One of the most essential and vexing aspects of any compliance program is the challenge of establishing and maintaining a whistleblower program that employees trust to fairly handle reports, protect anonymity, and prevent retaliation. Ethisphere’s partners at EY have experience running and consulting on whistleblower programs around the world. We convened a roundtable of three of their practitioners to discuss the challenges and opportunities they present. This transcript has been edited from the full hour-long roundtable, which you can watch below.
Tyler Lawrence: Could each of you briefly introduce yourselves and tell me a little bit about your areas of expertise?
Cecilia Melzi: I’m a partner in the forensics practice of EY in Lima, Peru where we have a strong practice composed of nearly 90 people. We provide and operate whistleblower hotlines, and manage implementations and training for more than 200 clients in Peru and in the Andean region.
Katharina Weghmann: I’m a partner responsible for our integrity and ethics offerings. For the past four years, I’ve had the pleasure of working with our clients on measuring ethical culture, and then creating cultures of integrity in a more sustainable way. I have a research background on the topic of whistleblowing, a passion of mine ever since the financial crisis. It’s an honor to be here and share the research lens, and how it translates into practice.
Liban Jama: I lead our investigations and compliance practice across the Americas. I spend a lot of my time assisting our clients in building out their compliance programs using data to help inform decision making. Prior to EY, I was in the U.S. federal government and spent more than a decade at the Securities and Exchange Commission. This was around the same time that whistleblower rules were developed by the Commission. I offer a perspective from the regulatory side, particularly the US, as well as from the work that I do with clients around the globe.
Tyler Lawrence: For employees to feel comfortable raising concerns, you have to set up a baseline speak-up culture. What kind of environment is necessary for employees to have that security in the first place?
Liban Jama: From my perspective, it’s really about fostering an environment of trust, and then building out that culture. You want a process that addresses the procedural perspective and also offers meaningful action where employees know that leadership values their insights on issues.
Katharina Weghmann: We need to be very mindful about how we design and perpetuate a culture of trust, and also how we value the very concept of employee voice. If we look into the research, we ask: why don’t people speak up? The reason why they don’t speak up is either they believe nothing is going to happen, or there is a fear of retaliation. How do we mitigate those beliefs, and how do we design an organization very mindfully around creating that psychological safety? We also need to look at moments where people don’t speak up, and create an environment—through leadership, through role modeling, among others—in which we listen to voice and dissent.
Cecilia Melzi: It’s not an easy decision for a person to make a report. It’s a balance of costs and benefits. So, companies should aim to ensure that the balance goes to benefit, that it’s a win-win. Trust is what makes whistleblowing work—trust that the company will listen, and if applicable will take corrective actions. It’s really important that people know that the company really believes in speaking up, and in listening to its people. There’s a big difference in the message you give to people about why you do things. It’s not because you want to comply or avoid any penalty, it’s because you really believe in listening. That message from the top management is key.
Liban Jama: In 2020 EY did a comprehensive global integrity report that focused on the issue of trust. We surveyed employees at more than 3,000 companies, and one in five respondents felt that they weren’t sufficiently protected from retaliation. That’s pretty compelling, and goes to the importance of building an environment in which habits create a culture of trust. How you develop and support those habits will build the culture you want to have. In our most recent survey, there are still companies where people feel that lack of trust, despite 94% of organizations saying they had a hotline.
Tyler Lawrence: What risks does the company create by not promoting a speak-up culture, and creating a situation where employees might be hesitant to report?
Cecilia Melzi: The main risk is that people do not believe in what the company is doing, do not think they have available channels within the company, and then go to regulators.
Liban Jama: Think about it from the commercial perspective. So often when we talk about the downsides, we talk about blind spots, missing something, or reputational harm. If we take a step back, all of those elements are really important, but we’re in an environment where expectations have changed. More employees, particularly younger employees, expect their organizations to allow them to be aligned with the missions and values in the code of conduct. There is a commercial imperative in terms of talent retention and customer expectations.
Tyler Lawrence: What are some warning signs that companies should be looking for that perhaps they have a problem with ethical culture?
Liban Jama: A lack of information in the system. Sometimes it’s counterintuitive. Folks will say, “Our hotline reporting numbers are down—that might be problematic, right? Are people feeling safe and secure to talk?” The lack of information may be a red flag in and of itself.
If we look at the US data, particularly with a lot of the social justice issues that have arisen, you see a spike in hotline activity with respect to workplace misconduct, and then it slows down in the months afterwards for a lot of sectors. Does that indicate there were fewer issues? I don’t think so. Sometimes we have to look at the data holistically.
Katharina Weghmann: This holistic approach to measurement is really important. Speak-up data is only one element of the overall culture. There are a lot more proxies that influence speak-up behavior and retention. It’s also good to look at external data. What are the market perceptions of your brand, and your organization? Not just as an employer, but how is your company perceived? There are other structured data sets within the company. You can look into HR data. For example, diversity and inclusion data influences the way in which people feel like they can bring their whole self to work, whether they feel like they belong and can speak up about certain topics, especially in times of COVID.
Cecilia Melzi: Any decrease in the number of reports should be examined. An example from our work in Peru for a client: we helped launch a hotline, and in the first two days, we received 40 reports. We thought, wow, these people need to talk. We started transmitting the reports to the ethics committee, which was just the general manager. But then the management didn’t like all the information they received. They kept the hotline open but they ignored the reports. So then there were two, five, six reports, and then no more. People realized that there was no point, because the management did not take action.
Tyler Lawrence: An effective whistleblower program can’t just exist. Employees have to think something might come of it. What else should companies do to make sure that employees have trust in the process?
Cecilia Melzi: I have three key best practices I want to share. The first is the most critical: have a third party in charge of operating the whistleblower hotline. Why? Because that independent third party will be objective, without any conflict, and will give the employees confidence that there will not be retaliation. According to our statistics, 82% of people report anonymously. They do not want to share their information with the company. But, 33% will share their information with us as third party, so we can follow-up, ask questions, and report the information to an ethics committee.
My second piece of advice is to have compliance procedures so you know what to do, and who to share information with, whether the ethics committee or an alternative way to report if there are conflicts. My third piece of advice is to disclose procedures as much as possible to reporters, so they know what to expect.
Liban Jama: A powerful component of communication is the ability to tell narratives transparently. Be thoughtful about the approach. What should we communicate about our results on a quarterly basis? What are the themes we want to suggest? What do we want to highlight?
There are also cultural considerations. In the US, we have our own biases about how we think things should be done. It’s incredibly important to have nuanced conversations around the globe on what is expected, what is likely to occur, and to listen to what would be most effective in a particular geographic space.
Katharina Weghmann: We need to put people over process, to be human-centric and try to understand what seems to be driving them, what seems to be making them afraid. What’s not working so well? How can we facilitate and normalize the process for people? Ultimately any type of ambiguity is going to add extra anxiety for the person who is speaking up. What we can see in the regulatory space, especially in Europe with the new whistleblower protection rules coming into effect at the end of this year, is that speed and staying in touch with the reporter seem to be very important.
Additionally, the root causes of cases have to be fed back into the organization, and we need to find a way to communicate about them. What are the patterns? What are the measures we are taking to remediate those in the long run? If we package it in the right way, it can be really powerful to bring this back into the organization, learn, move ahead, and try to make people feel like we have heard them.
Tyler Lawrence: What can organizations do to make good on retaliation protections? What kind of follow-up do leading organizations do?
Liban Jama: It’s critically important to highlight cases and let people know that we had someone raise an issue, and we’re being transparent about it, and these are the things we did to reform and remediate and celebrate the individuals raising important issues and say, “This is what we want to see.” If you do that consistently, you build a culture of expectation that significantly allays concerns about retaliation.
Cecilia Melzi: You must also establish what conduct is considered retaliation. We see clients establishing post-report monitoring for one to three months. They try to reach the reporters if they have provided contact information. They ask us to follow up to see if they have more information, how they are feeling, and if there has been any retaliation.
Katharina Weghmann: You can also go one step further. Recently, I’ve seen companies look into the career trajectories over time of those who report. From the research, we can see that careers can very much be inhibited, either because people found out who spoke up or anonymity couldn’t be ensured. Look at the careers of each reporter. Do they leave the organization? How did their career path progress?
Tyler Lawrence: Whistleblowing requires this delicate balance of protecting reporters, but still ideally being able to follow up. How can companies attempt to strike that balance? and what tools are now allowing companies to maintain communication, even with an anonymous report?
Katharina Weghmann: The most mature organizations already monitor which reports come in informally, and they calculate how many people report through formal or informal channels. My hypothesis would be that organizations that have more informal reports have a higher level of trust. This could be a good proxy for us to measure if we’re progressing in that space.
Technology enables us to be so much more advanced in the way we serve employees—to have a confidential conversation, guide people through the process, and help them feel comfortable. I have hope that this is going to change the game for engaging those who might not feel comfortable speaking up.
Liban Jama: With the analytics, it’s not just the individual hotline requests. We are essentially doing a heat mapping exercise, and then we’re tailoring our remediation based on those analytics so that we can have a much more end-to-end process in how we address these issues.
Cecilia Melzi: A way to balance the anonymous report with a desire for follow-up is to give all reporters a code through email, web, or phone so they can then access status information about the case—in process, dismissed due to a specific reason, or closed, for example. If the company does not want to provide specific case details, they can still communicate more broadly through bulletins, quarterly or monthly magazines, or town hall meetings. That allows reporters to know they had impact, and also builds trust in the system. That’s key, because we receive a lot of emails asking, “What happened with my report?” We’re always encouraging companies to make these specific ways that the reporter can enter and see the steps.
Tyler Lawrence: How do you convince people that sharing stories can benefit an organization?
Liban Jama: Align with commercial interests, really understand the business issues that your stakeholders are managing through, and speak in that language. To give a specific experience, if onboarding third-parties for risk management is taking too long, what analytics can I use to help shorten that process? You have to speak the language to effect change.
Katharina Weghmann: The way that I would lead these conversations is to share a macro perspective of the trends that we see, which all seem to indicate that transparency is not going away. For example, one macro trend is investors pushing heavily for ESG.Transparency is also a trend we see in the regulatory space, pushing into questions such as, how do you monitor? How do you report externally? Being serious about your speak-up culture, and being able to prove it, will create public trust in your organization and increase the chances of acquiring talent and capital.
Cecilia Melzi: If I’m the compliance officer and I have to sell it to the board or to the general manager, I emphasize that it is a matter of numbers: you will earn more, lose less, improve processes and establish new controls, and that will make the organization more efficient.
About the Expert:
Liban Jama is a Partner and EY Americas Forensic & Integrity Services Investigations & Compliance Leader. Earlier in his career, Liban spent nearly a decade at the United States Securities and Exchange Commission (SEC), where he was responsible for handling a broad range of the SEC’s domestic and international enforcement matters, including investigations involving accounting and disclosure fraud, insider trading and illicit payments under the Foreign Corrupt Practices Act.
Cecilia Melzi is a Partner, EY Forensic & Integrity Services, Peru. She has seventeen years of experience in providing forensic services related to corporate compliance, disputes, investigation, the prevention of fraud, and data analytics.
Katharina Weghmann is a Partner, EY Forensic & Integrity Services, leading the integrity and ethics advisory work in EMEIA. Together with her interdisciplinary team, Katharina consults organizations in measuring, institutionalizing, and building cultures of integrity.
