I. INTRODUCTION
Several financial institutions have implemented or are considering the establishment of fraud hotlines as a mechanism to mitigate both internal and external risks and threats to itself or its customers. Some fraud hotlines are set up internally while many others are being implemented through contracts with third party service providers. The FDIC issued a Financial Institution letter (FIL-80-2005), dated August 16, 2005, to give guidance to financial institutions on implementing fraud hotlines. Citing the Association of Certified Fraud Examiners “2004 Report to the Nation,” FIL-80-2005 notes that organizations without mechanisms to report fraud suffered financial losses were more than twice as high as organizations with anonymous fraud-reporting mechanisms. Entitled “Guidance on Implementing a Fraud Hotline,” the FDIC Guidance discusses the benefits of a hotline and encourages financial institutions to consider implementing a fraud hotline as a confidential communication channel to: identify fraud; minimize potential and actual fraud risks; assist in the institution’s risk management, corporate governance and fraud protection efforts; and reduce fraud-related losses as part of the institution’s governance and enterprise risk management program. The FDIC notes that related to this Guidance (FIL-80-2005) are two previously issued Guidances: FIL-46-2005 “Pre-employment Background Screening” and FIL-17-2003 “Corporate Governance, Audits, and Reporting Requirements.” NBA members who either have or are considering a fraud hotline are alerted to several issues anticipated and standards expected by the FDIC.
II. AWARENESS
For a fraud hotline to be most effective, its existence should be advertised and marketed by an institution (e.g., in bank newsletters, memoranda, written policy and on internal as well as external institution websites) to employees, suppliers, third-party service providers and customers. The purpose of the hotline should be communicated and guidelines for usage defined in order to reduce inappropriate calls or complaints unrelated to wrongdoing and to make aware the types of improprieties that are reportable events. According to the Guidance, “risk-awareness training about situations and suspicions that merit reporting will help to create a corporate culture that supports this type of confidential reporting mechanism.”
III. OPERATIONAL ISSUES
Prior to implementing a fraud hotline, an institution should perform a cost/benefit analysis (e.g., budget, staffing and expected volume of calls) of operating a hotline either internally or by third party contract. Although initial start-up costs are incurred, the Guidance advises that once it is established, loss prevention savings should outweigh costs. Communication channels suggested in the Guideline include: toll-free telephone line; secure e-mail address; designated mailing address; or combination of these or other methods. Hotlines should be operated by experienced interviewers capable of asking pertinent follow-up questions to determine whether an investigation should be initiated. Operational hours should ensure availability.
An institution’s fraud hotline may be operated either internally or by a third party service provider. In either case, the FDIC advises that the operation be independent from bank management, for “the more independently the hotline is administered, the more confidence the complainants will have in reporting misconduct.”
IV. CONFIDENTIALITY
An institution’s legal counsel should be consulted prior to establishing a fraud hotline to ensure that it is in compliance with both privacy and whistleblower laws and that information sources remain confidential. Certain communications features that could intimidate callers must be avoided (e.g., caller ID or call-back functions). To avoid the fear of possible reprisal, callers should be assured of confidentiality.
V. RESPONSIBILITIES AND DUTIES
A. Tracking
A secure tracking system should be established in order to handle: the complaints and incidents of fraud; the follow-up; the investigation; the disposition; and the final closure of the matter. Updates on the status of a complaint or incident should be reviewed regularly with the institution’s internal auditor and personnel responsible for fraud prevention.
B. Investigations and Reporting
According to the Guidance, the decision to investigate a complaint or incident should be made on a case-by-case basis and that any investigation and conclusion should be included in reports to the institution’s audit committee. In case of an identified fraud scheme, financial institution management should develop internal control procedures to avoid future incidents.
VI. CONCLUSION
The FDIC advises that there are two important components in implementing a fraud line: (1) employees, customers, contractors, service providers, suppliers and other third parties should be made aware of an institution’s fraud hotline to ensure its effectiveness; and (2) tips reported on fraud hotlines should be guaranteed confidentiality to ensure that persons may report suspected wrongdoing without fear of retribution or reprisal.
In addition, institutions that implement fraud hotlines should be aware of added responsibilities and probable duties to address complaints through follow-up activities, investigations and dispositions, including mitigation or avoidance of future risks when a fraud incident occurs.