The Hotline Report About the CFO
An anonymous hotline report alleges that the CFO directed procurement staff to award a facilities contract to a company owned by his brother-in-law, and that the CFO reviewed and approved the contract himself. The compliance director receives the report on a Friday. The CFO sits on the committee that approves the compliance budget and has previously praised the compliance director's work. The company has 900 employees, an audit committee of three independent directors, and no separate general counsel; the CFO's deputy oversees legal affairs. The alleged contract is worth $2.3 million and was signed three weeks ago. The compliance director's charter gives her authority to investigate, but she reports administratively to the CFO. The audit committee chair is traveling internationally for two weeks.
1. Who should direct this investigation, and what immediate steps should the compliance director take before the audit committee chair returns?
Read the worked answer
The compliance director should not direct this investigation alone, because her administrative reporting line runs to the subject and her budget depends on a committee he sits on. Independence is the controlling issue. She should escalate immediately to the audit committee chair by phone and email, even while traveling, and to at least one other independent director. She should document the escalation time and content.
Immediate steps before the chair returns: preserve evidence. That means a litigation-hold notice to procurement, legal, and finance covering the contract file, emails, calendar entries, and approval records, and confirmation that auto-deletion is suspended for the custodians. She should identify who approved the contract and confirm whether the CFO's self-approval violated the delegation-of-authority policy. She should not interview the CFO or his deputy, and should not discuss the allegation with them. She should consider whether the CFO's deputy, who oversees legal affairs, is conflicted by proximity and should be excluded from the investigation's scope.
She should also assess interim risk: whether the CFO can influence the investigation, alter records, or retaliate. If so, she should ask an independent director for authority to engage outside counsel and to place the CFO on administrative leave or restrict his access to relevant records, pending review. She should not act unilaterally against a senior officer without that authority.
2. The compliance director wants to hire an external investigator. What should she consider, and how should the findings be reported?
Read the worked answer
She should engage outside counsel or a forensic firm with no prior relationship to the CFO or the brother-in-law's company, and confirm the engagement is directed by the audit committee rather than by her administrative supervisor. The engagement letter should specify who receives the work product, who can direct scope changes, and how privilege will be asserted. Because there is no separate general counsel and the CFO's deputy oversees legal, privilege decisions should be made by outside counsel, not by the deputy.
The investigator should cover: the procurement process and whether competitive bids were genuinely considered; the CFO's approval and whether he disclosed the family relationship; whether any policy required recusal; and whether other contracts with the same company exist. The investigator should also test whether the allegation is mistaken, since a brother-in-law relationship may have been disclosed and approved.
Reporting should go to the audit committee, with a written report that separates established facts, contested facts, and conclusions. The compliance director should not edit findings to protect the CFO or to protect herself. If the findings substantiate the allegation, the audit committee should decide on referral to counsel for possible regulatory or law-enforcement notification, discipline, and remediation of the procurement process. The compliance director should also recommend a structural fix: a reporting line or charter change that removes her administrative dependence on the CFO, so future allegations against senior officers can be handled without this conflict.