Compliance programs are all about addressing problems within a corporate organization — and when your ability to address problems becomes problematic unto itself, perhaps it’s time to revisit your case management system.
Let’s first remember that managing cases is a core function of corporate compliance programs. An issue comes to your attention (over the hotline, through an audit, by your own observations); and your program must then investigate and address that case somehow. Sometimes the case can be closed with no action; sometimes it can lead to changes in policy or procedure. Some, alas, lead to regulatory enforcement actions.
But that’s only how case management works at the level of individual cases. The true challenge for compliance officers is effective case management at scale, when you might need to manage dozens, hundreds, or even thousands of cases at any given moment.
Why is a case management system important?
A system of case management is important for several reasons.
First, effective case management goes hand-in-hand with effective compliance programs. It’s true that the actual phrase “case management” never appears in the Justice Department’s guidelines for effective compliance programs — but when you read the department’s guidelines for investigating complaints, it’s clear that you can’t meet those expectations without a disciplined system of case management.
For example, the guidelines ask questions including: How does the company ensure that investigations are properly scoped? Does the company have a process for monitoring the outcome of investigations and ensuring accountability for the response to any findings or recommendations? Does the company periodically analyze the reports or investigation findings for patterns of misconduct?
No organization of appreciable size can do those things without a systematic approach to case management.
Second, and more practically, you need a system of case management because without one, you’re much more likely to mishandle an investigation that somehow gets you sued. Complaints might be ignored; witnesses might be overlooked; disciplinary actions might be applied inconsistently. Missteps like that can be fodder for civil litigation, bad press, and other disruptions.
For example, imagine several women complaining about harassment by a senior executive, and those cases are mishandled. #MeToo allegations explode on social media, lawsuits are threatened, the executive is ousted. Other than the last one, none of those things need to happen. Effective case management helps to assure that they don’t.
When does your system of case management break down?
Most businesses won’t see their case management system suddenly collapse. A more accurate description is to say that your ability to manage cases degrades over time; the system can’t keep up with the demands your organization needs.
What are the warning signs of poor performance? Let’s consider five of them.
The identity of internal reporters gets leaked.
As simple (and obvious) as this warning sign may seem, it’s actually quite telling. It means your investigation protocols aren’t strong enough to keep a reporter’s identity confidential.
For example, someone might submit a report to the compliance hotline that is more of an HR issue, so the case file is handed off to the HR team — and in that transition, the reporter’s identity isn’t kept confidential. Or someone brings an issue to his or her manager’s attention, and that manager forgets to keep the identity confidential. (This isn’t theoretical, by the way. In 2019 the Government Accountability Office audited the whistleblower protections provided by Defense Department internal hotlines, and those systems were riddled with failures.)
An effective case management system can maintain confidentiality throughout all the twists and turns a case might encounter. When important data starts falling through the cracks, you have a problem.
Your case closure times are getting longer.
Case management systems help the compliance officer to focus on action items and push a case to resolution as quickly as possible. When case closure starts taking more time, that can be a warning sign that your team is losing its ability to act in a timely manner.
We should stress here that longer case closure times don’t always mean that your case management system is overwhelmed. You might encounter a run of complex cases that simply need more time, or maybe you recently had a staff reduction so even pressing issues need to wait. Those things stink, but poor case management systems aren’t the culprit.
But poor case management can be the culprit for longer case closure times. If your system doesn’t have sufficient (ideally automated) alerting and escalation functions, your team may not know what to do, or what isn’t being done. So when you see case closure times start to rise, consider whether this is the root cause.
You re-invent case management protocols every time.
An effective case management system does just that: it manages cases. It guides your team to investigate and address all cases in a systematic, disciplined manner. So when you see more and more cases that unfold in a chaotic way —
- It’s unclear who should lead the investigation
- You can’t easily gather or maintain evidence
- People who should be briefed on the issue are excluded
- Notes and summaries are incomplete
— that’s a sign that your case management system isn’t supporting the compliance function the way it should. Case management is technology. It exists to help humans work more efficiently. If the humans are struggling, that means the technology isn’t doing its job.
You can’t tie cases to larger program weaknesses.
This is the data analytics component of case management, and it should be a top priority for compliance officers. Your case management system should provide a comprehensive view of the issues unfolding across your company so you can discern which policy, procedure, or internal control changes might be worth making.
For example, you don’t just want an efficient way of investigating harassment complaints; you also want to know whether harassment cases have spiked since the company hired that new VP, or acquired that new business unit. Then you can decide whether to separate from the VP or implement more training in the business unit. Or, perhaps you find a large number of reports about antitrust misconduct that turn out not to be true; that could mean your training about what qualifies as a violation isn’t clear.
Effective case management can track the details of your cases at scale, and provide the analytics to let you see improvements that could reduce problematic behavior.
You can’t deliver the level of reporting that stakeholders need.
This may be the ultimate sign of an overworked case management system: you can’t provide the level of analysis, assurance, and reporting that the board or senior managers need.
That shortcoming can take several forms. If your case management system can’t summarize the salient points of a case quickly, executives might get mired in irrelevant details while getting up to speed on an issue — or overlook important information, and then make decisions with an inaccurate sense of what’s happening. Or if the case management system can’t perform sufficient data analytics (see our previous warning sign), you can’t have an effective conversation with senior leaders about bigger issues that might need more strategic responses.
You could also have difficult conversations with regulators, if they’re reviewing a specific incident and ask about similar prior cases — and you can’t provide a good answer.
Conclusion
The bottom line is that effective case management is crucial to a compliance program. Like any tool, however, your case management system needs to be maintained over time, or eventually, its performance will degrade to the point where it no longer gives you the capabilities you need.
Know the warning signs for ineffective case management. When you see them emerge, don’t ignore them. Otherwise, your now-inadequate ability to manage problems will become just one more problem for you to solve. Last time I checked, compliance officers had enough of those already.
Matt Kelly is an independent compliance consultant and the founder of Radical Compliance, which offers consulting and commentary on corporate compliance, audit, governance, and risk management. Radical Compliance also hosts Matt’s personal blog, where he discusses compliance and governance issues, and the Compliance Jobs Report, covering industry moves and news. Kelly was formerly the editor of Compliance Week. from 2006 to 2015. He was recognized as a "Rising Star of Corporate Governance" by the Millstein Center in 2008 and was listed among Ethisphere’s "Most Influential in Business Ethics" in 2011 (no. 91) and 2013 (no. 77). He resides in Boston, Mass.