Sarbanes-Oxley Whistleblower Hotline to pass

Posted by Teresa Bockwoldt on February 6, 2010

One of the requirements as laid out by the Committee of Sponsoring Organization or COSO for the Entity Level control is a whistleblower hotline. 

Many organizations have sprung up offering this service in a variety of forms.  One of the most sophisticated I have seen included a voice camouflage (think 20/20 and the way the voice is changed when an undercover person speaks). 

These are wonderful alternatives for companies who are able to afford it but do not be fooled into thinking that an anonymous hotline is required to pass Sarbanes-Oxley

Here are some free options that we have implemented that have successfully passed audit:

  1. Installing a separate line in the CFO's office and publishing the number on posters in the break room & in the employee handbook.  Sure, this is not necessarily anonymous but with some creativity (i.e., pay phones), people can make it relatively anonymous.  We even did this with the CFO's regular line.
  2. Posting the email account of the Audit Committee Chair on a poster in the break room and in the employee handbook to let people know that if they have a concern, they should write - not call because a number was not available - the Audit Committee Chair directly.  The auditors fussed a little because they were used to seeing "hotlines" that were manned by an independent 3rd party but in some cases, this is just not an expense that companies can afford.  $100+ per month is $100!  And again, in this case, a person could create an anonymous email from Yahoo! or MSN that would provide the level of anonymity they desire. 

The point of a "Whistleblower Hotline" is to have an avenue whereby people can explain a grievance in a manner that is taken seriously; that does not mean you are required to pay for a subscription to a service. 

An interesting tidbit, in my over 50 implementations of SOX, the most significant whistleblower communications I have witnessed have come from vendors and customers - not employees. 

We have a nice Whistleblower Hotline poster that you may download via this link after registration. This link will take you to the home page, where you can register. You can also register in the box in the upper right hand corner of this page.  The file is in Microsoft® Publisher so you may change it as necessary. 

Tags: Compliance tools, Controls Testing, Sarbanes-Oxley Training, compliance, Sarbanes-Oxley, Entity Level Controls