Институт внутренних аудиторов

Вопрос снова поднят к обсуждению в группе ИВА в линкедин https://www.linkedin.com/grp/post/2606437-6...755239539437568 <br><br>краткие рекомендации по горячей линии<br>Выдержка из Managing the Business Risk of Fraud: A Practical Guide <br><br>https://global.theiia.org/standards-guidanc...aud%20paper.pdf <br><br>Whistleblower Hotlines<br>The use of a whistleblower hotline36, which has markedly increased among SEC registrants since it was mandated by the U.S. Sarbanes-Oxley Act of 2002, is one of the more effective measures organizations can implement as part of their fraud risk assessment program. Various surveys indicate that anonymous tips received through hotlines or by other methods are the most likely means of detecting fraud. In addition, knowledge that an employee hotline is in place can help prevent fraud because individuals may fear that a fraud will be discovered and reported.<br>Marketing the existence of a hotline to increase awareness, making it easy to use, and promoting the timely handling of all reported issues are strong preventive measures that should supplement the detective control of hotlines. The hotline should be promoted with educational materials provided to shareholders, employees, customers, and vendors, all of whom can provide valuable information from a variety of reliable sources. Hotlines ideally support a multilingual capability and provide access to a trained interviewer 24 hours a day, 365 days a year.<br>Provision for anonymity to any individual who willingly comes forward to report a suspicion of fraud is a key to encouraging such reporting and should be a component of the organization’s policy. The most effective whistleblower hotlines preserve the confidentiality of callers and provide assurance to employees that they will not be retaliated against for reporting their suspicions of wrongdoing including wrongdoing by their superiors. Another key is demonstrating that their reporting will result in appropriate and timely action being taken. To preserve the integrity of the whistleblower process, it must also provide a means of reporting suspected fraud that involves senior management, possibly reporting directly to the audit committee.<br>A single case management system should be used to log all calls and their follow-up to facilitate management of the resolution process, testing by internal auditors, and oversight by the board and/or the audit committee38 as the board’s designee. The board should approve protocols to ensure reported fraud-related issues are disseminated timely to appropriate parties, such as the ethics/compliance team, HR, the board and/or the audit committee, legal, and security. Distributing reports to these parties of occurrences in their respective areas of responsibility ensures that no single person or functional area controls this highly sensitive information and increases accountability.<br>Charged with the responsibility for having documented procedures for receiving, retaining, and investigating complaints or tips alleging the possibility of misconduct or possible fraud, many audit committees have turned to independent service providers to operate hotlines and notify the organization of any reported accusations.<br>An effective hotline program should analyze the data received and compare results to norms for similar organizations. Ongoing analysis allows an organization to reshape its fraud risk management program to address evolving risks. The whistleblower process should be independently evaluated periodically for effectiveness, including compliance with established protocols.<br><br>