Plan & Assign: Part of Internal Investigations for Control and Compliance Violations (3 of 5)

tag:blogger.com,1999:blog-29863993.post-41070069820270325852007-11-08T14:44:00.001-07:002008-04-15T09:30:55.180-07:00Plan & Assign: Part of Internal Investigations for Control and Compliance Violations (3 of 5)In a recent <a href="http://www.complianceweek.com/index.cfm?fuseaction=article.viewArticle&article_ID=3739">column</a>, I illustrated the key components of a strong internal investigations capability to address compliance and internal control violations. In fact, I've done a number of these 11x17 illustrations and they can all be found on the <a href="http://www.oceg.org/view/illustrations">OCEG</a> site or on the <a href="http://www.complianceweek.com/">Compliance Week</a> site. This is Part 1 of a 5-Part Series: 1. <a href="http://grc360.blog.oceg.org/2007/11/investigations.html">Capture</a> 2. <a href="http://grc360.blog.oceg.org/2007/11/filtering-issues-part-of-internal.html">Filter</a> 3. Plan & Assign Based on the alleged and/or confirmed facts, circumstances, nature and seriousness of the issue, the team should assign the issue to the appropriate investigations “work stream” or “tier” as some organizations call it. Using a tiered system ensures that issues of similar nature and seriousness are handled in a similar way. In addition, it allows the organization to allocate scarce capital – both human and financial capital – to investigations. When assigning issues to a tier and team, an organization should consider:<?xml:namespace prefix = o /><o:p></o:p><ul style="MARGIN-TOP: 0in" type="disc"><li class="MsoNormal" style="MARGIN-BOTTOM: 0pt; COLOR: rgb(13,13,13); LINE-HEIGHT: normal">Nature and seriousness of the issue;<o:p></o:p></li><li class="MsoNormal" style="MARGIN-BOTTOM: 0pt; COLOR: rgb(13,13,13); LINE-HEIGHT: normal">Skills and experience required to obtain and analyze facts (legal, accounting, technology, forensic and other industry expertise);<o:p></o:p></li><li class="MsoNormal" style="MARGIN-BOTTOM: 0pt; COLOR: rgb(13,13,13); LINE-HEIGHT: normal">Independence from the issue at hand (e.g., to not assign a financial investigation to a team that includes staff from the office of the CFO); and<o:p></o:p></li><li class="MsoNormal" style="MARGIN-BOTTOM: 0pt; COLOR: rgb(13,13,13); LINE-HEIGHT: normal">Availability of resources.<o:p></o:p></li></ul><o:p></o:p>I know this last item sounds obvious, but a timely follow-up and investigation is important especially for serious issues that may involve the government. <o:p></o:p><o:p></o:p>While an organization may choose to have fewer or additional tier, at least four will be helpful:<o:p></o:p>Tier 1: Critical Issues. This tier is reserved for “sink the company” issues that are material to either the financial or reputational health of the organization – or issues that involve senior executives. These investigations are directed by the board and involve significant outside assistance to ensure objectivity. Privilege is a must at this level. For public companies, the involvement of the external auditor may be required or at least advised.<o:p></o:p>Tier 2: Significant Issues. These issues are serious and material to the organization but do not involve allegations of wrongdoing by senior management. As such, senior management directs these investigations with special care and under privilege. <o:p></o:p>Tier 3: Serious Issues. Most organizations have issues that they, to a certain degree, expect and prepare for, such as a significant theft. Systems have been designed and special investigative staffs have been trained to address these issues.<o:p></o:p>Tier 4: Operational Issues. These issues, often HR related, warrant the attention of management, but may not require privilege or professional investigators. They are often delegated to management, but could escalate at any phase. Some of these issues are resolved without the need for investigative resources.<o:p></o:p>While each of these tiers it is important to define who does what. Critical roles include:<o:p></o:p><ul style="MARGIN-TOP: 0in" type="disc"><li class="MsoNormal" style="MARGIN-BOTTOM: 0pt; COLOR: rgb(13,13,13); LINE-HEIGHT: normal">Leadership for day-to-day management of the investigation;<o:p></o:p></li><li class="MsoNormal" style="MARGIN-BOTTOM: 0pt; COLOR: rgb(13,13,13); LINE-HEIGHT: normal">An individual charged with communication about the status of the investigation with stakeholders such as the source of the allegation, the media, and most importantly the government; and<o:p></o:p></li><li class="MsoNormal" style="MARGIN-BOTTOM: 0pt; COLOR: rgb(13,13,13); LINE-HEIGHT: normal">Staff and outside consultants who will obtain and analyze the facts.<o:p></o:p></li></ul>As a final note, it is wise to limit knowledge that a particular investigation is being conducted. The risk of evidence tampering and destruction increases when it is broadly known that an issue is under investigation.<o:p></o:p>Scott L. Mitchell, CEO (www.oceg.org)http://www.blogger.com/profile/06182779518123146033noreply@blogger.com