Gail Gibson (gail@yesterdayspeople.com) is a senior compliance lecturer from Juta, South Africa, and the author of The A-Z of GRC: Governance, Risk & Compliance Simplified and Project Management for Compliance Officers.
facebook.com/GovernanceRiskandCompliance/
Businesses regularly confront allegations of internal misconduct. These allegations can involve breaches of the law or the business’s policies or procedures. The first basic step is to determine if a misconduct allegation has merit and if a comprehensive investigation is required. The compliance officer, human resources management, privacy and security officers, legal counsel, and others may bear responsibility, either individually or collectively, to resolve issues and problems arising from concerns, complaints, and allegations.
If the compliance function receives the whistleblower complaints, then the compliance process begins with the steps to determine if an investigation is needed, the cost effectiveness, and in which area the steps required should be done.
Step 1: Assessing credibility
Look carefully at the person or persons reporting the misconduct. If the whistleblower is anonymous, see which department these allegations stem from. Do you think this information is due to personal feelings or professional jealousy? Normally if the allegations are specific and the reporter(s) do not have a stake in the outcome, then there is a likelihood that the allegations have merit.
Do your homework before action is taken: Investigate both the reporter, if known, and those suspected of misconduct. This may include the review of personnel records, criminal and civil litigation histories, media research, and analysis of social media.
For example, if the allegation is fraud, then this investigation may show the subject of the investigation and their family members have multiple business affiliations or own homes, vehicles, and other assets that are not commensurate with the income they receive. Another red flag is travel to expensive resorts and exotic places.
At this point, avoid talking to the persons concerned. Confronting someone suspected of wrongdoing may give them the tools they need and time to create an alternative explanation or sufficient doubt and confusion to unravel the investigation. It can also provide the suspect with enough knowledge to notify others involved who can then cover their tracks. Make sure the wrongdoer is only confronted when the time is correct and the situation is manageable. (Suggest all concerned are immediately removed from the workplace and have limited or no system access.)
Doing a high-level investigation may show that those suspected of misconduct are not in fact culpable of any wrongdoing and can save valuable resources. Such an investigation can protect the business from negative effects of declining staff morale. This reaction will prove the value of a proactive compliance reaction to a situation, which does not simply allocate blame but finds solutions.
