Making Your Whistleblowing Program in China / Asia Successful

Introduction

Some of the largest frauds the world has seen have been detected by whistleblower tip-offs. Bolstered by this, governments and regulatory bodies are increasingly making it mandatory for companies to provision for whistleblower helplines to help employees voice their concerns on potential fraud and misconduct. Recent surveys demonstrate that companies that have a formal whistleblowing channel are more likely to detect frauds than those that do not have one.

Despite global recognition for whistleblower hotlines, our experience shows that Asia has had less success in harnessing this channel to detect frauds. One of the major reasons for this lies in the approach that companies take when they set out to implement such a hotline. When an initiative is commenced with an aim to ‘tick in the box’, it is unlikely to succeed. That is what seems to be happening with many Asia based companies trying to implement a whistleblowing program.

For such programs to succeed, it is important to realize that a hotline is not merely another source, but perhaps the only source that can detect fraud at an early stage. Accordingly, companies need to build an employee/stakeholder-friendly whistleblowing program that restores good faith and makes employees feel empowered about their decision to blow the whistle. Most importantly, confidence can only come when employees see a commitment from the senior management to the program and know first-hand what actions have been taken from previous reports. Only when one leads, can others follow.
Globally, regulators have recognized this and have published whistle blower complaints statistics, to encourage more people to come forward with such tips. The US Department of Justice reported over 4,400 whistleblower tips between 2016 and 2017 , while UK’s Serious Fraud Office’s whistleblower hotline has been averaging more than 500 calls a month.

As whistleblowing has become central to fraud detection and with increased regulatory emphasis on the need for having such a mechanism, we wanted to share Asia based sentiments on the need, structure and implementation the whistleblowing mechanism.
We hope you find our survey results useful and relevant to your efforts in curbing fraud.

Keeping the eyes and ears open

Companies understand that employees are their eyes and ears – i.e. they see and hear everything that goes on within, including inappropriate behaviour and who is involved in perpetrating it. According to the Association of Certified Fraud Examiners’ 2016 Report to the Nations on Occupational Fraud and Abuse, frauds are 47.3% more likely to be detected by ‘tips’ (received from employees and third parties) than by any other method. Additionally, companies with some form of a hotline in place experienced frauds that were 41 percent less costly and detected frauds 50 percent more quickly. While 90 percent of our respondents agreed that establishing a whistleblower hotline could help reduce fraud, only 68 percent said they were actually equipped with such a hotline or policy.

It is important to understand that providing individuals with a means to report suspicious activity is a critical part of an anti-fraud program. Fraud reporting mechanisms, such as a hotline in this case, should be set up to receive tips from both internal as well as external sources, while allowing anonymity and confidentiality. Around 84 percent of the respondents to the survey felt it was essential to extend a company’s whistleblowing hotline to the associated third parties such as vendors and business partners.

Whistleblowing in the wind?

In our experience, while companies have a whistleblowing policy, they are still unable to utilize it effectively to detect frauds. The primary reason is poor response from employees. The survey respondents indicated a number of reasons, as depicted in the graph, for employees to feel under confident using their companies’ whistleblower hotline.

These responses point to a more fundamental concern within organizations – the seriousness with which the company approaches fraud detection and management.

For most companies today, whistleblowing is perceived as ‘yet another measure to implement’ as part of the larger fraud risk management efforts and hence, it can be relegated to a tick-the-box exercise. Organisations must understand that whistleblowing is, perhaps, the only tool that comes close to pointing out a fraud in its nascent stages. It is, therefore, important to build, monitor and nurture this channel continuously. Data from the whistleblower hotline needs to be continuously monitored and integrated into the larger fraud risk management systems so that even small irregularities can be detected early. Around 83 percent of our survey respondents agreed that proactive trend analysis based on the data generated through whistleblower hotlines was useful to their organizations.

Through our engagements, we have seen that a majority of Asian companies usually invest little time and resources on building robust whistleblowing systems or training employees on the existence and use of such a system. Often, hotlines are either not functional or available through multiple access points. What is worse, hotlines often fail to promise confidentiality to users and in several instances, there are no dedicated teams to run these hotlines. Often, the person managing the hotline has either a full time administrative or human resources responsibility. 

Regulation on Labour Security Supervision and Criminal Procedure Law of the PRC. Further, in 2016 China's supreme investigative body and two other ministries have promulgated further whistle-blower protections and incentives (more on this later).

Other than China, Asia has a ways to go. For example in India, the relevant law does not allow anonymous complaints. Contrast this to the level of protection in countries like the US, where the Sarbanes Oxley Act (section 301) mandates companies trading on the US Stock Exchange to provide a mechanism to employees to remain anonymous when reporting concerns about accounting or audit irregularities.

Under these circumstances, the extent to which a whistleblower can rely on the company to protect
him depends on the ‘tone at the top’. The senior management’s commitment is essential for the success of a whistleblower hotline, and therefore, they need to frequently communicate about the hotline to employees.

One of the ways that companies can ensure effective management of a whistleblower hotline is outsourcing its implementation and management to a third party with the relevant experience and capability. Around 43 percent of respondents felt that a helpline run by an independent service provider reporting to the Audit Committee would be the most effective model of whistleblowing hotlines.

Through outsourced whistleblower hotline management, companies can assure their employees
that the initial communication is handled independently to ensure that all allegations are recorded ‘as is’ and passed to the appropriate person. What occurs subsequently depends on the nature of the allegation and the company as well. Although internally operated hotlines can also work well, they might be disadvantaged by the fact that all allegations are initially received by employees of the organization where the subject of the whistle-blower's allegation is also one of the employees and may be subject to bias.

Managing whistle blower complaints effectively

Deloitte Legal 勤理 point of view

Every whistleblower complaint comprises of three aspects - the whistleblower, the complaint and the suspect. Companies can expect success with their whistleblower mechanism only when they have processes that deal with all three aspects with maturity and sensitivity. Unfortunately, often little is done to sensitize employees and other stakeholders on such aspects. Below is some advice on how such complaints can be better managed.

Ongoing support to the whistleblower is important to ensure that he/she is comfortable with the proceedings and is not suffering from any adverse treatment as a result of his/her actions. This fear of retaliation seems to be the major reason that whistle-blowers initially wish to remain anonymous. Policies should ensure that any ‘detrimental’ action taken against the whistleblower as a result of their allegation should be treated as a serious matter and appropriate action ensured. Processes should
also be put in place to deal with the person(s) against whom the whistleblowing allegation is made.

A clear and well documented process for managing complaints can give greater confidence to employees to report suspicions. For instance, the processes required to establish allegations involving junior or middle ranking staff tend to be fairly straightforward across most companies. Either internal or external investigators are appointed to review the matter and report on the
allegations that are raised. Usually, an appropriate senior manager will then deal with the matter after advice from legal and HR teams.

If the allegation is against a senior manager, the situation can become a little complicated. Companies without a robust policy for dealing with such a scenario, mostly, run the risk of such investigations becoming compromised by senior management involvement or of such allegations being ignored. Employees need to be made aware of these detailed processes around how their complaints will be handled, so that they can gain trust in the system.

During the investigation process, it is important to ensure that the suspect is not victimized. In fact, it is best to not let the suspect or anyone else know about the complaint. Upon investigation, unless evidence is found supporting the whistleblower complaint, the suspect is better off not knowing about his/her involvement. Upon gathering evidence, most companies discuss the findings with the suspect and basis the reaction, before determining the next steps. In extremely critical cases, the suspect’s access to the company’s systems is cut-off until after the investigation in order to help preserve evidence.

Not opening wide enough

“Open wide,” says the dentist. The wider you open your mouth, the easier it is for your dentist to see what is going on, identify potential problems early, and take action to keep your teeth in good shape. Whistleblower systems work in a similar way. When access is restricted, it is harder for people to report potential wrongdoing. Issues can fester until they create such pain that action has to be taken.

Whistle-blower system access can, sometimes, be restricted consciously by executives who may be fearful of having to respond to more allegations if they “open wide.” More often, access is restricted unconsciously through use of a design that inadvertently doesn’t reflect some of the lessons learned in recent years about whistle-blower systems.

Whistle-blowing can involve several forms of communication, such as the use of a special telephone
hotline, e-mail, web form, regular mail, fax or at times simply speaking up to a supervisor/ manager, human resources specialist, or a trusted person. Amongst our survey respondents, while the majority
(38 percent) preferred a service that offered varied platforms; the next best option chosen by 28 percent of our respondents was to opt for an e-mail based service.

This is in line with the global trend of hotlines becoming Internet and e-mail-based. While this makes it easier to report concerns, it removes the ability of the hotline operator to gather potentially critical additional information at the beginning. Besides these, there also are other access related barriers to whistleblowing. These include:

Service hours:
Many early whistleblower systems consisted of a phone number that employees could call during business hours. It may have gone to a compliance officer or an internal auditor at the head office. However, in our experience, majority of calls received are outside business hours. Whistle-blowers may be reluctant to make hotline calls from the workplace where they could easily be overheard, have their name show up on caller ID, and tracked in telephone call logs. Thus, enabling access to a 24/7 helpline can help to increase calls.

Language:
Whistleblower reports are sensitive and tricky things to communicate, so not being able to use one’s preferred language can deter whistleblowing or adversely impact a report’s completeness and accuracy. For many companies today, the ability to take reports in many different languages is becoming a necessity.

Constituencies:
While many companies have focused on providing a whistle-blower reporting system just for employees, it is important to note, a significant number of tips also come from external sources such as customers, vendors, shareholders, competitors, etc. Encouraging these other stakeholders to use your system could thus generate better tips.

Methods:
Phone calls handled by trained professionals make it easy to seek clarifications from whistle-blowers and help understand the issue better. However, not all whistle-blowers are comfortable with that system. Preferred methods vary by country and culture. Hence, offering multiple methods of reporting can help to generate more tips than just a hotline or e-mail system on its own.

Addressing concerns

The word “whistleblower” tends to have a negative connotation for most people and may evoke the
feeling that the action of making a report to the system is an extreme act akin to hosting anti-establishment sentiments. Calling such a reporting system a “whistleblower hotline” may also spark fears about retribution against the potential source. Some companies have, therefore, chosen names that focus on positive outcomes of fraud prevention, such as “Integrity Hotline” or “Ethics Helpline”. These alternative names emphasize the desirable behaviour demonstrated by the employee when they make use of the system, since most people would like to be regarded as a person of high integrity or ethics.

Some other characteristics that can encourage whistle-blowers to use a hotline include providing anonymity and confidentiality, communicating the independence and transparency in the process, and offering protection to the whistleblower. It is crucial to remember that all the factors discussed above are equally important. Most of our respondents have not realized this aspect and education in this area is, therefore, of vital importance.

Building a supportive environment for whistle-blowers

Given how valuable whistleblowing can be in deterring and detecting wrongdoing, it would be prudent for an organization to create a supportive environment for whistle-blowers. Measures that a company can take to do this include:
• Developing meaningful rewards for whistleblowing
• Implementing a detailed non-retaliation policy protecting whistle-blowers who make reports in good faith (and perhaps dissuading frivolous allegations)
• Communicating this policy in the employee code of ethics, orientation and periodic refresher training, hotline posters, employee newsletters, ethics and compliance communications, and periodic speeches from senior management
• Designating a central function or person, such as the corporate compliance and ethics officer, to monitor the career progression, compensation, and any proposed disciplinary actions against whistle-blowers for a period of time (such as three years) after a whistleblower report is made. This person can also be designated to receive and to investigate any complaints of retribution
• Implementing a records retention policy for whistleblower reports, complaints and investigations
• Training senior management about the whistleblower policies, especially non-retaliation. Additionally, senior leaders can also test the whistleblower hotline and share their experiences with employees, assuring them of equal treatment of complaints
• Ongoing education/ workshops, from inclusion in a mandatory annual compliance training session to constantly displaying a poster in the company break room, is essential for getting employees to accept and embrace the idea of self-regulation using a hotline. Around 76 percent of our respondents recognized this idea.

Communicate, communicate and then communicate some more

A successful whistleblower system requires effective communication to create and maintain awareness of the hotline’s existence, build employees’ willingness to use it, as well as, develop the employees’ ability to identify potential wrongdoing.

We advocate a three-step process that companies can implement to build momentum for their whistleblower hotlines.
Companies need to focus their communication on assuring employees that their tips will remain confidential. To demonstrate this, they may publish internal suitably anonymous examples of where a whistleblower system report led to an investigation and appropriate disciplinary action against those found to have violated the companies’ policies. This helps to build the necessary trust for the system. Once employees are confident about reporting any concerns, they should be educated about red flags, risks and schemes related to unethical or illegal behaviour including topics such as conflicts of interest, bribery, kickbacks, embezzlement, financial statement manipulation and fraudulent regulatory reporting.

This type of awareness can be part of a fraud risk management or ethics and compliance awareness program. It is important to explain that every employee has a role in preventing and detecting fraud and that the hotline system is a key tool for people to use for that purpose. Armed with this knowledge, employees will be in a better position to act if they experience/ witness a suspicious behaviour.

Supporting this, 94 percent of our survey respondents agreed that a proper response and feedback mechanism for cases reported using a whistleblowing hotline is a good practice to follow. Once employees realize that action is indeed being taken on tips, they are encouraged to use the hotline. A passive approach on closing employee complaints can result in loss of confidence in the entire mechanism.

Conclusion: Supportive legislation alone is an insufficient motivator

Regulators and governments across the world are increasingly introducing laws that require organizations to have mechanisms in place enabling employees to report suspicious behaviour within the workplace and offer protection to whistle-blowers.

For example, in 2016 China's Supreme People’s Procuratorate (“SPP”), Ministry of Public Security and Ministry of Finance released Several Provisions on Protecting and Rewarding Whistle-blowers for Reporting Duty Crimes (“New Regulations”) offering greater protection and incentives to the whistleblower. This is likely to encourage more whistleblower reports and further strengthen the government’s efforts to crackdown on corruption involving government officials.

Although the New Regulations target Chinese officials, multinational companies (“MNCs”) doing business in China need to be vigilant given the current enforcement climate. MNCs can still be implicated in whistleblower complaints alleging that the MNC is involved in a bribery scheme. This may attract an investigation by Chinese authorities and/or the attention of foreign enforcement bodies such as the US Department of Justice, SEC or the UK’s Serious Fraud Office.

In the same vein, the US Dodd-Frank Act is continuing to gain momentum with it's regulatory enforcement and whistle-blowing incentives to fight fraud globally. It should be noted that employees of Asian firms with US presence or business are also allowed to blow the whistle under Dodd-Frank.

The above is a timely reminder for businesses to assess and improve their internal policies and compliance efforts. An effective compliance program and a sound compliance culture are key to preventing corporate officers, employees, and third-party agents from engaging in illegal practices such as bribery, collusion and fraud. For a compliance program to function and be successfully implemented, employees must feel empowered to ask questions and report problems with confidence that the company will investigate their complaints and take decisive action where required. We recommend the following steps:

• Establish comprehensive and effective whistleblower and non-retaliation policies and ensure they are well understood by PRC employees and third parties engaged by the business.
• Conduct thorough, credible and where possible, independent investigations of significant whistleblower complaints and remediate business practices as necessary.
• Devise and implement protocols for swiftly and comprehensively responding to PRC regulatory investigations or dawn raids.
• Seek legal advice on employment policies and before taking disciplinary or termination action resulting from whistleblower allegations to ensure that you do not violate China’s laws and regulations or expose yourself to employee litigation.

The recent regulations are a strong signal that whistleblowing is continuing to play an important role in the Chinese government’s anti-corruption campaign against government officials. Organizations doing business in China need to ensure that they are in a position to respond to and manage internal complaints swiftly and in a credible manner. In addition to compliance with Chinese laws, it is also imperative that compliance programs are aligned with standards laid down by global regimes (such as the US Foreign Corrupt Practices Act and the UK Bribery Act) as Chinese whistle-blowers have been known to report complaints outside the company if they feel aggrieved or believe that potential rewards are greater.