Finishing Touch of Ethics and Compliance Programs: Internal Investigations

• Fikret Sebilcioğlu          CFE, CPA, TRACE Anti-Bribery Specialist         
• Managing Partner
• E-mail to Fikret

Recently companies have been spending a significant amount of time and money on ethics and compliance programs in expectation of minimizing the impact of misconduct and fraud. As such a big effort is shown to make sure company employees act in accordance with set rules, it is naturally critically important what will be done in case of rule violations.

Looking back at the last two decades of the world of business, today we see that companies are under more surveillance than they were ever before. International laws and regulations (FCPA, UK Bribery Act, OECD Anti-Bribery Convention, etc.) increase the pressure day by day. We witness that the surveillance coming mainly from local or foreign governments as well as public or private organizations is focused on one point most of the time: Whether or not companies do their business in compliance with the business ethics principles as per the laws.

The load on the shoulders of company executives is aggravated day by day. On one hand investors and the market pressure them to make more money, on the other hand changing trends caused by amendments to local and international laws require them to do their business in a decent manner and in full compliance with the laws. In other words, it is becoming a sine qua non that company executives are more transparent and accountable.

And what is the final point of this accountability? Of course taking over responsibility when something goes wrong and doing the right thing. At this point, “internal investigations” come to the stage. Internal investigations might be the most effective action that can be taken by a company management in regards to accountability. Wherever and whoever is touched by the outcome of the internal investigation!

Where do internal investigations stand in “Ethics and Compliance Programs”?

Imagine that in a soccer game, the player takes the ball from his own post to the front of the opponent’s post passing by all the opponent players and throw the ball out of bounds at the finishing touch. In a company where a very good ethics and compliance program is designed, implemented and monitored properly, if an allegation is not effectively investigated or a sufficient response is not given to the outcomes of the investigation by the company management, the ethics and compliance program will be like that soccer player who cannot goal. The “finishing touch” of a player in soccer is like “successful internal investigation” in ethics and compliance programs.

In short, internal investigations are a critical process of ethics and compliance programs.   

Why are internal investigations conducted?

Under normal conditions organizations do their business (companies, NGOs, public institutions, etc.) in line with the targets assigned to them. As long as things go well, they generally face no problems. However sometimes, an important ethics and compliance problem might occur that will hinder the success of an organization.

Some examples for frequently encountered ethics and compliance problems include the following:

• Corruption (conflicts of interest, bribery, bid rigging, illegal gratuities, economic extortion)
• Financial statement fraud (fictitious revenues, concealed liabilities and expenses, improper asset valuation, improper disclosures etc.)
• Asset misappropriation (billing scheme, theft of cash, payroll scheme, improper expense reimbursement, misuse and larceny of inventory and other assets etc.)
• Unauthorized access to company’s confidential data, manipulation of data, taking data out of the company
• Threat, sexual harassment or other inappropriate behavior
• Other acts violating the laws and company policies and procedures

Many big companies have been observed not to take action in the event of such problems and to leave them to time and then, these problems go out of their hand. On the other hand, improper termination from employment due to such problems may bring a high cost to companies in the court on the grounds of unfair treatment to the employee.

Corporate companies should take action in the early stage for ethics and compliance issues due to such and similar other reasons. Inability to take adequate action by the company management for a concrete violation or allegation may damage the reputation of company values as well as lead to compensation of losses, the neglect of the company senior management and the board of directors (executives), and even allegations or conspiracies over secret or illegal cooperation between executives and fraudsters. The company executives may incur the risk of becoming a party to lawsuits because of such mistakes, and what is worse they may face a criminal charge due to inability to take necessary actions in the event of misconduct or fraud.

Should or should not conduct an investigation?

Should every tip or allegation trigger an internal investigation? Under what circumstances should a company decide to conduct an internal investigation? 

If a reasonable, professionally trained and prudent individual believes based on all the existing evidence that an act that violates the ethics and compliance program has occurred, is occurring or will occur in the company, there is an adequate ground to initiate an internal investigation. At this point, the most important advice to give to companies is not to initiate an investigation, unless there is a sufficient justification for an internal investigation.

An allegation received through a reporting hotline may make the company management think that a fraud on the respective issue has occurred. However, before accusing someone, it will be appropriate to conduct a preliminary check (data analysis or background check, etc.) regarding whether or not the allegation is true and to assess if there is sufficient justification for a potential internal investigation. This preliminary check should be performed meticulously in case personal rights of the employees involved are harmed.

It is critically important to protect personal rights during an internal investigation. Therefore, an internal investigation should not be initiated, unless there is sufficient and reasonable justification.

What kind of an internal investigation?

Once it is decided to conduct an investigation, the process starts. It is critically important to hold the investigation in a methodological and well-structured manner. Corporate values and reputation of companies can be preserved only if investigations are conducted in a precise and correct way.

The subjects within the scope of an internal investigation are generally non-routine, which naturally complicates the process. Investigations might be costly and time-consuming processes that may cause damage within the company or might cause unexpected complications, legal problems and even employee dissatisfaction, if they are not managed confidentially and meticulously.

Running the internal investigation process may show different peculiarities based on the allegation of misconduct causing the investigation and the parties involved. Regardless of the reason for conducting the investigation and the different peculiarities involved, the efficiency and reliability of an investigation depends on the timely, accurate, fair, objective and meticulous performance of that investigation.

The main purpose of internal investigations is to prove if misconduct or fraud occurred. However, a good investigation should not damage the relationship with the innocent employee or should not unnecessarily harm the reputation of any employee. Looking at internal investigations through this wide framework requires good planning, consistency, analytic approach, sensitivity and lawful practice of all the stages of the process.

Internal investigations generally involve gathering and reviewing written and recorded evidence, questioning suspect employees and witnesses, and going through computers and computer networks. The process also may require talking to company executives, human resources experts and legal advisers. Actions to take with the persons to take a role in the process are determined only to the extent that they are deemed necessary based on the special circumstance at hand.  

Who should constitute the internal investigation team?

Considering the content of the allegation subject to internal investigation and the parties involved, the investigation team may include the following experts:  

• The company’s internal legal adviser and external lawyer
• Human resources specialist
• Information technology and information security specialists
• Forensic accountant
• IT security personnel
• Internal auditor
• Specialists that may be assigned in special subjects

Good investigation makes the company win, a bad investigation is costly

The process of internal investigation is a boring and unpleasant process that is not frequently encountered by company employees. And can this process be limited to the question “is there a violation or not?” at the end of the investigation? Of course not. Within the scope of a successful internal investigation, the company management asks a lot of questions and possibly encounters many weak areas and areas that need improvement from which the company can take lessons.

A well-managed investigation protects the assets of the company as well as helps to improve the company’s policies and procedures. For example; the money stolen may be traced, the responsible people may be found out and losses may be indemnified as a result of a well-run investigation; or a more efficient counter claim can be developed against the lawsuit opened by a discharged employee; and internal controls can be improved so that similar misconduct or fraud will occur again. The best part of a well-managed internal investigation might be giving the message across the company that non-compliance to the laws and company policies and procedures will not be tolerated and such non-compliance will be punished. Successful internal investigations increase the employee’s trust in and satisfaction with the company, while contrary situations harm that trust.

Last words

The internal investigation is an unpleasant and tough process which involves a number of delicate balances. However, the matters explained above and many other factors that were not mentioned due to the scope of this article could be understood, internal investigations can be conducted and managed in a rapid, detailed and lawful manner. Here the keywords are “planning and preparation”. That the company has policies and procedures in place regarding internal investigations might minimize the crises in a potential investigation and help to facilitate the process.