Episode Transcript
[00:00:00] Speaker A: Hi everyone. You've got questions and we've got answers. Welcome to another Bella Asks episode of the Ethicast.
At Ethisphere. We believe there is no competition in compliance. That's why we're using this show as a platform to answer high level questions about business integrity that that have been posed to us by the members of the Business Ethics Leadership alliance, or Bela. Bella is a global ethics and compliance community that provides exclusive access to helpful data, benchmarking events and other resources to advance your ENC program. It also provides a concierge service by which members can submit questions around best practices and our internal experts will provide an answer plus helpful resources with more information.
Now, many of these questions are particular to a specific company's needs, but but many more of them speak to challenges and opportunities that face ENC professionals everywhere. So in this episode we're going to answer one such question as part of our ongoing mission to make the world a better place by advancing business integrity.
And joining us once again to answer these questions is Bella chair Erica Salmon Byrne. Erica, as always, thank you for returning to the program.
[00:01:16] Speaker B: Oh, Bill, thank you so much for having me back. I feel like every time I think that the, it's not even a trilogy at this point because it's so many more episodes than that. The box set, every time I think the box set of our investigation answers is finished and we, you know, can like do the shrink wrap. Somebody comes along with a question we haven't answered yet. And that's exactly what today's question is.
[00:01:36] Speaker A: I'm excited about it 100%. It's like that, that series of books on your shelf where they all have the same cover and then like one more volume comes out, like I get them all over again.
And, and we're kind of like that with this question. It's a great investigations question and it reads how soon should we notify an external auditor about a misconduct allegation?
[00:01:55] Speaker B: Yep. And so, Bill, this one goes with the question that you and I did on when do I notify the board about misconduct involving a senior executive? And my answer to this question is going to follow along very similar lines to the answer to that question, which was basically, you want to consider this well before you have to. So what we usually see from an external auditor's perspective in terms of notifying is it's going to depend on whether or not you are a publicly traded company where you are filing audited financials with the SEC or your relevant listing body.
If the allegation potentially implicates in a material way, your audited financials. If that's the case, you better get on the phone staff, right? So make sure that your external auditors are in the loop in terms of what the issue is that you might be finding. And you really want to make sure that you have laid this out in great detail in your investigations process and your concern raising protocols before you find yourself in this situation. Because having seen it happen many, many, many times, it is very easy to find ways to talk yourself out of making a hard phone call.
Much like with the question of when do you raise misconduct involving an executive to higher levels, you want to be able to take shelter in a process that everyone has agreed upon before they understood it might be applied to them. Right? It's the old kind of utopian principle. What is the system that we would set up if we were setting up a system, not knowing what our role in that system would be? So that's the question you want to ask yourself.
What are, you know, what is the external what, what are the kinds of things that our external auditors are going to have a legitimate professional interest in understanding?
Knowing full well that if you, you know, sometimes if you raise things to your external auditors before you have all the facts, you've created a very large challenge for yourself if the initial issue that you raised upon further investigation turns out to be not as bad as it looks. So the real thing to do here is always going to be lay out in your process.
These are the criteria we will follow for deciding who we're going to escalate a concern to, at what point in the process and how.
So if it's a, over a certain dollar value, very common threshold, if it involves a certain business unit, right, that is where the financials have been audited and it's got a financial component to it, much like you would, Bill, if you were thinking about your data breach notification process, right, There are going to be thresholds you're going to have to care about. You're going to have thresholds you're going to care about for your external auditors. Now that's of course assuming that you're a publicly traded company, you've been publicly disclosing your financials. If you're not a publicly traded company, you're family owned, you're PE backed, you're privately held in whatever capacity, and you have an external auditor relationship.
First off, kudos to you because many don't. But if you have an external auditor relationship, then the thing you should be asking yourself as you craft that escalation protocol is where are the places that notifying and bringing in my external auditor could potentially be helpful to me as an organization or helpful to me as an investigation of it as an investigations team. And this applies to honestly, if we're thinking about public companies, but this is particularly important if you don't have a public company reason to bring your external auditors in.
Sometimes it is easier for people from the outside to look into an issue depending upon the facts and circumstances. So again, you're going to want to think about what would that escalation process and protocol look like. Is it going to be a dollar value question? Is it going to be a seniority of the people involved question? Is it going to be a nature of the allegations made question, or is it going to be a skill set question? Are there going to be things that I as the company simply don't have the internal skills needed to really look into the, in the way in which it needs to be looked into?
If you think, for example, you might have to bring in law enforcement, you probably want to bring your external auditors in first. If, example, you think that you might have to bring the, you know, the details of this situation to the attention of a creditor or to the attention of your bank or you know, your loan officer, you probably want to bring somebody in from the outside just to make sure that you've got all of your pieces lined up and you have someone that you can rely on for advice on how to proceed. So just a couple thoughts on kind of what the, the factors that might go into that would look like on.
[00:06:36] Speaker A: Top of all the excellent advice you just gave about how you create procedures around this? Do you have any words of wisdom for anybody out there who it may be their first year in compliance or they may be running a very, very young program for when you have these things in place. But you know, some, some advice on your executing it for the first time. Anything to keep in mind like when you're actually putting this into practice for that very first time and you don't have the benefit of, of, of past history to, to guide your way.
[00:07:02] Speaker B: Yep.
So I'm looking over to the side here, Bill, to my other screen, because I actually I, I had a conversation about this with one of our colleagues here at, at this FE who had also been in that position of kind of putting one of these investigation documents into, into practice for the first time. And he had some wonderful advice that I'm going to share with, with our audience because it was to role play as you are getting to the final stages of being of feeling like you're done with this protocol.
Run it through various scenarios. Right? So, okay, this person has done this thing, what do we do? We're good with that. Great. This person has done this thing, what do we do? We're good with it. Great. And then ask yourself, you're in charge of the hotline. Someone calls in anonymously and the fact pattern is similar to Enron. Now, for a lot of people listening into you and I, Enron is far enough in the distant recesses of memory that that one might not resonate. But, you know, the fact pattern is similar to fill in the blank, you know, scandal of the day.
The senior. Most people at the company are involved.
Is there enough in here that you can follow it confidently? Because that is the sticking point that you have to make sure you are your, your process and your, your protocol is prepared for. Is the situation where somebody at a senior level, the general counsel, the CEO, the cfo, whomever it might be, is involved in the misconduct. And you have to figure out what to do as the person who has been handed this particular hot potato, you know, what is going like to, to continue to abuse the hot potato metaphor. Bill, are your oven gloves strong enough that you can carry this particular hot potato through all of the things you're going to have to carry it through, or are there places or pieces in this protocol that you, that you need scaffolding that you don't yet have? And if so, do it now, right? Do it in the abstract, do it in the hypothetical.
Have those, you know, do the role play, have those conversations so that at the, at the point in time where you need to go, you need to rely on this process to protect you and your livelihood and your job and your sleep.
You've got the tools you need.
[00:09:21] Speaker A: Well, Erica, we have expanded the investigations box set by yet one more volume. So thank you so very much for your time and for your insights on this.
[00:09:28] Speaker B: Absolutely, Bill, my pleasure. And I do have to tell you, I'm going to stop assuming that there are not future volumes to come on this one because it is a, it is a topic that we continue to talk about. And look, we can get better and better at it.
[00:09:41] Speaker A: To learn more about Bella, Visit@the sphere.com Bella to request guest access to the member resource hub and to speak with the Bella Engagement Director. If you have a question that you would like answered on this program, contact the Bella Concierge service and we'll get to work on it for you right away.
This has been another Bella Asks episode of the Ethicast. Thanks for joining us. We hope you've enjoyed the show. If you haven't already, please like and subscribe on YouTube, Apple Podcasts and Spotify. And be sure to tell a colleague about us as well. Every like comment and share really helps this program.
That's all for now, but until next time, remember, strong ethics is good business.
[00:10:24] Speaker B: It.
