answers provided by these respondents. Additionally, Appendix B provides some insight from the 15% of survey respondents who indicated that their organizations do not currently have whistleblower hotline programs.
This report organizes our findings to help organizations achieve two specific objectives:
• Benchmark hotline programs against other organizations around the world.
• Understand the factors that contribute to the effectiveness of a whistleblower hotline program.
The ACFE and The IIA hope that the information presented herein provides practical, data- driven guidance on how internal audit leaders, anti-fraud professionals, and others can most effectively manage and support the whistleblower hotline programs within their organizations.
TRUST IS ESSENTIAL
While benchmarking program components can be informative and useful for creating a comprehensive hotline program, we encourage organizations to focus primarily on what makes programs effective, rather than on what components are most commonly implemented.
The findings of our study indicate that the foundational component for an effective hotline program is TRUST. If parties do not perceive that whistleblower reports will be taken seriously, that whistleblower identities will be safeguarded, and that whistleblowers will be protected from potential retaliation, the presence of other program components will have little effect on the overall program effectiveness.
PART 1: BENCHMARKING HOTLINE PROGRAMS
Whistleblower hotline programs are not one-size-fits-all endeavors; their structure and components vary from organization to organization based on resources, needs, and priorities. However, when assessing or investing in hotline programs, it can be instructional to benchmark against other organizations’ programs.
This section provides an overview of our survey responses as a whole. Additional information on how these programs vary by geographic region can be found in Appendix C.
STRUCTURE OF THE HOTLINE PROGRAM
HOTLINE ADMINISTRATION
As shown in Figure 3, most organizations (84%) have at least some internal parties involved in the administration of their hotline programs, and 41% keep the administration of the program entirely in-house. Only 11% of programs are fully administered by an external third party, but more than half of organizations (54%) engage an external third party in at least some administrative aspects of their program.
HOTLINE OVERSIGHT
Even when administered by an external third party, the oversight of the hotline program must be assigned to one or more parties within the organization. We asked survey respondents which business units in their organization are responsible for managing or overseeing the hotline program (Figure 4). The most common party with this oversight responsibility is internal audit; 42% of hotline programs are overseen either entirely or in part by the internal audit function. Other common business units with hotline oversight are compliance (36%) and the audit committee (36%).
HOTLINE PROGRAM COMPONENTS
AVAILABLE REPORTING MECHANISMS
When ensuring potential whistleblowers have effective means to report their concerns, accessibility is an important factor. We asked survey respondents about the types of reporting mechanisms their organizations have in place as part of their hotline program. Figure 5 shows that the two most common reporting mechanisms are a dedicated hotline phone number (77%) and a website or online reporting mechanism (72%).
e also analyzed how many of the six reporting mechanisms in the survey were made available by survey respondents’ organizations. The vast majority of hotline programs provide multiple channels for reporting (Figure 6); only 17% had a single reporting mechanism. More than half of organizations provide either two or three mechanisms, while 28% provide four or more reporting mechanisms.
ANONYMITY AND OTHER PROGRAM ATTRIBUTES
As noted earlier, hotline programs might contain a variety of attributes based on the resources, culture, and priorities of the organization. We asked survey respondents which of several common program attributes their organizations had incorporated into their hotline programs.
The results are reflected in Figure 7. Nearly all organizations (91%) provide the ability for the whistleblower to remain anonymous. Other common attributes include the ability to receive reports at any time (83%) and formal mechanisms to protect whistleblower confidentiality (76%).
Interestingly, only 39% of the hotline programs in our study undergo formal audits.
PROTECTION FOR WHISTLEBLOWERS
Ensuring that parties feel safe and comfortable when making a report is an important part of a comprehensive hotline program. We asked survey respondents about the measures their organizations take to protect whistleblowers from retaliation (Figure 8). The most common approach, employed by 72% of organizations in our study, involves an official anti-retaliation policy, either as a standalone policy or as part of another organizational policy. Additionally, more than half (55%) have an official process or channel for reporting and resolving any form of retaliation that may occur. However, less than half of organizations (44%) train their managers on how to avoid, recognize, and respond to potential retaliation, and only 36% have targeted messaging from the organization’s leaders about zero tolerance for retaliation—both of which reinforce the effectiveness of anti- retaliation policies and ensure that the policy is enacted effectively.
METRICS USED TO ASSESS THE PROGRAM
Although only 39% of hotline programs undergo formal audits (see Figure 7), the majority of organizations use some metrics or key performance indicators to assess the effectiveness of the program overall. As shown in Figure 9, the most common metric used is the number of complaints received during a given period; two-thirds of organizations evaluate this as part of assessing their program. Other top metrics used include the percentage of complaints substantiated or investigated (47%) and the complaints received by claim type (47%). However, 11% of organizations do not use any metrics to evaluate their hotline program’s effectiveness.
PART 2: EFFECTIVENESS OF HOTLINE PROGRAMS
While benchmarking program components can be informative and useful for creating a comprehensive hotline program, we encourage organizations to pay special attention to the factors that make the most difference for the program’s effectiveness, rather than just implementing the components that are used most commonly.
This section explores program effectiveness based on our survey responses as a whole. See Appendix C for additional information on how these findings vary by geographic region.
I reported an HR issue in the past and was left in the dark as to whether anything came of my reporting effort. This left me feeling less confident in the whistleblower program’s effectiveness.
– RISK AND CONTROLS PROFESSIONAL, UNITED STATES
CONSIDERATIONS FOR A SUCCESSFUL HOTLINE PROGRAM
We asked respondents the open-ended question, “In general, what do you think are the most important considerations for a successful whistleblower hotline program?” Responses varied, but several common themes emerged from the perspectives that respondents shared (Figure 10). The top four considerations cited by respondents were anonymity, hotline awareness, follow-up actions, and retaliation protection. Other than hotline awareness, these aspects of the program are all based around trust—that the whistleblower’s identity will remain anonymous, that reports will be taken seriously and acted upon, and that the whistleblower will be protected from retaliation.
PERCEIVED EFFECTIVENESS OF HOTLINE PROGRAMS
Employee perception of the hotline program’s effectiveness is an important factor in both ensuring and measuring the program’s success; if employees do not perceive the program to be effective, they will be much less likely to use it to report concerns. Consequently, we asked survey respondents—many of whom are actively involved in the oversight or administration of their organization’s hotline program—to provide us with their opinion on the efficacy of their program overall. Figure 11 shows that 44% of programs are perceived to be “extremely” or “very” effective, while 40% are considered “moderately” effective, and 16% are perceived as “minimally” or “not effective.”
FACTORS ASSOCIATED WITH INCREASED HOTLINE PROGRAM EFFECTIVENESS
To better understand which factors might drive perceived effectiveness of hotline programs, we compared the presence of the program components studied in our survey with the respondents’ opinion on program effectiveness. Interestingly, many program components were not clearly associated with the programs’ level of perceived effectiveness. In other words, an organization can have many common attributes noted in our study and still have a hotline that is perceived as “minimally” or “not effective.” However, the following factors addressed in the survey did correlate with higher perceived effectiveness:
- Presence of a fraud department
- Independent administration of the hotline program
- Ability to receive anonymous reports
- Ability to receive reports 24 hours a day, 365 days a year
- Number of reporting mechanisms
- Protection against retaliation, including leaders expressing “zero tolerance” for retaliation
PRESENCE OF FRAUD DEPARTMENT
Of the organizations in our study, 54% had a dedicated fraud department. Hotline programs at these organizations had a notably higher level of perceived effectiveness compared to organizations without a fraud department (Figure 12).
INDEPENDENT ADMINISTRATION
As shown in Figure 13, hotlines that are either entirely or partially administered by an external third party are perceived as more effective than hotlines administered solely by internal staff. This might be due to the increased expectation of objectivity when the administration is handled externally; employees may trust an outside, professional hotline provider to be more impartial or to better protect incoming reports than inside parties who might be subject to organizational politics or have a vested interest in the outcomes of any reports received.
ABILITY TO RECEIVE ANONYMOUS REPORTS
Our survey data reinforces the observation by respondents that anonymity is a top consideration for an effective hotline program. As Figure 14 shows, organizations that enable whistleblowers to report anonymously have notably more effective hotline programs than organizations that do not provide a way to remain anonymous.
MECHANISMS TO PROTECT WHISTLEBLOWER CONFIDENTIALITY
Similarly, hotline programs that include mechanisms specifically designed to protect the confidentiality of the whistleblower are perceived as more effective than programs that lack such mechanisms (Figure 15).
ABILITY TO RECEIVE REPORTS 24 HOURS A DAY, 365 DAYS A YEAR
Ensuring the hotline is accessible at all times provides potential whistleblowers with every possible chance to report their concerns. Figure 16 shows that making reporting mechanisms available 24 hours a day, 365 days a year is associated with a much higher level of perceived program effectiveness.
NUMBER OF REPORTING MECHANISMS
Hotline programs that include multiple reporting mechanisms to collect tips have higher perceived levels of effectiveness. As shown in Figure 17, the perception of effectiveness increases as more reporting mechanisms are provided. These findings emphasize the importance of both the accessibility of the program (i.e., are whistleblowers provided every possible means, within reason, to report their concerns?) and employees’ perceived trust in the program. Having multiple avenues of reporting reinforces that management wants to encourage tips and that they are willing to invest in providing alternatives in case people do not feel comfortable using a specific reporting mechanism.
PROTECTION AGAINST RETALIATION
Our survey indicates that hotline programs are greatly strengthened by the presence of proactive measures to protect whistleblowers against potential retaliation. As shown in Figure 18, the presence of any of the anti-retaliation protections was correlated to a notably higher level of perceived effectiveness. In contrast, hotline programs with no anti-retaliation components had a very low level of perceived effectiveness, with more than half of those programs being rated as “minimally” or “not effective.” The measure that is correlated with highest perceived effectiveness is targeted messaging from organizational leaders about zero tolerance for retaliation.
Specifically, perceived hotline program effectiveness is substantially higher when organizational leaders provided targeted messaging that expresses zero tolerance for retaliation (Figure 19). This tone-at-the-top effect is an important consideration, as it likely plays a key role in establishing trust in the hotline program.
APPENDIX A: RRESPONDENT DEMOGRAPHICS
The following charts reflect the demographics of the survey participants who indicated that their organizations have hotlines in place (i.e., the responses on which the main body of the report is based).
PRIMARY OCCUPATION
Half (50%) of the participants with hotlines in place are internal auditors, and 20% are fraud examiners or investigators. The remaining 30% are spread between other occupation categories.
PROFESSIONAL LEVEL
The largest segment of our survey respondents with hotlines (43%) are in roles at the executive management, director, or equivalent level, with another 34% holding senior manager or manager roles. Just over one-fifth (21%) are in staff-level positions.
ORGANIZATION
TYPE
Most survey respondents with hotlines work either for a publicly traded company (35%) or a public sector entity (28%). Another 20% work in privately held organizations, with smaller percentages each in nonprofit organizations (9%) and consultancies (4%).
ORGANIZATION SIZE
The size of the organizations with hotlines for which survey respondents work varied greatly. The largest proportion (22%) are at organizations with 1,501 to 5,000 employees. Only 6% work for small businesses (those with fewer than 100 employees), while 10% work for the largest organizations (those with more than 50,000 employees).
INDUSTRY
Survey respondents with hotlines came from a variety of industries, ensuring our study provides a comprehensive picture of hotline programs across sectors. The industry with the greatest representation in our survey is finance and insurance (29% of responses), followed by public administration (13%).
GEOGRAPHIC REGION
The survey respondents at organizations with hotlines work in organizations spread throughout the globe. More than half (52%) come from regions outside North America, with 19% residing in Africa and 16% in Europe. Thus, our study provides a truly global view into the state of existing hotline programs. Additional information on how these programs vary by geographic region can be found in Appendix C.
APPENDIX B: REASONS ORGANIZATIONS DO NOT HAVE A HOTLINE PROGRAM
While the majority of our survey respondents (75%) indicated that their organizations had hotline programs in place (see Figure 2), we were also interested to learn from the roughly 400 participants whose organizations lack a hotline program. As noted in Figure 26, the proportion of respondents who do not have a hotline program varied greatly by region.
These respondents were presented with an open-ended question asking about the reasons their organizations do not have a hotline program, and several themes emerged from their responses (Figure 27). The most common reason cited was that the organization was too small or immature (31%). A lack of consideration, awareness, or perceived need was the second most common theme, noted by 19% of respondents. Interestingly, cost and budget concerns were rarely cited as the reason for not having a hotline program; only 5% of respondents indicated this as an issue.
There were also some notable differences in the reasons for a lack of hotline based on an organization’s region (Figure 28). For example, organizations in Africa noted lack of consideration, awareness, and/or perceived need as the top reason for not having a hotline program, while organizations within other regions noted their organization was too small or immature.
APPENDIX C: REGIONAL DIFFERENCES IN HOTLINE PROGRAMS
Our study included responses from all global regions and revealed some interesting differences in hotline programs based on organizational geography. This appendix explores some of our findings across regions, providing a global snapshot into the state of hotline programs around the world.
For purposes of our study, the following tables provide the number of respondents with whistleblower hotlines for the countries within each region.
PRESENCE OF HOTLINE PROGRAM BY REGION
Our survey results indicate that organizations in North America and Europe are most likely to have hotline programs, while organizations in Africa and Latin America and the Caribbean have a much lower adoption rate for these programs (Figure 29).
HOTLINE ADMINISTRATION BY REGION
The administration of hotline programs also varies by region. Organizations in the Middle East are much more likely to have a fully internally administered hotline than organizations in other regions, while the administration of hotlines in Latin American and the Caribbean and in Africa is more commonly fully outsourced to an external third party.
HOTLINE OVERSIGHT BY REGION
Figure 31 shows the top business units with some oversight responsibility for the hotline program in each region. In all regions, internal audit plays a key role in overseeing these programs. The compliance function and the audit committee are also commonly assigned oversight responsibility in most regions. Interestingly, North America is the only region where the legal department is in the top three business units with this responsibility.
PROGRAM ATTRIBUTES BY REGION
The following figures show the proportion of hotline programs that include the attributes studied based on region. For almost all regions, the ability to receive anonymous reports and the ability to receive reports at all times were the two most common attributes.
PROTECTION FOR WHISTLEBLOWERS BY REGION
Across all regions, most organizations have an official anti-retaliation policy that provides the foundation for protecting whistleblowers from repercussions for making their reports (Figure 33). This type of policy is most common in North America (82%) and least common in Africa (58%).
Implementation rates of other whistleblower protections also vary widely across geographic regions. Notably, hotline programs in Latin America and the Caribbean are much less likely than those in other regions to include official processes, training, or targeted messages designed to prevent or address retaliation.
PERCEIVED EFFECTIVENESS BY REGION
Figure 34 provides a comparison of survey respondents’ perceived effectiveness of their hotline programs based on their regions. There were no statistically significant differences between regions in this regard.
ABOUT THE ACFE
Founded in 1988 by Dr. Joseph T. Wells, CFE, CPA, the Association of Certified Fraud Examiners (ACFE) is the world’s largest anti-fraud organization. Together with more than 90,000 members, the ACFE works to reduce business fraud worldwide and inspire public confidence in the integrity and objectivity within the profession.
The ACFE offers its members the opportunity for professional certification. The Certified Fraud Examiner (CFE) credential is preferred by businesses and government entities around the world and indicates expertise in fraud prevention and detection. To learn more, visit ACFE.com.
ABOUT THE IIA
ABOUT THE INSTITUTE OF INTERNAL AUDITORS
The Institute of Internal Auditors (IIA) is an international professional association that serves more than 230,000 global members and has awarded more than 185,000 Certified Internal Auditor (CIA) certifications worldwide. Established in 1941, The IIA is recognized throughout the world as the internal audit profession’s leader in standards, certifications, education, research, and technical guidance. For more information, visit theiia.org/.
