A new benchmark report closely examines what is and isn’t working with whistleblower hotline programs, especially as they concern fraud detection. Among the most troubling findings: 25 percent of organizations still don’t have a whistleblower program and among those that do, only 39 percent bother to audit them.
The report, “Building a Best-in-Class Whistleblower Hotline,” published by the Institute of Internal Auditors (IIA) and the Association of Certified Fraud Examiners (ACFE), examines the structure and components of a whistleblower hotline program, as well as aspects of hotline programs that contribute to program success.
According to the findings, 75 percent of respondents said their organizations have a whistleblower hotline program, while the remaining 25 percent of respondents said their organization either did not have one in place, was considering one, or they were not sure.
“Research by the ACFE indicates that whistleblower tips are, by far, the most common way that fraud schemes are detected,” said ACFE President and CEO Bruce Dorris. “Without effective whistleblower hotline programs in place, employees may not know where to turn if they suspect fraud is occurring within their organization.”
Whistleblower Hotline Program Oversight
Hotline administration: Most organizations (84 percent) have at least some internal parties involved in the administration of their hotline programs, and 41 percent keep the administration of the program entirely in-house. Only 11 percent of programs are fully administered by an external third party, but 54 percent engage an external third party in at least some administrative aspects of their program.
Hotline oversight: Asked which business units in their organization are responsible for managing or overseeing the hotline program, the most common answer was the internal audit function, cited by 42 percent of respondents. Other common business units with hotline oversight were compliance (36 percent) and the audit committee (36 percent).
“Internal auditors and anti-fraud practitioners play vital roles in their organizations’ whistleblower hotline programs,” said IIA CEO Anthony Pugliese. “Whether it’s administrating the program or investigating tips, we’re on the front line in the fight against fraud. This IIA and ACFE collaboration shines a light on the need for further fraud detection and prevention programs and provides a roadmap for how to create them.”
Multiple reporting channels: Most organizations (83 percent) provide multiple channels for reporting as part of their hotline programs. The most common hotline reporting mechanisms provided by organizations are dedicated phone numbers, online reporting mechanisms, and dedicated email addresses.
Anonymous reporting channels: The report also found that 91 percent of hotlines have the ability to receive anonymous reports; 83 percent can receive reports 24 hours a day, 365 days a year; 76 percent have mechanism to protect whistleblowers; and 70 percent have an official whistleblower reporting policy.
Whistleblower protection mechanisms: The top cited approach for protecting whistleblowers from retaliation, cited by 72 percent of respondents, was having in place “an official anti-retaliation policy, either as a standalone policy or as part of another organizational policy,” according to the study. Additionally, 55 percent have an official process or channel for reporting and resolving allegations of retaliation.
The survey showed management training could improve, however. Just 44 percent of respondents said they train their managers on how to avoid, recognize, and respond to potential retaliation, and only 36 percent have targeted messaging from the organization’s leaders about zero tolerance for retaliation, “both of which reinforce the effectiveness of anti-retaliation policies and ensure that the policy is enacted effectively,” the survey said.
Reporting metrics: Only 39 percent of hotline programs undergo formal audits, according to the survey. The top cited metric to assess the effectiveness of the program overall: “number of complaints per period,” cited by 66 percent of respondents. The other top two metrics cited were “percentage of complaints substantiated or investigated (47 percent);” and “complaints received by claim type” (47 percent).
Hotline Program Effectiveness
Regarding the most important considerations for a successful whistleblower hotline program, several common themes emerged. “The top four considerations cited by respondents were anonymity, hotline awareness, follow-up actions, and retaliation protection,” the report stated.
The report further noted that other critical aspects of a best-in-class whistleblower hotline program have to do with a level of trust—for example, “that the whistleblower’s identity will remain anonymous, that reports will be taken seriously and acted upon, and that the whistleblower will be protected from retaliation,” the report noted.
The report surveyed a total of 1,600 IIA and ACFE members worldwide between December 2022 and January 2023. The plurality of responses (42 percent) came from North America, while the remaining survey respondents came from Africa, Europe, Asia Pacific, Latin America, and the Middle East. 
Jaclyn Jaeger is a contributing editor at Compliance Chief 360° and a freelance business writer based in Manchester, New Hampshire.