Security leaders are underserved by ethics hotlines, generic email addresses and internal telephone extensions as a means for employees to speak up about workplace violence, theft, harassment and cyber hygiene. Increasing workforce engagement by implementing a security-focused mobile hotline can improve effectiveness and reduce long-term costs.

Why do Incident Reporting and Case Management tools focus on intake from a security guard or analyst when the vast majority of security issues are observed earlier and in more detail by the general workforce?

As a 20+ year veteran of security and investigations, I have been on the receiving end of many leads from sources outside of my department, many from Ethics and Compliance hotlines. Regrettably, the idea of spending on security hotlines has gone by the wayside, nudged into discussion only slightly by the increased focus on insider threats ranging from workplace violence to protection of classified or proprietary information. The results is that most companies have a security hotline that is implemented on the cheap, without much thought given to how a properly implemented hotline can improve effectiveness of the security team and help contain overall costs.

Think about your average workplace - a medium-sized business might have a 2-3 security guards and/or cyber security analysts on site during the workday. At the same time, there may be a 1000 pairs of eyes and ears spread across your building(s) in the form of staff and contractors. Rather than provide a venue for them to speak up about theft, harassment, cyber hygiene or other issues THEY might well believe are best reported to Security, many security managers instead leave in place inadvertent roadblocks to reporting on Security matter that don't exist with today's leading Ethics hotlines. (I am thinking here of those generic email address, internal department phone extensions, even paper forms.)

These are not a best practice for Ethics hotlines, nor should they be for Security hotlines.

How do you justify the spend? Consider the average cost of security guard, who has one set of eyes and ears, perhaps augmented by a small bank of cameras, PSIM or SIEM that extend their reach into the digital. Now think about the staff that occupies every corner and nook in the building, knows what is out of place in both the physical and virtual domain and observes actions and conversations that could be considered bullying, harassment or indicative of insider threats. Consider also that with rare exception, each of these staff members wants to occupy a safe, secure workplace of integrity. Why not make it easier for them to share their concern in a meaningful, timely fashion? After all, most often, investigations into costly and/or grievous incidents almost always reveal that certain "non-technical observables" could have mitigated or prevented the incidents...if only they had been shared in more timely, effective manner.

This not about deputizing the workforce, that would be a mistake. For many, "guarding" is not part of their makeup and it's not their job, and they don't have the proper training. What if, though, you could put a security professional in their hands, one that is expert, always available and who can guide them through a brief, meaningful (and if they want, anonymous) interaction that allows them to share their concern and get on with their day. Seems like a win to me...and sounds a lot like what ATM's did for banks and check-in kiosks did for airlines. Augmenting the productivity of key by empowering the individual.

As budgeting season kicks into gear you are no doubt reviewing the effectiveness of your security team and the significant costs of finding and training additional personnel. You are probably doing this while also reading headlines about the most recent workplace violence incident, breach or theft of intellectual property. Perhaps is also time to consider the gains to be made from better engaging your existing "workplace neighbors," many of which are all to happy to help if you are able to empower them with the why and the how.

So, you have an ethics or fraud hotline. <Insert Golf Clap>

But are you setting yourself and your business up for failure by not evaluating how effective it is in the face of changing workforce demographics?

We often get asked to compare ourselves to vendors with traditional telephone hotlines, some of whom offer basic web-based reporting. We are happy to do so.

Why? Because we prioritize something absolutely vital to the success our your ethics program - and it's something that many hotline providers and ethics managers have forgotten about. This issue this is so important that ignoring it will result in even the most robust "awareness program, policy-offering, let-us-train your workforce eight ways to Sunday vendor" failing at the task of effectively supporting your efforts to keep the SOX, OSHA, HIPAA and fraud gremlins at bay.

Unlike others, we focus on customer partners who are looking for more than a check-the-box solution when outsourcing their whistleblower hotline and case management system. Our ideal customers are actively seeking to update and future-proof efforts to ensure proactive, effective communication with their workforce. They choose not to bury their head and take their chances with the costly consequences of fraud, sexual harassment or workplace violence. Instead, they seek out opportunities to mitigate issues before they become incidents, to take decisive action and communicate to the workforce the steps taken to both address the issue and to prevent the incident form happening again.

So, where is it that so many have lost focus? It regards the importance of how users in today's workforce prefers to communicate. Some might point to slightly increasing web-based reporting numbers and persistent telephone-based reporting as evidence that all is well in hotline world. This, however, undervalues the importance of appreciating significant generational changes in user experience preferences. It's as if they stopped asking that one favorite question of investigators and auditors: What else? In this case, what else could we be doing to foster more timely, effective workplace reporting?

When is the last time you walked down a hallway at work and didn't almost run into someone who was brain-stem deep in a mobile app? It's not just Millennials and Gen X'ers who are communicating in a new way. A 2015 Pew Research study found that people 55 and under were texting and emailing at least as much as making telephone calls. More recently, a quick read of this Inc. magazine article, reveals a study indicating that 75 percent of American Gen Z and Millennials told researchers that they prefer to talk with other people via text message--as opposed to actually talking with them.

The trend is obvious - update your hotline reporting mechanism...or your efforts to raise awareness and prevent incidents are going to hit a wall made of the cash you had to spend on regulatory fines, insurance fees, lawsuits and recovering your brand reputation. So, then. Why are outsourced ethics hotline programs and vendors still focused on scripted telephone calls? I dunno.

I can't help but reflect here on what one salesperson with a large, well-known vendor told me at a major ethics conference last year. He said, without even considering web-based reporting, let alone an intelligent app, "hotlines are a commodity, no one really cares as long as you have one." Say again?

Are traditional hotline reporting tools going extinct while the industry turns a blind eye (or ear) to users?

You don’t just need more reports from staff, you need more timely, actionable and detailed reporting.

Context: It’s not just about what users want to say, it’s about what you need to know. Details that can dramatically impact an ethics or fraud investigation are often missed when users are left fill out a form on their own, send an email to a generic departmental email inbox or when operators (or forms and bots) use a basic script. With the benefit of critical context up front, you can reduce the time and cost of research, structure interviews that more quickly build insight and close investigations more quickly, reducing effort, risks and costs.

Confidentiality: Respecting anonymity and confidentiality of those who reach out via your ethics hotline builds trust with those who speak up, helping ensure they are forthcoming with details. As important, respecting confidentiality will in the long term increase confidence in others who might otherwise stay silent due to concerns about retaliation.

Convenience: Most everyone appreciates that people just don’t make phone calls as much as in the past and are looking for a quick, convenient app-based interaction. The workforce is also increasingly mobile, making it less likely they will be able to easily find the traditional online form that is often buried in amongst the company webpages. For more evidence as to why a mobile-focused user experience needs to be a vital part of your ethics hotline ecosystem, in 2015 The New School for Social Research, New York published research showing that precision, disclosure and satisfaction all increased when automated interviews were conducted on mobile devices. (For more details on how this study applies to anonymous employee hotlines, see our blog post from earlier this week.)