The whitepaper discusses how misconduct often goes undetected at organizations until it is too late. While employees report issues to local managers, the information does not get escalated or documented properly. This allows small isolated incidents to accumulate without the organization's awareness. The whitepaper argues that organizations already have the necessary data in employee reports but lack centralized systems to analyze trends across different locations. An integrated case management system is proposed to document incidents in a consistent way and allow information sharing between departments to detect broader patterns of misconduct before major issues emerge.

1. Whitepaper
Human Resources
Whitepaper
Misconduct Rarely Happens in Isolation:
How you can detect critical trends

2. Executive Summary
The data most organizations need in order to have visibility into potential code of conduct violations
is already available to them. Yet companies are often unaware of these issues until they become multi-mil-
lion-dollar lawsuits. Our observations of the marketplace, validated by various ethics research studies, show
that a major cause of these situations is managers typically do not recognize or correctly escalate issues
communicated to them by employees. When the information-gathering process stops at local levels within
a company, the potential for true insight is missed.
With the added pressure of a downturned economy, organizations are now facing a tough cultural
environment that creates more incentives for employees to engage in negative behaviors such as theft,
fraud, workplace bullying, discrimination, harassment, and other misconduct. The good news is that employ-
ees will continue to comply with the code of conduct guidelines and report the issues they notice. However,
the sheer volume of reports, compounded by the reality that ethics budgets have been reduced, creates an
impetus for businesses to automate processes and become proactive in order to efficiently and effectively
manage incidents of misconduct.
To address this challenge and stay on top of internal data that already exists, organizations need a
consistent way to collect, investigate, document, resolve and analyze misconduct information from a wide
variety of sources – whistleblower hotlines, internal managers, HR, compliance officers, etc. Without a pow-
erful, centralized system, companies are unable to understand trends in code of conduct breaches and take
a more proactive approach in protecting their reputation.
Maintaining an ethical culture during an economic downturn
Numerous studies have shown that misconduct increases during economic downturns, and the current reces-
sion appears to be no different. Governance, Risk and Compliance experts recognize the trend as the result of
growing pressure in employees’ professional and personal lives resulting from financial and job uncertainty.
At the same time, financial struggles are causing many companies to actually spend less to combat the surge
in misconduct. Instead, organizations are making every possible effort to cut costs and preserve their bud-
gets, meaning there are fewer people and resources to combat the increase in misconduct.
Organizations typically prefer to focus their efforts on detecting and avoiding the big issues – serious prob-
lems that could lead to devastating public scandals and negatively impact corporate reputation. However,
misconduct manifests itself in the workplace along a broad spectrum of severity, and while the big risks are
cause for concern, the more routine problems that might seem minor in isolation can have just as serious an
impact on your organization. Having a multitude of smaller, more isolated incidents can sometimes be as
detrimental as a large and highly public incident. It is all too often the accumulation of many small issues –
the kind of issues that become much more frequent in an economic downturn – that expose your company to
problems like large class action lawsuits or increased exposure to fraud.
As an example, consider one family-owned, private retail company as an illustration of the way a serious issue
page 2 / 5

3. Maintaining an ethical culture during an economic downturn (cont.)
can avoid detection until it is too late. This company was hit by a major class action discrimination lawsuit
several years ago. The problem originated as a byproduct of a positive company culture based on loyalty,
which was a deciding factor in promotions with the organization. One unintended and unfortunate result
was that women were not being promoted above a certain level of management, because in most cases they
lacked the tenure of their male counterparts. Far from being quiet, female employees actively brought their
complaints forward with local managers, who investigated the claims. But complaints about discrimination
are not uncommon, and the managers and local Human Resource representatives only saw the claims as
isolated incidents. These managers lacked the ability to recognize each case as part of a trend. And since
there was no visibility into events happening throughout the company at disparate store locations from a
macro-level, the organization only gained awareness of the larger pattern once the lawsuit was filed.
This example is playing out in a number of themes across our economy, especially amid the distractions,
layoffs and the general corporate disarray that many organizations are currently going through. The task of
tracking this kind of issue becomes much trickier in such a serious recession, but on the bright side, the infor-
mation you need exists. To understand the issues, you just need a way to gather the data.
You already have the information
The good news is that, while misconduct is on the rise (ACFE, The Ethics Resource Center), employees are
increasingly willing to bring the issues to your company’s attention. As the people closest to the problems,
employees are often the first to notice when something goes wrong. According to KPMG’s Integrity Survey
2008-2009, 74 percent of U.S. employees have “personally seen” or have “firsthand knowledge of” specific
categories of misconduct over the past 12 months.
When work incidents occur, employees act in compliance to the code of conduct: they discuss their concerns
with a manager or supervisor. This approach works very well and statistics confirm that issues are consid-
erably more likely to surface through informal conversations than through more formal methods such as a
whistleblower hotline. After the report is filed, however, the process often starts to break down in the routing
and follow-up stages.
In a 2009 study, Bottlenecks in Ethics Reporting, the Ethics Resource Center asked executives to explain
why risk issues sometimes go undetected. More than half of respondents said the biggest issue was that the
organizational structure “does not facilitate the flow of information.” Another 43 percent said the problem
was that managers do not recognize or escalate the issues they hear about from employees. In effect, the two
most significant problems are the same: the information you need is there, but it never reaches you.
page 3 / 5

4. You already have the information (cont.)
When code of conduct violations are reported, they are most often managed at the local level. The managers
to whom the violations are reported have three potential choices in how they respond: either resolve the issue
personally, escalate it to the next level of authority, or just ignore it.
Breaking these scenarios down helps expose where the risks lie. Think about your own organization and what
happens when an employee reports an issue to a manager or HR representative: If the issue is resolved, do
you know if each outcome is documented correctly, and the best resolution was determined? If the issue is
escalated, does it automatically get routed to the right department or appropriate person? And if it is routed,
are other appropriate personnel notified – for instance, if a threat of physical violence is made, are both cor-
porate security and human resources aware? Perhaps most importantly, are you certain that the decision
was correct and consistent, and no applicable law was violated? This is an especially critical issue when the
reporter falls within a protected class. If the manager chooses to ignore the complaint, do you have other
mechanisms, such as a confidential and anonymous hotline, where the employee can raise the issue?
Clearly, trying to track and manage the myriad risks your organization faces is challenging. While it would be
ideal to gather as much information as possible, it is not reasonable to ask your managers to document every
single conversation. But organizations that use outdated e-mail and spreadsheet systems to track employee
reports run the risk that valuable information will be buried. Even companies with more advanced solutions
for tracking and managing issues are ineffective at understanding trends if the systems are not shared across
departments. The best way to identify risks before it is too late is a simple, intuitive, collaborative way to
share pertinent information across the entire enterprise.
Integrated case management
Business leaders who want to understand the risks facing their companies need to establish a structured
workflow to direct the information documented in direct, informal conversations from the local level to a
centralized place where it can be analyzed. Obviously this process should not interfere with local managers’
ability to make decisions, but it should allow them to quickly and easily document the outcomes of certain
incidents in a consistent manner.
Once documented, all data should flow to a centralized repository – a database that can be accessed by
authorized users anywhere in the world, ideally on a role-specific basis to make sure each user only works
with pertinent data. This sort of structured repository for information can be analyzed and reported to senior
executives and the Board, revealing trends that may not otherwise be apparent and increasing the likelihood
that misconduct issues will be discovered early.
A major retail organization, for example, recently used EthicsPoint’s incident management system to discover
a correlation between work hour complaints and employee theft.
page 4 / 5

5. Integrated case management (cont.)
They found that when a surge of complaints comes from employees who believe they are not receiving enough
work hours, there is a subsequent increase in employee theft incidents. With that insight, it is now possible
for the company to notice if that particular trend is beginning to occur in any given location, and to prepare in
advance for the possible results.
Senior leaders need a far deeper level of insight than what they currently receive at many organizations.
Without incident management technology and company-wide process-sharing, the things managers observe
at a local level will not be seen as part of a company-wide trend that could form a real threat to the entire
enterprise.
Conclusion: Go with what you know
Faced with a surge of misconduct and the challenge of budget restrictions, you need all the information you
can get. The wealth of data most organizations already collects is available, but when information-gathering
stops at the local level the potential for insight is wasted. Companies need an enterprise-class incident man-
agement solution to truly understand and prepare for the critical business risks that will arise in the months
to come.
Questions? Comments?
Contact sales@ethicspoint.com
www.ethicspoint.com
page 5 / 5