In my last column I described the human factors which stopped people raising concerns or acting on them if they were raised. They can be summed up – bluntly – as fear and cowardice, respectively. Or, if we want to be kinder, worry and opting for an easy life.

What those with concerns worry about most is that they won’t be listened to, their concerns not properly investigated or at all, or they will be labelled as troublemakers and retaliated against. Managers may not intend to ignore problems but if they are conflicted – “admitting to this will harm me / my company” – it is easy to rationalise why doing nothing or hoping the problem will resolve itself or go away is the best thing to do, especially if the alternative involves expense and the use of scarce resources. Doing nothing is easy.

So how do you get round these all too understandable and prevalent human reactions?

Make it easy on yourself

The key to any effective process is to make it easy – or easier than it might otherwise be – for people to do the right thing and hard for them to do the wrong thing.

Let’s assume you have your policy written, published and publicised. This is necessary, but never sufficient. A policy is not action. It can easily end up being about as effective as New Year resolutions – created with good intentions but quickly forgotten.

What is needed is a strong, independent, internal investigations function. To operate effectively, the following is needed.

• An experienced, multi-disciplinary team which knows how to investigate. Do not assume that this means it must be staffed exclusively by lawyers. Investigation is not the same as litigation. Good investigators need two skills above all: empathy coupled with curiosity and ruthless analysis. They also need to be able to assess critically technical evidence. Obviously the team depends on the type and size of business but, however small, there needs to be someone responsible for investigating concerns.
• All concerns raised to it – whether directly or indirectly – must be investigated, no matter how minor, seemingly trivial or ludicrous. Management does not determine whether an investigation is started, nor can it stop it.
• It must be the only body that carries out investigations. It has authority to co-opt resources from other functions as needed. Where external investigators are necessary, it acts as the interface with them.
• It must be able to recover the evidence needed – communications, trading or other business information – in a comprehensive, robust and expeditious manner without needing to ask those whose information it is.
• It must take the confidentiality of its investigations very seriously indeed: from the names/identities of those raising concerns to the evidence obtained, the names of witnesses and so on.
• An effective governance process must exist to ensure that any conflicts of interest are properly handled, any difficulties in carrying out the investigation are dealt with, and that there is effective escalation of serious issues and timely, accurate reporting to key internal and external stakeholders.
• Its findings should not just be on the concerns raised but recommendations for actions to be taken – whether disciplinary proceedings, better training, process improvements …
• An effective process for ensuring that follow-up actions are allocated and tracked must be present.
• There must be appropriate feedback to those raising concerns and others.
• The process needs to include an understanding that, even if a concern turns out to be unsubstantiated, this does not mean that it was wrong to raise it. The fact that someone only felt able to raise a concern in such a way is telling you something important about your firm’s culture. At the very least it shows that communication is not what it should be and that staff feel unable to raise issues in the normal course of business. This needs addressing not ignoring. Above all, there needs to be an understanding that there should be no adverse consequences for the person raising the concerns.

How does this help?

In three important ways.

• It gives confidence to whistleblowers. It builds the trust that is needed to allow people to speak freely, in confidence, knowing that they are doing so to people who will properly and professionally investigate what has been said.
• It minimises the conflicts of interest which managers often have. 
• Its findings are robust, thorough and useful. This gives confidence to senior management. It makes it more likely that effective action will be taken. There is, of course, no guarantee. But remember: doing nothing because you do not know what is happening is easy to justify, to yourself and others. Doing nothing when you have a report telling you what is happening and what needs doing to put it right is very much harder. The incentives have shifted into doing something – if only because this will make managers look good. Too cynical? Possibly, but we are dealing with humans not saints.

Can an internal team be independent?

Don’t let the perfect be the enemy of the good. Even external teams are not truly independent. They answer to who pays them.

Independence is a mixture of governance, the procedures governing how investigations are carried out and the independence of mind of the investigators. This last is probably the single most important factor: both in making the team professional, reliable and trustworthy and in making it trusted by all those involved.

The other key point is this: whistleblowing / speaking up is, in essence, about risk management. It is a way of ensuring that you know and find out about the risks you are running and can manage them before they turn into big problems. That is something an organisation needs to do for itself.

It cannot – should not – outsource that. The more you do it yourself, the better you get at it, the more you improve your culture, the greater the expertise you develop and the more knowledge you have of what is really going on in your firm. Why would you outsource that – and have to pay handsomely for it too?