Effective Workplace Investigations:

Building a Business Process to Ensure

Your Compliance Program Works

By Meric Craig Bloch, Esq., CFE

A publication of the
SCCE White Paper Series
October, 2009

Society of Corporate Compliance and Ethics

6500 Barrie Road, Suite 250
Minneapolis, MN 55435

Society of Corporate Compliance and Ethics +1 952 4977 or 888 277 4977 [Link]
 Effective Workplace Investigations:
Building a Business Process to Ensure
Your Compliance Program Works

By Meric Craig Bloch, Esq., CFE 1

Contents
Introduction

I. Corporate Realities and Internal Investigations

A. The Ethics Messages

B. The Management Mindset

C. Selling the Value of Business Investigations to Management

D. Management’s Legal Obligations

E. Structuring the Compliance Investigative Function

II. Basic Concepts of Compliance Investigations

A. Purposes of the Compliance Investigation

B. Timing of the Investigation

C. Investigation Team Members

D. Management Steps

E. Tracking and Metrics

1
Meric Craig Bloch, Esq., CFE, is Vice President for Compliance and Corporate Investigations at
Adecco Group North America. He is an attorney, Certified Fraud Examiner, Professional Certified
Investigator, licensed private investigator, and reserve police officer.

Society of Corporate Compliance and Ethics +1 952 4977 or 888 277 4977 [Link]
 Effective Workplace Investigations:
Building a Business Process to Ensure Your Compliance Program Works

by Meric Craig Bloch, Esq., CFE

Introduction

When a company learns that there may have been some violation of law or company
policy, an internal investigation is needed to determine precisely what happened.
Corporate executives increasingly recognize that internal investigations uncover and
help correct improper activities before they attract government, litigant or marketplace
attention. Compliance officers today cite the improvement of their function’s risk-
assessment capabilities as a high priority.

No one seriously argues with the idea that corporate investigations are now a necessary
part of the corporate landscape in a post-Sarbanes Oxley world. Most will also not argue
with the relevance and utility of investigations. But the point for those who administer
compliance programs is not to simply solicit agreement from corporate peers.
Compliance officers need to know how to embed compliance investigations into their
company’s culture (and this applies even to those professionals in human resources and
legal departments who freelance investigations). Compliance executives must assume
new responsibilities in an existing corporate political world. Leaders of business units
may voice support for the compliance function because they want to be good corporate
citizens, but corporate compliance departments are only effective when they are
accepted and embedded into the business.

A cursory review of company websites and industry sources shows an emphasis

predominantly on employee ethics training and hotline-reporting schemes. This focuses
only on the education and detection priorities of the compliance function. The missing
component – the internal compliance investigation – completes the picture by resolving
the incident and improving the business through its findings.

The challenge is to make the results of the investigative process a practical and personal
piece of advice to business leaders. The investigation goal is to prevent damage to the
company – by using investigation findings as a form of business intelligence – rather
than rebuilding it after the damage is done. Once the business leaders appreciate its
practical and personal significance, the investigative process will succeed.

But internal business investigations can be a difficult business task. By definition, they
involve accusations or insinuations of wrongdoing against company employees.
Investigations can be divisive and disruptive to a company’s workforce and business
operations. They can be costly, time consuming, and they frequently distract business
executives from focusing on their usual responsibilities. While an investigation of specific
alleged misconduct may help resolve the initial problem, investigators may also uncover
other potentially troubling situations that the company is not prepared to deal with
immediately.

Society of Corporate Compliance and Ethics +1 952 4977 or 888 277 4977 [Link]
1
This work examines management techniques and processes to create and manage
compliance investigations as an internal business function and to provide readers with a
practical framework from which to implement an investigations process.

I. CORPORATE REALITIES AND INTERNAL INVESTIGATIONS

Compliance programs are not profit centers of a business. This is significant but not
surprising. So there must be some rationale for funding these programs internally. If a
company funds a compliance program simply out of fear of prosecution or because its
competitors also have these programs, the future of the compliance group becomes
precarious because the group’s survival depends on factors outside its control. Similarly,
if the program exists without concrete expectations and metrics to measure its business
value, then the program is also at risk. Compliance officers must, if for no reason other
than self-preservation, recognize their obligation to contribute to the equity value of the
business – increasing the returns to its shareholding owners – and this must be a
fundamental operating principle.

A. The Ethics Messages

Correcting the Misperceptions

Traditionally, ethics, the philosophical underpinnings of a compliance program, was the
domain of academics and social critics. Consequently, much of the discussion of ethics
focused on philosophical points of view, case studies, and critiques of social
responsibility. The problem was that there was little practical information about putting
ethical goals and ideas into action, especially in a business context. This has led to a
misperception about the utility of an ethical approach to business.

The misperception is compounded by the perennial ethics scandals in politics, where

“ethics” is seen as an easy technical and isolated act, rather than as a habit of proper
conduct formed through repeated action. The use of the term only led to a consideration
of abstract professional rules that bear no real connection to concepts of right or wrong.
And the inevitable next scandal reinforced the perception of “ethics” as little more than
posturing.

Within the area of business ethics, the lack of involvement of business managers has
caused much confusion about the proper role of ethics in business. There are many
ethical “gray areas” in business dealings. However, ethics was often presented – often
by those who do not work within a company department with profit-and-loss
responsibility – as a kind of moral absolutism. The examples were often presented in a
simplistic way, as if every real-life situation has a right and wrong answer (such as
“should I lie, cheat or steal”). With its emphasis on “doing the right thing,” managers
believe that compliance officers are simply asserting the obvious, and managers do not
take the message seriously.

Many managers believe business ethics is irrelevant because too much business ethics
discussion avoids the real-life complexities these managers face. They believe that
business activity often demands that we select from alternatives that are neither wholly
right nor wholly wrong. The better message is that business ethics is about prioritizing
moral values for the workplace and ensuring that business conduct is aligned with those

Society of Corporate Compliance and Ethics +1 952 4977 or 888 277 4977 [Link]
2
values. Stated differently, ethics and compliance are simply forms of values
management.

Myths about Ethics

Considering that they have not been engaged historically in the ethics process, business
managers are often confused about the notion of ethics. Certain myths arise from narrow
or simplistic views of ethical dilemmas.

• Myth: Our employees are ethical so we don’t need to pay attention to

business ethics. In fact, most of the ethical dilemmas faced by managers in
the workplace are complex. People are quick to speak of the Golden Rule,
honesty and courtesy. But when presented with complex ethical dilemmas,
most people realize there is a wide "gray area" when trying to apply ethical
principles.

• Myth: Business ethics is superfluous – it only asserts the obvious: "do

good!" Many people feel that codes of ethics, or lists of ethical values to which
the organization aspire, are rather superfluous because they represent values
to which everyone should naturally aspire.

• Myth: Business ethics is a matter of the good guys preaching to the bad
guys. Good people can take bad actions, particularly when stressed or
confused. Managing ethics in the workplace includes colleagues working
together to help each other remain ethical and to work through confusing and
stressful ethical dilemmas.

• Myth: Ethics can't be managed. Actually, ethics is always "managed" – but,

too often, indirectly. Strategic priorities (profit maximization, expanding
marketshare, cutting costs, etc.) can strongly influence ethics. Laws,
regulations and rules directly influence behaviors to be more ethical.

• Myth: Our company is not in trouble with the law, so we're ethical. One
can often be unethical, yet operate within the limits of the law, such as
withholding information from superiors, fudging on budgets, constantly
complaining about others, etc. However, breaking the law often starts with
unethical behavior that has gone unnoticed.

• Myth: Managing ethics in the workplace has little practical relevance.

Managing ethics in the workplace involves identifying and prioritizing values to
guide behaviors in the organization, and establishing associated policies and
procedures to ensure those behaviors are conducted appropriately.
Compliance officers must be prepared to rebut these myths if their programs
are going to be effective.

B. The Management Mindset

Once perceptions are adjusted, compliance officers must then market the value of the
investigative function in particular. Business leaders should be considered the
“customers” of the investigation’s outcome. Therefore, it pays to know how these
executives generally view business issues. Business people generally like to be in
control. For example, a regular business practice is to define a goal, formulate a

Society of Corporate Compliance and Ethics +1 952 4977 or 888 277 4977 [Link]
3
strategy, and execute a plan. By controlling the outcome as much as possible, managers
ensure the most profitable result. This is what they are paid to do. Not surprisingly, the
profit motive can be valued more heavily than the good-citizenship role of the
corporation. This mindset influences a company’s perception of the investigation
process. Managers will want to know what commitment must be made to complete an
investigation. But until the facts are known, required commitments can only be
estimated. Senior business managers may want the ability to conduct compliance
investigations with their own resources or within their own business units because the
managers believe they can control the outcome. This challenge does not prevent a
proper investigation. Compliance officers may successfully leverage that mindset by
developing the investigations process to provide a reasonable assurance to these
managers that the outcomes will serve the business interests of the company and its
shareholders.

Threats to Employee Loyalty

Compliance officers must acknowledge that managers may be reluctant to embrace the
investigative process because they may believe it jeopardizes employee loyalty. Loyalty
is critical to worker productivity, efficient operations and good customer service. Loyalty
is also a function of the extent to which employees trust their employer and believe that
the employer is truly interested in their well-being. Employees are unlikely to remain
committed to an employer they do not trust. While most employees would not suggest
that fellow employees who committed some misconduct should be protected from
discipline, the efforts of a third party – in this case, the compliance group – may be seen
a threat to the loyalty bond. Compliance officers must keep this in mind.

C. Selling the Value of Business Investigations to Management

Some managers believe that investigations are neither profitable nor expeditious.
Business people know that the profitable use of time is the key to their success, and the
investigation may seem more expensive than simply writing off the loss, firing the
offending employee and going back to the business of selling goods and services.

The perception is reinforced by the fact that, in the past, compliance-related

investigations were not tied to the operation of the business. The goals were usually to
identify wrongdoers and then calculate the harm they caused. Compliance programs
were often disconnected from what the company culture considered the true business of
the company, and they were perceived as just another layer of bureaucratic oversight.
As a result, the process was viewed simply as added cost to the business. Compliance
officers must overcome these gaps in understanding if the investigation process is to
work. There are some valuable concepts for compliance officers to use for persuading
management.

Risk Management
Risk is simply the possibility that damage could be inflicted. Investigations are basic
components of a company’s efforts to identify systematically the risks to the business
and to ensure that appropriate processes commensurate with the risks are implemented.
An identified risk is a managed risk.

In risk-management terms, investigations identify existing sources of revenue loss and

prevent further losses. Investigations shield the company from liability or reduce it. The
company may become aware of problems or practices which could expose the company
to criminal liability, civil lawsuits or sanctions. Identifying and repairing these problems

Society of Corporate Compliance and Ethics +1 952 4977 or 888 277 4977 [Link]
4
before a possible outside investigation begins can give the company the opportunity to
take remedial measures, comply with relevant laws or regulatory standards, or eliminate
other problems that were previously unknown to management. Finally, aggregate
compliance-investigation data can be presented to show risk trends of certain employee
behaviors, troubled management, or business regions.

Investigations also avoid costs. They connect compliance with financial and operational
policies and procedures. Timely and meaningful findings avoid damage to reputation and
investor confidence. They protect the stock price. They avoid the personal liability of
directors and officers. They avoid civil litigation and criminal penalties. On a practical
level, a thorough investigation may even help the dispute-resolution process of company
claims.

In their most effectiveform, investigations permit business leaders to partner with

compliance officers to identify and prioritize the business risks. This gives the business
leaders a stake in the compliance process and maximizes the value of investigations to
the business.

Good Corporate Citizenship

Practical business considerations generally encourage companies to be perceived
publicly as good corporate citizens. Corporations generally want to be recognized in the
relevant community as a contributor to shared values through the creation of jobs,
income to the community and the payment of taxes. To the extent that the corporation
can build a constituency beyond the shareholders, the greater the likelihood that
company executives will see the benefits of an effective compliance-investigation
function.

Projecting a Strong Public Image

Attention to ethics is also strong public relations. The fact that an organization regularly
gives attention to its ethics portrays a strong positive image to the public. People see
those organizations as valuing people more than profit, as striving to operate with the
utmost of integrity and honor. Aligning behavior with values is critical to effective
marketing and public relations programs. Also, a company can use its compliance
program to recruit the best and brightest employees and to burnish its reputation. A
compliance program allows sales representatives to go beyond mere platitudes in
describing a company’s dependability and ethical standards.

Enforcing an Ethical Culture

Companies that have strong track records of ethical, responsible behavior generally
stand to gain the most from compliance investigations. Investigations as part of a
properly implemented program foster an ethical corporate culture company-wide,
preserving the company’s reputation. When the results of investigations lead to
improved employee relations, enhanced productivity and positive morale, compliance
officers add to the company’s equity.

Compliance programs increase ethical awareness, and additional measures taken for
the sake of prevention and control lead to a better rate of discovery. Skeptics of
compliance programs, however, often criticize ethical goals as being no more than a
corporate version of the same lessons our mothers taught us. However, an ethical
culture improves the business. It takes what may seem like an amoral world of profit and
loss and creates a common set of expectations and understandings. A company’s code

Society of Corporate Compliance and Ethics +1 952 4977 or 888 277 4977 [Link]
5
of employee conduct is an example of this. Over time, appropriate conduct will shift the
burdens of shame and embarrassment from those who speak out against improper
conduct to those who simply stand by and do nothing when they allow improper behavior
to continue.

The investigations process complements the self-regulating aspects of an ethical culture.

First, the potential of business ethics is not fully exploited when ethical guidelines only
take abstract values into account. Abstract concepts like responsibility, integrity,
compliance, fairness and respect, when left in the abstract, are not generally effective.
When investigations reinforce the guidelines by applying the guidelines to specific acts
of corporate conduct, the effectiveness of business ethics is increased. As a result,
investigations communicate values and reinforce concrete limits on business conduct.

Stakeholder Expectations
Investigations which identify compliance and ethics-related misconduct serve a
company’s broader interests by helping the company meet the expectations of the
business’ internal and external stakeholders. A stakeholder could be the company’s
employees, shareholders, government agencies or outside groups. A business that
incorporates ethical principles into its operations will likely fare better in the market. If an
ethical lapse then occurs in the future, the risk of adverse publicity will be less as the
public may see it as an aberration in the company’s otherwise clean image.

Quality Control
Properly conducted investigations are another form of business intelligence. Information
gleaned from an investigation improves business operations. When done well,
investigations offer senior management each of the following:

• Company values, ethics and expected behaviors are communicated to

employees through the conduct of the investigation and the application of a code
of conduct.

• Key business risks are identified and assessed.

• Information can be reported to management, the board and stakeholders in an

accurate, timely and reliable way.

• The company’s true culture can be measured, as well as the need for additional
training or better management supervision.

Workforce Changes
Younger employees are among the least likely to report misconduct and are among the
most likely to feel that management and their coworkers will view them negatively if they
do report. Younger managers (under 30) are considered more likely to feel more
pressure to compromise ethical standards than other employees. Cheating among both
college and high school students is on the rise, as is the attitude that cheating is
acceptable behavior.

Companies that require ethics training and investigate allegations of misconduct

generally experience an increased reporting of misconduct by employees, higher

Society of Corporate Compliance and Ethics +1 952 4977 or 888 277 4977 [Link]
6
perceptions that employees are held accountable on ethics violations, and lower
pressures on employees to compromise company standards of business conduct.

Cultivating Teamwork and Productivity

Ethics programs align employee behaviors with those top priority ethical values preferred
by leaders of the organization. Usually, an organization finds surprising disparity
between its preferred values and the values actually reflected by behaviors in the
workplace. Ongoing attention and dialogue regarding values in the workplace builds
openness, integrity and community – critical ingredients of strong teams in the
workplace. Employees feel strong alignment between their values and those of the
organization. They react with strong motivation and performance.

Associated Values with Other Company Programs

Ethics programs identify preferred values and ensure that organizational behaviors are
aligned with those values. This overall effort is very useful for several other programs in
the workplace that require behaviors to be aligned with values, including quality
management, strategic planning and diversity management. Total Quality Management
includes high priority on certain operating values, e.g., trust among stakeholders,
performance, reliability, measurement, and feedback. Ethics management programs are
also useful in managing diversity. Diversity is much more than the color of people’s skin
– it’s acknowledging different values and perspectives. Diversity programs require
recognizing and applying diverse values and perspectives – these activities are the basis
of a successful ethics program.

Ethics Programs Pay for Themselves

Companies with a code of conduct and an active investigations function generate more
value-added than companies without these features. Every dollar allocated to a
company’s compliance budget has been found to decrease damages, settlements, and
fines by $1.37 on average. (Presby, p.19)

D. Management’s Legal Obligations

The company’s decision to investigate misconduct or ethical lapses is not just a
voluntary business decision. Certain legal principles apply to influence that decision.

The Duty to Investigate

A company’s management and board of directors have a fiduciary duty to act in good
faith with the care of an ordinarily prudent person. These general standards require
directors, officers and other fiduciaries to use the same reasonable care in conducting
the affairs of a company that they would in their own affairs, and always to put the
interests of the company ahead of their personal interests. Accordingly, a duty to
investigate may arise under normal fiduciary duties. In the context of a public
corporation’s financial reporting process, directors also have a duty under the federal
securities laws to oversee and investigate when information comes to their attention
indicating that the corporation’s management may have engaged in fraud, or that the
corporation’s prior public statements may be inaccurate.

Legal and regulatory duties to disclose misconduct outweigh a company’s desire to

ignore an employee or managerial offense. Management may find that the best way to
fulfill these legal duties and requirements is to investigate known or suspected
misconduct. By failing to investigate, a company may not be complying with the law.

Society of Corporate Compliance and Ethics +1 952 4977 or 888 277 4977 [Link]
7
This may seem like an obvious point: why wouldn’t an employer want to investigate
possible misconduct? Wouldn’t an employer want to conduct an investigation so that it
could remedy the problem, stop its losses and prevent future problems? The truth is that
an investigation can have adverse consequences. When a company admits publicly that
it is a victim of employee misconduct, it may harm the company’s image. The admission
can expose the company to civil or criminal liability. It can affect the stock price. The
investigation may unintentionally provide its competitors and adversaries with previously
unknown information that can be used against the company.

Vicarious Liability for Employee Misconduct

Under some circumstances, a compliance investigation helps a company avoid criminal
or civil liability for an employee’s misconduct. An employer is generally liable for any
misconduct committed by an employee within the course and scope of his employment.
“Within the course and scope” basically means that the employee performed acts of the
kind he was authorized to perform and that his acts were intended, at least in part, to
benefit the company. The fact that particular conduct was wrongful does not necessarily
mean it was outside the course and scope of employment. Consequently, a company
may be held liable for the illegal acts of its employees.

However, if an employer has clearly established policies and standards that prohibit
employees from engaging in the particular kinds of conduct, and if an employer shows
that it regularly enforces those policies and standards, a court may conclude that the
employee’s conduct was not within the course and scope of employment, and the
company would then not be liable. Enforcement of policies and standards requires,
among other things, that management thoroughly investigate alleged violations
whenever they occur and that they enforce the policies through appropriate discipline to
wrongdoers.

Sarbanes-Oxley
The Sarbanes-Oxley Act of 2002 changed the laws of corporate governance in the
United States. The law and other recent developments reflect an acceleration of the
trend towards requiring corporations to adopt effective compliance programs and initiate
internal investigations to deal with allegations of misconduct. The law creates new
criminal penalties and increases the scope and severity of old ones. For example,
Section 406 of the Act requires disclosure of whether the public company has adopted a
code of ethics for senior financial officers, and if not, why not. Section 404 requires that a
public company’s annual reports include a discussion of the existence and effectiveness
of internal control structures.

Sarbanes-Oxley imposes a number of measures designed to enhance corporate

honesty and accountability. Some of its provisions require audit committees to establish
procedures (such as a hotline) for receiving and dealing with complaints and anonymous
employee tips regarding irregularities in the company’s accounting methods, compliance
controls, or auditing matters.

Sarbanes-Oxley requires a company to investigate whistleblower complaints quickly and

competently. Otherwise, this might be considered a lack of “compliance controls” under
Sections 302 and 404 of the Act. If the company rejects any whistleblower claims, the
company must be prepared to explain a competent basis for its assessment and
rejection of the claim.

Society of Corporate Compliance and Ethics +1 952 4977 or 888 277 4977 [Link]
8
Sarbanes-Oxley also makes it illegal to retaliate against whistleblowers. Companies
must therefore ensure that reporting employees remain protected. Any employee who
reasonably believes he was retaliated against because he reasonably believed that
fraud was occurring has a civil cause of action against the company. The law also
makes it a federal crime to retaliate against a whistleblower who has assisted law
enforcement.

Management, with good reason, usually pays close attention to the application of
Sarbanes-Oxley rules to its financial documents, financial reporting documents and
public statements. Any irregularities or discrepancies that are reported publicly will
receive severe treatment by the market. Auditors must also assess a company’s
compliance financial controls. The reality is that the compliance investigator does
precisely the same thing: evaluate and assess the company’s business operations to
minimize risk and ensure appropriate business conduct. (By making these linkages,
compliance officers can leverage the impact of Sarbanes Oxley and benefit from the
attention management pays to its requirements.)

Possible Federal Prosecution

There will be times when misconduct could not be or was not detected by an internal
investigation. In some cases, the company may find itself exposed to criminal liability.
The United States Department of Justice has issued a set of guidelines which gives a
significant incentive to embed the investigations function in compliance programs in its
memorandum on the “Principles of Federal Prosecution of Business Organizations.” This
memorandum is named after its author, Deputy Attorney General Larry Thompson, and
it is known generally as the “Thompson Memorandum.” The Department of Justice in
this memorandum placed new emphasis on the role that a company’s cooperation would
play in the prosecutor’s decision to bring charges or to negotiate a plea agreement.

The Thompson Memorandum specifies nine factors for federal prosecutors to consider.
Three of these factors relate to an effective corporate compliance program:

4. the corporation’s timely and voluntary disclosure of wrongdoing and its

willingness to cooperate in the investigation of its agents, including, if necessary,
the waiver of corporate attorney-client and work product protection;

5. the existence and adequacy of the corporation’s compliance program;

6. the corporation’s remedial actions, including any efforts to implement an

effective corporate compliance program or to improve an existing one, to replace
responsible management, to discipline or terminate wrongdoers, to pay
restitution, and to cooperate with the relevant government agencies. . . .

The Thompson Memorandum explains that “the critical factors in evaluating any program
are whether the program is adequately designed for maximum effectiveness in
preventing and detecting wrongdoing by employees and whether corporate management
is enforcing the program or is tacitly encouraging or pressuring employees to engage in
misconduct to achieve business objectives.” The ultimate goal is to “determine whether a
corporation’s compliance program is merely a ‘paper program’ or whether it was
designed and implemented in an effective manner.”

Society of Corporate Compliance and Ethics +1 952 4977 or 888 277 4977 [Link]
9
The mere existence of a compliance program will not relieve a corporation of criminal
liability. To the contrary, the Thompson Memorandum warns that criminal conduct “in the
face of a compliance program may suggest that corporate management is not
adequately enforcing its program.” Properly conducted investigations, as part of a well-
designed and effective compliance program, may meaningfully reduce the risks of a
corporate prosecution by federal officials.

Organizational Sentencing Guidelines

The United States Sentencing Commission's Guidelines for the Sentencing of
Organizations have become increasingly strict, thereby raising a company’s exposure.
The Guidelines seek to combat white-collar crime by imposing mandatory sentences,
harsh fines, imprisonment, restitution and public disclosures through imprisonment. The
Guidelines were designed to work in tandem with the provisions applicable to individuals
to cover the broad range of offenses with which federal prosecutors can charge
corporate defendants.

Even where company liability cannot be avoided, it may be mitigated by efforts that
include effective compliance investigation of the misconduct that caused the liability.
Under the original Guidelines, federal courts use a prescribed formula to determine fines
for organizations that have committed (or are vicariously liable for) felonies. Fines under
the Guidelines are based on two factors: the seriousness of the offense and the
company’s level of culpability. The seriousness of the offense determines the base fine.
The company’s culpability is a measure of the actions taken by the organization which
either mitigated or aggravated the situation.

Four aggravating factors that increase the culpability score and, therefore, could
increase the penalty imposed are: (i) the company’s involvement in or toleration of the
criminal activity; (ii) the company’s prior history of wrongdoing; (iii) whether an existing
court order was violated; and (iv) whether there was obstruction of justice. In 2004, the
Guidelines were amended to make the criteria more rigorous with the intention of making
boards of directors and executives more accountable for the oversight and
implementation of a compliance program. Requirements were added that requires a
company to promote a culture of compliance within the corporation. The amended
Guidelines provide two mitigating factors that reduce this culpability score and, therefore,
could decrease the penalty imposed. These two factors are (i) the existence of an
effective compliance and ethics program; and (ii) the company’s efforts to self-report,
cooperate with authorities, and accept responsibility.

An "effective program to prevent and detect violations of law" means a compliance

program that has been reasonably designed, implemented and enforced so that it
generally will be effective in preventing and detecting criminal conduct. The seven
components that a company must show include:

• Standards, including a Code of Conduct.

• An active role played by the company’s board, senior management and ethics
officer.
• Due diligence in hiring and promoting law-abiding personnel.
• Training and other forms of communications.
• Audits and evaluations of the program, and a hotline.
• Discipline for violations.

Society of Corporate Compliance and Ethics +1 952 4977 or 888 277 4977 [Link]
10
 • Remedial actions when a violation is discovered.

Failure to prevent or detect the offense, by itself, does not mean that the program was
not effective. An effective program to prevent and detect violations of law is one in which
the organization exercised due diligence in seeking to prevent and detect the criminal
conduct.

Accordingly, if a company accepts complaints through a hotline but takes no further

action to investigate or remedy the situation reported, this can result in liability to the
company. Not acting on the call puts the company at risk under the Guidelines. Offering
an anonymous reporting mechanism but not acting on calls to it would eventually lead a
judge to question the effectiveness of the company’s compliance program. As a general
matter, the Guidelines’ description of an effective ethics and compliance program has
become an industry benchmark for assessing corporate compliance practices.

E. Structuring the Compliance Investigative Function

Once management authorizes the creation of an internal compliance investigation
function, the next question is how to construct that function. The investigative function
should be tailored to the company’s needs, depending on the company’s history,
industry, and key business risks. Regardless of its precise contours, there are certain
considerations common to the compliance investigation function.

Independence
The function cannot even appear to be influenced by management. The independence
of the investigation process is crucial to ensuring that the results are a fair determination
of the facts learned. The company should consider placing the responsibility in an
independent corporate department that is not part of a business unit within the company.
Interference, whether regarding timing, methods, which witnesses to contact, which
documents deserve heightened scrutiny or ultimate determinations reached will destroy
the credibility of the investigation process. It will likely increase the risk of liability to the
company.

Consistency
Responses to allegations must be consistent and predictable. For the compliance
investigation function to be effective, employees must believe that a response to
misconduct will be handled the same regardless of the subject’s management level.

Navigating the Political Winds

An internal investigation usually takes place within a matrix of competing interests.
Inside the company, the board of directors, the audit committee, management,
employees and shareholders can have different goals and perceptions of their interest.
Players may not always place the company’s interests above their own. Outside the
company, competitors, the press, the company’s auditors, the market, and the
government may all have different motives and concerns.

Often one of the most important things compliance officers can do is convince upper
management – and the board of directors if necessary – of the importance of
understanding and solving the problem. This can be the key to obtaining adequate
resources and authority for the investigation and to obtain proper credit to the company
for dealing with the problem.

Society of Corporate Compliance and Ethics +1 952 4977 or 888 277 4977 [Link]
11
The Investigations Coordinator
Traditionally, compliance investigations were conducted by members of the legal or
human resources department. In recent years, there has been a trend toward more
objectivity in the management of this process and to embed the function in the
operations of business. There are some clear advantages for the use of an independent
compliance investigations manager – likely an attorney – to oversee the compliance
investigation process.

The Investigations Coordinator portrays an element of process fairness. The coordinator

is not part of a business unit which may be involved in misconduct, has no stake in the
outcome and has no preconceived notions of guilt or innocence of the parties. The
Investigations Coordinator is not tainted by knowledge of any past history of the subject
or accuser. The coordinator can look at the evidence with a fresh eye, and will most
likely notice things that the parties close to the matter will not see. (Human resources
personnel are typically viewed as aligned with management, and management itself
often finds itself in an untenable position. In-house attorneys are often viewed as looking
to protect the company’s legal interests at all costs, rather than searching out the facts
that show what really happened.)

An Investigations Coordinator specializes in investigations and is likely to have

significantly more experience that either the in-house attorneys or the human resources
managers. These other professionals often, however experienced in their own
disciplines, handle investigations as only one part of their other responsibilities. The
investigations they conduct are also likely to suffer from their competing time priorities. A
full-time Investigations Coordinator also shows that the company does not have a “part-
time” approach to compliance.

A good Investigations Coordinator also understands the nature of litigation. The

coordinator should understand the role of evidence, discovery and the other issues
related to litigation. As an employee, the Investigations Coordinator understands the
workplace and business operations better than an outside counsel who might be
retained to perform the same inquiries. The coordinator also understands the company’s
culture and the internal company politics that may expedite, or impede, corrective action.
The effective Investigations Coordinator uses his or her knowledge of the workplace to
draw out the facts of the case. The coordinator will be better known to company
management and its employees. This may result in more effective persuasion of
company management that action is necessary and better cooperation in requests for
information and interviews.

The Investigations Coordinator has more than just a procedural role. The coordinator
must have the skills to translate the value of the investigation process and findings into
forms of risk management and business counseling. The coordinator needs to have
nontraditional compliance competencies such as business partnership, industry
knowledge, communications and teaching skills. Business expertise and financial skills
enhance the coordinator’s value even further.

Because investigating possible compliance failures may involve questioning someone’s

judgment and putting a stop to activities that may be both popular and lucrative, the
Investigations Coordinator needs sufficient tact and clout to carry out the function.
Similarly, because company policies will be investigated, the coordinator should have

Society of Corporate Compliance and Ethics +1 952 4977 or 888 277 4977 [Link]
12
experience both in the company generally and as a manager to be credible to those who
may be investigated.

The appointment of an Investigations Coordinator is also a statement that the company

is serious about the investigation process as a permanent part of its operations. It also
reinforces the goal of integrating investigations into the management of the business.
The presence of a professional, business-based investigator makes everyone aware of
the importance of the investigation and the emphasis the company places on
compliance.

Some will claim that the appointment of a compliance investigator undermines the goal
of encouraging corporate colleagues to work together amicably by threatening the
cohesion that binds them. This view is correct only if an investigation is conducted
poorly. A properly conducted investigation – which includes an appreciation for the
corporate political forces at work – reassures management that the investigated
deficiencies or errors are viewed in a realistic, marketplace context. The fact that the
Investigations Coordinator must continue to work with these people, cultivate them as
allies and customers of the investigative process, and encourage them to refer future
matters to the compliance group actually makes it more likely that the Investigations
Coordinator will be able to navigate internal operating forces successfully.

The Investigation Coordinator has overall responsibility for the investigations process.
The competent Investigation Coordinator has specific duties:

• Making an initial determination of whether and, if so, how to conduct the

investigation.
• Ensuring that sufficient resources are devoted to each investigation.
• Determining who should investigate a particular report.
• Ensuring that the investigation is conducted in a timely manner and according to
established protocol.
• Training investigators or arranging for their training by third-parties.
• Maintaining collaborative relationships with Human Resources, Legal and
Finance departments within the company.
• Obtaining assistance from subject matter experts outside the compliance group
when that assistance is needed to conduct an investigation properly.
• Advising management whether there have been previous instances or
allegations of the same nature about the specific matter under investigation.
• Being prepared to conduct personally any investigation that warrants high-level
involvement.
• Recommending to management possible remedial steps to take as a result of the
investigation.

The Investigation Coordinator establishes guidelines in advance to avoid allegations that

the company proceeded on an inconsistent or capricious basis and will minimize the
time and effort spent addressing procedural issues when the need for an investigation
becomes apparent. The guidelines should cover when an investigation will be conducted
and how the investigation will proceed. The guidelines may also cover who determines
the need for an investigation and who will oversee it. Specific guidelines also ensure the
integrity and confidentiality of an investigation.

Society of Corporate Compliance and Ethics +1 952 4977 or 888 277 4977 [Link]
13
Focusing on Key Risk Areas
The compliance group does not investigate every possible issue the company faces.
Compliance investigations generally are limited to specific areas, and investigators are
not usually general fact-finders for the business. The compliance investigation process
must also respect the boundaries of its sister departments.

Every business faces certain key risks. Generally, the common risk areas include the
following categories:
• Accounting Irregularities
• Antitrust and other Competitive Issues
• Conflicts of Interest
• Confidential Information
• Employment Practices
• Fraud
• Insider Trading and Information
• Internal Business Operations
• Internal Workplace Conduct
• International Trade Controls
• Kickbacks and Bribery
• Misuse of Internal Company Systems
• Money Laundering
• Political Activities
• Records Retention
• Regulatory Noncompliance
• Retaliation against Whistleblowers
• Substance Abuse

Compliance officers, however, should not limit their investigations to these functional
areas. Any issue that could be considered an ethics or compliance violation, even
outside the scope of the company’s code of conduct, becomes the obligation of the
compliance group to resolve. These would include issues with any of these
characteristics:

• Deliberate or reckless attempts to circumvent normal business procedures or

controls.
• Violations of Sarbanes-Oxley or any other law or regulation concerning corporate
governance and oversight.
• Systemic or pervasive concerted action directed toward a group of people.
• Any involvement by a corporate officer or a member of the board of directors.
• Potential material financial impact to a business unit or the company.
• Likely potential harm to the company’s reputation or a risk of adverse publicity.
• Likely potential for a significant lawsuit against the company.

If a matter would be more appropriately handled by another department, such as human

resources or the legal department, the compliance officers will redirect the matter
accordingly. Even if the compliance group does not conduct the investigation itself, the
investigation must still be monitored. This is to ensure that consistent standards are
used to determine whether a violation has occurred. It also allows the compliance
officers to report comprehensively all relevant incidents which arise within the company.

Society of Corporate Compliance and Ethics +1 952 4977 or 888 277 4977 [Link]
14
Another reason for centralized monitoring of all such investigations is to maintain
consistent and appropriate discipline. This is required by the Federal Sentencing
Guidelines. Compliance officers must remain involved to mediate any difference of
opinions regarding the investigation and the substantiation of the allegations.

II. BASIC CONCEPTS OF COMPLIANCE INVESTIGATIONS

Once the investigation function has been structured within the company, the next step is
to develop operating principles to protect the interests of shareholders and the
company’s business goals.

A. Purposes of the Compliance Investigation

The investigations process has its own objectives. An understanding of these purposes
helps embed the process in the company.

Determining the Facts

The context in which a compliance investigation is conducted involves uncertainty about
events and must therefore aim to answer questions as to what happened. The
investigative process determines the facts, establishes the facts which are sufficient to
cause a reasonable person to recognize that the facts are or are not what they are
reported to be.

Establishing Accountability
An investigation establishes accountability surrounding how an event happened and
what mitigating circumstances may exist that affected the outcome of the event. The
investigation does not critique management style, unless specific management actions
contributed to the circumstances which permitted the event being investigated to occur.

Maximizing the Decision Process

Investigators are in the business of information gathering. Information developed from an
investigation maximizes options for those managers who must decide on the solution.
The only way management decision-makers can be offered the maximum number of
options is if the investigation is done right.

The Opportunity to Respond

The investigations process allows the subject of the investigation, once identified, the
opportunity to respond to the accusations. Even if the investigation would appear to be
complete, it is not over until the subject is given the opportunity to offer other facts in his
or her defense. The credibility of the investigative process requires that the subject will
be offered an opportunity to respond.

Separation from the Disciplinary Process

The investigative process must be kept separate from the disciplinary process. The
compliance investigation focuses on the independent gathering of information and not on
the process of evaluating the information as it relates to the guilt or innocence of the
individual. The investigator must gather facts that would lead a reasonable person to
conclude that the investigator did not act under specific instruction to gather only
evidence that meets predetermined conclusions of those who would make the
disciplinary decisions. The ability to show that none of the individuals involved in fact

Society of Corporate Compliance and Ethics +1 952 4977 or 888 277 4977 [Link]
15
gathering had a vested interest in the outcome of the matter, except as it related to the
fairness of the process, is essential.

Confidentiality
The process must treat the information being collected as confidential. Only those
having a need to know the information should be granted access. Dissemination of the
findings beyond those individuals needing the information for the performance of their
job responsibilities is inappropriate.

Crisis Management
Periodically, compliance personnel will be instructed to conduct an investigation as part
of the company’s handling of an ethics-related crisis. The investigations process must be
able to function in a crisis atmosphere. The crisis could be a government inquiry, a
lawsuit, the public disclosure of some image-damaging incident or the company’s
disclosure of some financial-related issue. The investigation then becomes part of the
crisis vortex in the company, and the investigation risks being overtaken by crisis-related
urgencies.

Managed properly, the investigation can assist the company in its traditional function as
well as give some structure to the company’s handling of the crisis. In his bestselling
book “Winning,” Jack Welch offers five assumptions for senior management to keep in
mind when a crisis happens. Each one can also be applied to the compliance
investigations process when it is part of crisis management:

• “Assumption 1: The problem is worse than it appears.” Investigators usually do

not restrict the scope of their inquiries to the known facts or the perceived
misconduct. Frequently, as an investigation proceeds, the scope will widen or narrow
depending on the facts developed. In a crisis, company personnel may try to
downplay perceived bad facts or not be forthcoming with investigators. Therefore,
when planning an investigation during a crisis, compliance personnel must assume,
at least as a working hypothesis, that the problem is worse than it appears.

• “Assumption 2: There are no secrets in the world, and everyone will eventually
find out everything.” Seasoned investigators conduct investigations with the
assumption that any part of the investigation may be disclosed publicly. Although it is
a sound strategy to investigate in a way that preserves legal privileges against
disclosure to the greatest extent possible, this strategy cannot be relied on blindly.
Limits to confidentiality must also be remembered when conducting witness
interviews. Investigators must ask questions that are more probing than they might
ordinarily ask because the existence of the crisis may encourage witnesses to say as
little as they can. And even if the compliance officers try to maintain as much
confidentiality as possible, the company may, in the end, decide to preserve its own
credibility by disclosing as much information as possible.

• “Assumption 3: The investigator and your organization’s handling of the crisis

will be portrayed in the worst possible light.” The time for using the best
investigative resources available is when a crisis occurs. The investigation must be
conducted as professionally and thoroughly as possible. Even so, some will likely
accuse the investigators of “white-washing” the matter under investigation. Others
will complain that the company is being too aggressive in the investigation and is on
a “witch hunt.”

Society of Corporate Compliance and Ethics +1 952 4977 or 888 277 4977 [Link]
16
• “Assumption 4: There will be changes in processes and people. Almost no
crisis ends without blood on the floor.” If the investigation focuses on determining
the true facts concerning the affected business processes and people, the
compliance officers provide genuine value to the company. In a crisis, accurate facts
may be hard to determine, especially under time and management pressures. Senior
management may be looking to dismiss those they believe are responsible in order
to repair the company’s public image. The investigation provides these decision-
makers with objective facts about what precisely happened and how it occurred.

• “Assumption 5: The organization will survive, ultimately stronger for what

happened.” The crisis and the facts determined from the investigation can provide a
number of lessons to the company, if the company has the courage to confront what
happened. There can be no lessons learned unless the investigation was conducted
properly. (Welch, pp. 153-161.)

B. Timing of the Investigation

Investigations vary in complexity and the length of time to complete them. However, all
investigations must be conducted promptly. A timely investigation gives the company
more time to develop appropriate responses or defenses. If an investigation is not timely,
the company may not qualify for credit for full cooperation under the Sentencing
Guidelines.

• Timeliness is part of a professional investigation. It important for other reasons as

well:
• Innocent people should be cleared as soon as possible.
• Corrective action is generally more effective when taken closer to the triggering
event.
• Ongoing misconduct must be stopped as quickly as possible.
• The investigation will assist in any legal action that may arise in connection with
underlying matters.
• Promptness may be a mitigating factor in almost every level if government
enforcement, and delay or indifference can be seen as an aggravating factor.

The timeliness of a particular investigation is, of course, unique to that investigation. The
Investigations Coordinator will generally set the timetable that gives a reasonable
amount of time to conduct the investigation.

C. Investigation Team Members

The Investigations Coordinator, or the person performing that substantive role,
determines the appropriate investigator for a specific investigation. If necessary, the
coordinator should work in conjunction with internal audit, human resources or risk
management if an investigation requires such collaboration. The coordinator also retains
private investigators, outside counsel, and certified fraud examiners as needed. Staffing
the investigation requires a consideration of the advantages and risks of appointing
certain personnel as investigators.

Lawyers as Investigators
Lawyers are generally considered to be best-suited to investigate because investigations
typically involve interviews with company personnel (some of whom may be hostile), the

Society of Corporate Compliance and Ethics +1 952 4977 or 888 277 4977 [Link]
17
analysis of complex facts, and a final determination as to whether there have been any
civil or criminal investigations. Most lawyers are adept and experienced at examining
witnesses, sifting through facts, and ranking both in order of their importance. Certainly,
experienced attorneys are able to determine the necessary obligations of the corporation
in each particular circumstance, and counsel will make recommendations concerning
what actions to take as a result of the investigation.

However, lawyers do not always make the best compliance investigators. Although they
are skilled in gathering evidence and preparing a case, their expertise is generally
limited to some area of the law. These are not the only talents needed. Lawyers also do
not usually have the skills needed to advise the company on whether and how to
continue to conduct its business operations differently in the future. Lawyers are also
predisposed towards assessing risk rather than proposing a business-focused
resolution. It would be unlikely that they could serve in the other roles as a business
counselor, trouble shooter and operations improver.

There are also certain risks with using lawyers as investigators. An attorney who is
directly involved in interviewing witnesses or gathering evidence may be a fact witness in
a later suit, and thus may be disqualified from acting as the employer’s attorney.

If the attorney is involved in interviewing witnesses or directly gathering evidence, there

may be a need to disclose the attorney’s notes or have the attorney testify about his or
her role in the investigation. In this situation, the attorney’s advice to the company may
not be legally privileged from disclosure, and opposing counsel may be able to force
disclosure of all communications between the attorney and client regarding the subject
of the investigation.

There may be a preference to have investigations conducted by in-house counsel. The

counsel’s familiarity with the company, its policies, personnel and compliance politics is
an advantage to the corporation. Investigations conducted by in-house counsel may be
less costly and more efficient than one conducted by outside counsel. Employees may
also be more willing to talk openly with in-house counsel than an outsider.

However, there exists the risk of perceived bias because the in-house counsel is seen
as a management representative, especially if a member of senior management or
human resources is the subject. As company employees, they may appear less credible
and independent. Credibility is essential to gain the confidence of investors and
regulators when there is a suspicion of wrongdoing. There is an increased risk that in-
house counsel may possess information that could make him or her a fact witness.

Outside counsel will sometimes be retained for the investigation to provide a quick
response and to fill the need for additional resources. These lawyers can also help
where the existing compliance staff and the company’s internal lawyers do not have the
subject-matter skills needed for the investigation. Whenever it is important to
demonstrate that the fact finding was done by objective parties, it may be wiser to
choose outside counsel.

Auditors and Accountants

If the investigation requires reviewing financial records and an understanding of
business processes, the use of auditors and accountants seems obvious. Auditors can
be used to review documentary evidence, evaluate tips or complaints, schedule losses,

Society of Corporate Compliance and Ethics +1 952 4977 or 888 277 4977 [Link]
18
and provide assistance in technical areas of the company’s operations. Auditors are the
ones who frequently detect the financial anomalies. They can also identify fraud
indicators.

Accountants, however, generally have limited fraud-investigation experience. Auditors

and their accounting counterparts also may not be able to complete an investigation that
requires more than straightforward “number crunching.” If the scope of the investigation
includes a larger perspective on the operative facts – especially if witnesses must be
interviewed – these professionals are better used in collaboration with other
investigators.

Corporate Security
Depending on the company, security department investigators are often assigned the
field work part of the investigation, including interviewing outside witnesses and
obtaining public records and other documents from third parties. The drawbacks are that
they often have little experience in compliance investigations and may have a limited
view of the issues. Considering their day-to-day role, they may also attract unnecessary
attention to the investigation.

Human Resources Personnel

The human resources department should be consulted to ensure that the laws governing
the rights of employees in the workplace are not violated. Human resources personnel
can also be useful if the claims involve allegations of discrimination or retaliation. Their
involvement will lessen the possibility of a wrongful discharge suit or other civil claim.
Compliance officers, however, should remember that these personnel generally have
limited expertise in the relevant legal areas. Also, their skills and abilities may be limited
because of the nature of their regular duties.

D. Management Steps
No matter how good the investigator or the investigation, the ultimate objective of the
investigation is to present information to management to enable them to make the
necessary decisions for the benefit of the company and its shareholders. At the
conclusion of the investigation, the findings must be placed in a written report sufficient
to inform management of the relevant facts and at the same time set the groundwork for
compliance business improvement, the commencement of civil litigation and/or a referral
of the matter to law enforcement.

Compliance officers must remember their responsibilities as risk managers and business
advisors. Communicating the results of the investigation as a form of business
counseling provides a valuable opportunity to spotlight the value of the compliance
process.

Reporting the Findings

Sometimes, business managers would rather not see anything in writing. This view
should be unacceptable to management and certainly to compliance officers. There are
a variety of methods available to the corporation through legal counsel to assure a
limited distribution of an investigative report. The first time an investigative report is
suppressed for the purpose of avoiding a proper review by management marks the
beginning of the end of compliance investigative integrity for the company.

Society of Corporate Compliance and Ethics +1 952 4977 or 888 277 4977 [Link]
19
The investigator must provide answers to the “magic questions” of the investigation:
who, what, where, when, why and how. The answers represent the investigative
findings. The detail provided should be sufficient to explain compliance business
processes to someone who is unfamiliar with the business. The investigator must
remember that the managers who will read the report have limited time available. The
investigator who can accurately tell the story in the fewest words stands a better chance
of having the report reviewed.

As companies increasingly view their compliance officers as business counselors,

reporting the findings is the best opportunity to show the investigation’s value to the
company. The compliance professional needs to have good communications abilities,
problem-solving skills, knowledge of the business and client partnership skills.

The Final Report

A written report creates a lasting record of the findings and allows management to
consider its contents over time and review the report as needed. A written report should
be a persuasive way of communicating that misconduct did not occur or that corrective
action has already been taken. The report also provides support for the company’s
ultimate decision in resolving the matter, and it shows that the company’s investigative
process was objective and neutral. Finally, the report constitutes the company’s “stake in
the ground;” the company has committed to these facts when making its decision
regarding how to proceed.

There are many ways to organize a final investigation report. Written reports can be
valuable aids for management to develop corrective procedures to avoid repetitions of
questionable conduct. A written report may also be a persuasive way of communicating
to third parties that wrongful conduct did not occur or that corrective action has been
taken internally. The report also forces us to reach firm conclusions and is an easy way
to review the results of the investigation with senior management.

The form of the report depends on its intended use. The Final Report is not a chronology
of the investigation. The report states whether the allegations of misconduct were
substantiated, unsubstantiated, or whether the findings were inconclusive. If the
misconduct is substantiated, the Final Report will cite the policies violated and the harm
the company suffered as a result.

The Final Report is limited to the scope of the investigation. The scope should be clearly
specified in the report. The report, recommendations and findings should be limited by
that scope as well. This will provide a clear understanding to anyone to whom the report
is disclosed regarding the investigation’s limitations.

A proper Final Report offers no recommendations regarding how an employee should be

disciplined, whether the company should compensate someone, or similar possible post-
investigation activity. Those steps are outside the scope of the investigation. If the
investigator were to decide the resulting disciplinary action to be taken, a conflict of
interest may be created that interferes with the investigator’s ability to find the truth of
what happened. The Final Report may, however, include recommendations for
additional investigation and remedial changes.

The drafting of the Final Report, however, is not without risks. Compliance officers and
investigators should be conditioned to think before writing. If the report will cover any

Society of Corporate Compliance and Ethics +1 952 4977 or 888 277 4977 [Link]
20
sensitive areas, the drafter should consult the company’s legal department. At least in
the most sensitive areas, and in any preparation for litigation, the company may take
steps to permit it to assert the attorney-client and other privileges.

Great care should be taken to protect the confidentiality of the final report. A written
report means there is a greater risk of disclosure to people who should not read the
report. Given the ubiquity of photocopiers, scanners and e-mail, it is easy to copy and
circulate a report widely.

Action in Light of the Investigation

The final step in the investigation process is to implement corrective action. Compliance
officers should ensure that management has met with the person who was the subject of
the investigation as well as the employee who raised the issue.

Remedial action must be proper and prompt. Internal remedial steps could include
revising corporate procedures or management structures, revising compliance
procedures or oversight, as well as employee disciplinary action. External remedial steps
could include disclosures in public filings and compensating injured third parties.

The Final Report will also facilitate everyone’s attention and agreement regarding the
substantiated problem. The discovered problem may trigger an audit to prevent future
and more serious problems. The Final Report also may have collateral value to the
company. If the report is used in a private litigation, the findings can defend the company
from certain claims. Because the report will contain specific findings of fact and the
bases for the findings, the report can be used as a guide to resolve the dispute
informally. These uses, however, must be balanced against the risks of waiving
applicable legal privileges, identifying wrongdoers and the sources of information, and
the possibility that the report may be circulated beyond the company’s control.

E. Tracking and Metrics

Compliance officers must provide senior executives and/or the board of directors with an
overview of investigations opened during a specified time period, usually a month or a
calendar quarter. Background information tracked by the compliance group and reported
generally includes:

• The date the investigation was opened.
• The date the investigation was closed.
• The name and location of the reporter, if known.
• The name of the individual responsible for the resolution of the complaint.
• The nature of the complaint (i.e. the issue type).
• A summary of the facts elicited by the investigation, including whether the
allegations were substantiated.
• The disciplinary or remedial action taken, if necessary.

The measurement of quality and productivity is an essential component of managing

investigations as an embedded business function. Compliance officers must find ways to
measure the values of the investigative process in terms which have a relevance to
those values which contribute to the company’s profits. Few executives will fund an
investigative process without strong proof that a contribution to the bottom line will result.

Society of Corporate Compliance and Ethics +1 952 4977 or 888 277 4977 [Link]
21
When compliance officers fail to measure their value to the business enterprise, they
give management the opportunity to view the function as just one more expense of the
business and not as a contributor to company value. Some may consider it easier and
less expensive to avoid misconduct investigations and to simply terminate the employee
or pay the employee a healthy severance to simply go away. Although it is an expensive
decision for a company to proceed this way, without metrics there is no way to show the
true costs of that decision. Measuring the investigative function and its ability to
productively conduct investigations and offer decision-making support to management
can be shown to make a productive contribution to company equity and long-term
loyalty.

There are a variety of metrics to measure the investigative process, and the most
relevant focus on the efficacy of the process. Compliance officers may wish to use any
of these measurements:

• Number of incidents reported per 1000 employees.

• Percentage of employees disciplined for misconduct.
• Percentage of total compliance failures detected internally.
• Percentage of total compliance failures detected by hotline call.
• Percentage of total allegations that are substantiated.
• Percentage of contacts to the compliance and ethics office reporting an
allegation.
• Percentage of contacts to the compliance and ethics office seeking advice.
• Summary (and corresponding percentage) of most frequent allegations.
• Investigation cycle time during a specific time period.
• Number of cases opened during a specific time period.
• Number of cases closed during a specific time period.
• Average cost to conduct an investigation during a specific time period
• Summary of substantiated cases during a specific time period.

To overcome the misconceptions of managers as to the purpose of the compliance

investigative function, compliance officers need to talk in terms these managers
understand. Compliance officers must be able to communicate results that contribute to
the company’s profits and well-being. Compliance officers must continually look for ways
to present meaningful data which reflects its achievements and essential role as an
embedded business function within the operations of the company.

Society of Corporate Compliance and Ethics +1 952 4977 or 888 277 4977 [Link]
22
SOURCES
Brennan, James and Jeffrey Kaplan, Making Compliance Training Effective, GC New
York (July 25, 2005).

Brian, Brad and Barry McNeil, Compliance Corporate Investigations (American Bar
Association 2003).

Bussmann, Kai-D., Causes of EconCrime and the Impact of Values, Business Ethics as
a Measure of Crime Prevention (2003), at [Link]

Cole, Richard, Management of Compliance Business Investigations: A Survival Guide

(Charles Thomas 1996).

Conducting Compliance Investigations (Association of Certified Fraud Examiners 2003)

at [Link]

Corporate Compliance (October 2004) at [Link]

Edwards, Deborah L., Mark Colloway and Brian Edwards, What to Do When the Whistle
Blows: Do’s and Don’ts of Compliance Investigations (2004) at [Link]

Employing Legal Privilege to Protect Compliance Audits and Risk Assessments,

Corporate Executive Board (2005), at [Link]

Federal Sentencing Guidelines after the Booker Decision, Compliance and Ethics
Leadership Counsel (2005), at [Link]

Frank, Jonny J., The Role of the Forensic Accountant in Internal Corporate
Investigations (2003), at [Link]

Haig, Robert, Successful Partnering between Inside and Outside Counsel (Thomson
West 2004).

Hancock, William (ed.), Corporate Counsel’s Guide to Legal Audits and Investigations
(Business Laws, Inc. 2005).

Harrison, Orrin, Conducting Corporate Investigations under the Increased Scrutiny of

Sarbanes-Oxley (2003), at [Link]

Kahn Consulting, Inc., How to Conduct a Corporate Internal Investigations Reference

Materials (2004), at [Link]

MacKillop, Malcolm, The Reason Harassment Probes Fail (2004), at

[Link]

Marmer, Ronald L., How to Conduct Internal Corporate Investigations after Sarbanes-
Oxley (2005), at [Link]

Martin, Jay, Conducting an Effective Compliance Corporate Investigation (2002), at

[Link]

Society of Corporate Compliance and Ethics +1 952 4977 or 888 277 4977 [Link]
23
McNamara, Carter, Complete Guide to Ethics Management: An Ethics Toolkit for
Managers (2005) at [Link] .org/ethics/[Link].

Memorandum from Larry D. Thompson, Deputy Attorney General, U.S. Department of

Justice, to Heads of Department Components and United States Attorneys, dated
January 20, 2003, at [Link]

Michael, William and Mark Larsen, Compliance Investigations (2004), at

[Link]

Overview of Complaint Reporting, Investigation, and Tracking Processes (May 2005),

Compliance and Ethics Leadership Counsel, at
[Link]

Pfadenhauer, Diane M., Workplace Investigations: Rethinking the Traditional Paradigm

and Advocating the Use of Third-Party Investigators, HR Advisor (July 2005), at
[Link]

Poteet, Dewey, How to Conduct an Effective Workplace Investigation (2001), at

[Link]

Presby, J. Thomas and David Simon, The Golden Rule Meets the New Normal: The
Future of Compliance, NACD – Directors Monthly (October 2004).

Propper, Eugene, Corporate Fraud Investigations and Compliance Programs (Oceana

Publications (2000).

Silverstein, Ira, Hear No Evil, See No Evil No Longer Viable, Outside Counsel (2005), at
[Link]

Steinberg, Marc I., Attorney Liability after Sarbanes-Oxley (Law Journal Press 2005).
The Vision of the Future for the Compliance and Ethics Function (January 2006),
Compliance and Ethics Leadership Counsel, at
[Link]

Webb, Dan K., Corporate Compliance Investigations (Law Journal Press 2004).

Welch, Jack, Winning (Harper Business 2005).

Winter, Kenneth, Doing It Right – Overseas (1999), at [Link]

Society of Corporate Compliance and Ethics +1 952 4977 or 888 277 4977 [Link]
24