New DOJ whistleblower incentives. Investigation-related KPIs. Accountability demands from stakeholders of all stripes.
A combination of hard work by ethics and compliance professionals, high profile internal system failures, increased government interest and enforcement have resulted in more attention paid (if not always more resources given) to corporate internal investigation programs.
These pressures confirm the necessity of a solid, well-socialized investigation program that can: effectively triage, investigate and resolve allegations of differing complexity; swiftly, equitably, and consistently offer useful post-investigation training and lessons learned; and adequately deter retaliation. Oh, and it also must be completely defensible to regulators at both the federal and local level.
The meaning of success in raising the profile of internal investigations is clear:
You, and your program, will be judged on outcomes, processes and metrics you use to define and measure your E&C program.
Balancing how to meet these expectations, both in planning and execution, is key to building and maintaining a successful internal investigation program into 2025 and beyond.
Let’s explore several more nuanced aspects of internal investigations, including:
- What happens when you ask people to speak up and then they do
- New whistleblower incentives and the impact on timing
- Sharing Lessons Learned while keeping your guard up
- Key performance indicators (KPIs)
Delivering – If you invite people over, you better be prepared for company…
Whistleblower reporting is up overall per the 2024 NAVEX Whistleblowing & Incident Management Benchmark Report – which is definitely good news. It likely reflects the success of concerted efforts to support and encourage a speak-up culture including increased communication and training. Regulator guidance (including the recently-updated DOJ guidance for the Evaluation of Corporate Compliance Programs) also emphasizes strong outreach as a necessity for a well-functioning compliance program.
If you’re looking to increase reporting, the good news is that communication is often one of the easiest components to level up. While communication resources and creativity vary from organization to organization, most companies have multiple channels to reach their staff and stakeholders. Amplifying a “Speak Up” message can be accomplished with a little planning and negotiation with the corporate comms team – and if you have some in-house creative folks, you may even make it fun.
But before you lean too far into the sort of communications that are likely to increase reporting, inquiries and feedback – pause and ask yourself, are you ready to handle success?
It’s important to remember that when you put out a clarion call for information, you need to have the investigative personnel and resources to meet the response. This also includes the ability to promptly triage intake and ensure a smooth referral process is in place for reports and inquiries best handled by other departments. Not being prepared to deliver on your promises – timely response to questions, well-staffed investigation teams, fair and consistent corrective action – is a self-inflicted wound that both negatively impacts your compliance culture and burns out and demoralizes your team.
The DOJ whistleblower pilot program and the race to disclose
The Department of Justice’s new Corporate Whistleblower Pilot Program (CWPP) adds a new option outlet for potential corporate whistleblowers. The pilot program offers up to $30 million for tips leading to certain criminal convictions or forfeitures, particularly targeting healthcare and financial services firms. While whistleblower incentives are nothing new, one aspect of the CWPP may prompt compliance teams to pause when evaluating internal allegations of potentially criminal conduct.
Longstanding DOJ sentencing guidelines offer potential credits to an organization that shares internally reported criminal allegations with the DOJ before the agency hears about it from another source. However, under the CWPP a company must self-report within 120 days of receiving an internal whistleblower report to be eligible for credits that include a presumption of declination to prosecute. The goal remains the same: encouraging self-disclosure. However, the 120-day window means organizations need to consider disclosure earlier than they might have otherwise, and often while an investigation is still in flight.
This element may prompt compliance teams to consider adding a step in their triage process for allegations of criminal behavior covered by the CWPP (e.g., bribery, kickbacks etc.). Such allegations should essentially be pulled out of the normal investigative flow, escalated to senior compliance and legal leaders, and analyzed for potential disclosure while being fast-tracked for investigation. This may occasionally result in disclosures being made before the company understands the full scope of the case. From an investigation process point of view, the key is to spot the issue early and preserve the disclosure option to the greatest extent possible.
Obviously, given the winds of change in the U.S. politics, it’s worth noting that DOJ’s priorities could change.
Sharing Lessons Learned while keeping your guard up
Strategic storytelling is a potent way to build organizational trust, highlight your process to encourage reporting, and deter similar misconduct.
Showcasing a culture of compliance and accountability also helps to retain and attract top talent. High performing employees want to work where they understand the processes that support an organization’s stated values and know those processes actually work.
Not only that, but customers and shareholders are watching. Unethical companies caught in scandals are paying the price via enforcement and diminished returns as they lose business. Regulators often also take a positive view of this sort of accountability.
There is, however, a natural tension between the ongoing movement to share more information about investigation outcomes with rank-and-file employees and the potential litigation risk of increased transparency, particularly when an investigation results in termination or other serious corrective action.
This is not an argument for pulling back from constructively sharing lessons learned. But it is worthwhile remembering that plaintiff counsel are yet another source of scrutiny that makes it essential you ensure the processes you are highlighting and celebrating are clear, concise, consistently followed, and can stand up to close examination.
Can we get a KPI? The potential pitfalls of measuring success
Public scandals and the persistence of compliance professionals resulted in increased attention to internal investigations from senior leaders and boards of directors. This led, understandably, to requests to define and address the risks presented by shifts in data garnered from investigations, and it’s now increasingly common to highlight certain investigation-related data as key performance indicators.
However, applying KPIs to internal investigations is particularly tricky. Not because it isn’t worthwhile, but because a KPI, as opposed to mere metrics, is a measurement from which the direction of success should be clear. Unfortunately, some of the investigation data that’s most tempting to convert into a KPI, presents a particularly high risk of misinterpretation and unintended consequences.
Take, for example, case closure time. Certainly, investigations should be completed as soon as reasonably possible and tracking case closure time is, no doubt, a potentially valuable metric. However, because a variety of factors impact case completion times (e.g., complexity of the subject matter, number, and availability of witnesses etc.) it may not be the best choice for a KPI. Moreover, pressure to close cases faster notwithstanding those variables may reduce investigation quality by discouraging investigators from following new leads or engaging in more complicated and time-consuming analysis in favor of marking the matter “closed” and potentially reducing the substantiation rate artificially and inappropriately.
Polling conducted during a recent NAVEX Regional Hotline webinar supports this concern. Nearly two-thirds of the 650 respondents indicated that a KPI goal to close cases in a certain number of days influenced investigation outcomes.
There are, however, other investigation data points that present a clearer consensus of what success looks like. For example, case launch time (time from receipt of a report to assignment and first investigative steps) clearly reflects staffing quality and efficiency. Another potential KPI is anonymous reporting rates, as a proportional drop or increase in choosing anonymity provides a reasonable measure of trust in the internal investigation process.
The value of show and tell
So, you have well-written reporting and investigation policies and procedures in place, and you have a robust program that actually works well in practice.
But how do you convey that strength to stakeholders? Are you ready to describe your program with clear language when an unexpected opportunity presents itself? What’s your “elevator pitch” to a board member, versus a program summary for a regulator, versus the synopsis you share with a small group of employees?
The reality is that most communication about compliance and ethics programs is reactive. Preparing the quarterly board update, tweaking training or, more stressful and potentially dangerous, responding to often broad-based government and regulatory inquires.
Consider putting together an investigation program presentation, something more Ted Talk than PowerPoint discussion that offers a summary of the who, what and why of your program. Then practice it, noting what’s most important to each of your most likely audiences and sprinkle in a little updated data and highlight your most recent wins.
2025 prediction
This additional attention is both a risk and an opportunity. Beyond the need to merely avoid a “paper program,” ethics and compliance teams need to creatively respond to a demanding environment, effectively measure their investigation programs – and be ready for scrutiny.
In an increasingly transparent world few things stay secret (at least not for very long), and more people are watching. Governmental pressure will persist, at the local, national, and international level (even if politics shift some priorities). These regulators, along with employees, customers, shareholders, and other stakeholders will scrutinize both allegations of wrongdoing and the process in place to respond and investigate.
We should continue to expect that the ability to demonstrate the quality and functionality of internal investigation programs will be as important as the outcomes of individual investigations.
2025 Top 10 Trends in Risk and Compliance
For deeper insights into the most pressing topics for risk and compliance leaders, download the full eBook and watch the companion webinar on demand.
