Organizations can’t just *believe* they have a strong speak-up culture. They need to know they do. By following these steps, you can quantify the strength of your internal lines of communication.

An effective speak-up culture provides organizations the best early warning system and sometimes, when all else fails, a final line of defense against isolated misconduct blossoming into catastrophic legal and reputation damage. Countless organizations believe they have a speak-up culture until they find themselves defending their compliance programs when unchecked misconduct comes to light. As negative headlines swirl, the board and C-suite often demand an explanation for why no one reported the issue and, if somebody did, why the suspected misconduct was not properly escalated and addressed.

Regulators, prosecutors and the court of public opinion will scrutinize the organization’s mechanisms for employees and third parties to raise concerns without fear of retaliation.[1] Organizations able to demonstrate they had an effective compliance program, including a sound speak-up culture, can avoid prosecution and receive substantially reduced penalties.

Speak-Up Culture Is a Business Imperative, Not Just a Compliance Requirement

Besides compliance, businesses with an effective speak-up culture are more prosperous than ones that discourage or, worse, intimidate employees and third parties. Organizations with a poor a speak-up culture risk employees airing the organization’s dirty laundry on social media, in the press and directly to the government agencies that pay handsome whistleblower awards.[2] In fiscal year 2020, the SEC paid approximately $175 million in awards to 39 individuals as part of their whistleblower program—greater than any other year in the program’s history.[3]

How Does Your Organization’s Speak-Up Culture Stack Up?

• Developing and maintaining an effective speak-up culture requires more than installing a hotline. Points to consider include how well the organization:

• Coordinates and resources its efforts to develop and maintain a speak-up culture;

• Uses metrics (see below) to assess the effectiveness of its speak-up initiatives and culture;

• Makes employees comfortable raising concerns about conduct and business risks without fear of negative consequences;

• Promotes reporting channels to employees and third parties (contractors, customers, vendors, etc.);

• Protects reporters from retaliation (e.g., by proactively monitoring performance reviews, salary increases and promotions);

• Acts and is perceived as responsive when concerns are raised or potential misconduct is identified;

• Trains managers to “listen up,” to foster a welcoming speak-up culture and to recognize and proactively guard against common forms of retaliation; and

• Recognizes employees who bring issues to the attention of management.

5 Speak-Up Metrics

Few companies develop and track metrics necessary to demonstrate their efforts to instill a speak-up culture and the success of those efforts. And many mistakenly believe employees and third parties will raise issues when, in fact, they will not.

Individuals may be reluctant to call a hotline and perceive that they must be fairly certain there is a problem to report. In most cases, a consultation line can help assuage these concerns and provide an outlet for those seeking clarity. The discussion of a concern via a consultation line can lead to an actionable response, such as looking into the underlying information, or can help the caller arrive at the shared conclusion that what might seem odd is, in fact, not an issue. Face it: Speaking up is difficult, even if organizations have policies against retaliation or employees are subject to discipline for not reporting misconduct. It is one thing for employees to say they would speak up— it is another to do so when the opportunity actually arises.

Organizations usually have existing data sources to gauge speak-up culture. Organizations can leverage these metrics to create a scorecard to measure progress, report to senior management and the board and, if misconduct arises, defend the effectiveness of the compliance program.

1.Investigation Outcomes. Investigation functions can track how many substantiated investigations resulted from employees speaking up, and they offer a real-world lens on whether employees and third parties report alleged misconduct, not what they believe they would do.

To leverage investigations, organizations should have procedures to consider the who, what, when, why and how of a speak-up culture. Who knew or should have known about the misconduct? Does the initial reporter know additional people who were aware? When and how did reporters raise concerns? What was the response? Should the reporter’s concerns have been escalated? Who

did not report their concerns? Why did those who reported do so, and why did those who did not report refrain? What lessons can be learned?

How can the organization leverage investigation outcomes to recognize speaking up or cure deficiencies?

2. Employee Surveys. Many large organizations use surveys to measure employee perceptions. Large organizations typically conduct enterprise wide employee surveys annually, which they supplement with smaller group “pulse surveys” on particular issues. Besides providing information, organizations can use surveys to evidence the effectiveness of their speak-up programs and determine whether their speak-up culture is improving over time. Surveys should inquire if employees and third parties:

• Are aware of and know how and when to use reporting channels;

• Have raised a concern and, if so, why;

• Have decided not to raise a concern and, if not, why not (e.g., fear of retaliation, lack of trust in reporting system); and

• Believe the organization responds effectively when concerns are raised.

3. Focus Groups. Just as investigators don’t investigate by survey, organizations must have live discussions to truly understand their internal culture. Focus group results can provide valuable input to the speak-up scorecard (see below).

Ironically, the pandemic has made focus groups easier to organize (e.g., no travel), and an experienced internal or third-party facilitator can use videoconferencing to engage, say, four to six participants at a time. Third-party facilitators can speak more freely. Having a live conversation also sends a strong message that the organization cares what employees think. Sample discussion topics on speak-up culture include:

• How does management encourage open discussions of problems and concerns?

• Are employees comfortable to express opinions without fear of negative consequences?

• Do employees trust management to handle concerns fairly and consistently?

4. Hotline and Other Reporting Mechanisms. Besides tracking traditional hotline and case management data (e.g., new reports, substantiated reports), organizations can leverage hotline and other reporting mechanisms to analyze employee level, geography, severity and percentage of anonymous reporting to understand the full picture. And expanding metrics to include reports raised through all various reporting channels (e.g., tracking concerns raised to HR or compliance) will paint a more accurate and complete picture of concerns raised within the organization.

Organizations that track reports from hotline, web and other sources (e.g., open-door conversations, email, mail, mobile and more) can enjoy significantly more reports than organizations only tracking hotline and web intake sources.[4] Organizations should also share trends uncovered through this reporting with the training or HR function so that emerging themes and issues

can be addressed as part of ongoing employee trainings. For example, if reports of discrimination increase year-over-year, annual code of conduct training may have a scenario focused on the organization’s commitment to a diverse and harassment-free workplace.

5. Employee Relations Data. While one employee may call the hotline to raise concerns regarding management, others may feel more comfortable discussing these issues with HR or employee relations (ER) functions. HR and ER should provide regular input to the scorecard on complaint metrics (e.g., number of formal complaints raised), as well as disciplinary metrics regarding the number of concerns raised resulting in employee discipline or termination. Like hotline metrics, this ER data can be analyzed to identify trends by employee level, geography, severity or type of misconduct. And the spectrum of ER matters is far broader and more numerous than reports to the hotline.

Exit interviews of employees leaving the organization can provide an additional touchpoint on perspectives of organizational culture, as departing employees may raise misconduct allegations. Consultation with counsel is essential before conducting exit interviews.

The Speak-Up Scorecard

Oversight of speak-up culture extends beyond the compliance function. For that reason, organizations should devise, collect and analyze metrics in an easy-to-read and easily shareable format, such as a “speak-up scorecard.” Business leaders are familiar with these kinds of key performance indicator (KPI) presentations from business line reporting. Seeing data in scorecard format from compliance will reiterate importance. Over time, important trends can emerge— particularly if data analytics experts present trending and analyses by region, seniority, type of conduct, seriousness, etc. A speak-up scorecard is also evidence of the organization’s commitment to a culture of integrity in both a business-as-usual environment and defense situation.

The speak-up scorecard shown above demonstrates how the five metric areas described earlier can come together into a clear, actionable tool. Ideally, scorecard metrics will be both quantitative and qualitative to help prioritize responses and next steps and to strengthen the overall risk mitigation strategy. But measurement alone is not sufficient.

Once the scorecard helps identify an area of concern—for example, a specific team with ongoing concerns about management—the organization must act. Meaningful speak-up metrics, at their core, enable the organization to change. Acting on concerns raised also shows employees that management takes their concerns seriously. Finally, action shows prosecutors and regulators the organization’s efforts are more than a “paper” compliance program.

Essential Next Steps

Effective speak-up is good for business and protects the organization. Key action steps include:

• Identify speak-up sources,

• Act when employees and third parties speak up,

• Regularly report suspicions or alleged misconduct,

• Develop and implement metrics and

• Create a scorecard to document and report progress.

This article originally appeared in Corporate Compliance Insights, April 2021. All rights reserved.