The Hotline That Nobody Calls
Northline Components, a 900-employee manufacturer, contracts with a third-party ethics hotline at a cost of about $45,000 a year. Over the past twelve months the hotline logged 12 reports; internal audit substantiated two of them (a timesheet issue and a small expense reimbursement scheme) with combined losses near $9,000. The CFO wants to cancel the contract at renewal and redirect the money to a data-analytics license, noting that internal audit has only three staff and no analytics tooling. An engagement survey run the same quarter found that 41% of employees could not say how they would report misconduct, and supervisors are known to tell staff to "handle things inside the department." The audit committee has asked for your written assessment before the renewal date.
1. The CFO argues that a 2-of-12 substantiation rate proves the hotline is not working. Evaluate that inference and state whether the contract should be cancelled on this evidence.
Read the worked answer
The inference is unsound because the metric is measuring the wrong thing.
Two competing explanations fit 12 reports and 2 substantiations:
- There is very little fraud, or
- Employees do not report, or reports are poorly triaged.
The surrounding evidence points to explanation 2: 41% of staff cannot name a reporting channel, and supervisors actively suppress escalation. A hotline with a broken intake and a hostile culture will produce few calls regardless of the underlying fraud rate. Low volume is therefore a biased measure, not a clean signal.
Substantiation rate is also the wrong denominator. A tip that triggers an inquiry and exposes a control gap is a return even if no loss is proven. Two substantiated cases worth $9,000 in recoveries does not capture deterrence, which is the hotline's larger contribution: it raises the perceived certainty of detection, and perception is what changes behavior. Tips have been the most frequently reported initial detection method in every edition of the ACFE's biennial Report to the Nations; organizations with reporting mechanisms detect schemes sooner and lose less.
Do not cancel on this record. The evidence supports fixing intake, triage, and anti-retaliation messaging before judging the channel. Analytics is complementary, not a substitute: it finds patterns in data you already capture, and it will never surface the collusion, side agreements, or cultural conduct that arrive as a tip.
2. Assume the budget decision is real and only one of the two investments can be funded this year. Recommend a sequence and specify the metrics you would use to judge the hotline next year.
Read the worked answer
Sequence the spending by dependency, not by preference.
- Fraud risk assessment first (low cost). Without it you cannot rank analytics tests or interpret hotline volume. Identify schemes plausible for a manufacturer of this size: vendor master manipulation, duplicate payments, purchasing kickbacks, inventory shrink, payroll ghosting, expense abuse.
- Cheap intake fixes before a contract decision. Web/QR intake, a visible poster and intranet page, a named compliance contact, and a one-page supervisor escalation rule cost little. The survey result is the binding constraint; the vendor contract is not.
- Fund analytics on the top two risks only. Duplicate payments and vendor master changes are testable with existing ERP data and are the natural complement to a hotline, not its replacement.
- Renegotiate rather than cancel. Move to a lower service tier or a per-report price if volume is the worry; cancellation is irreversible and reads to staff as a signal that leadership does not want reports.
Metrics that actually test the channel: reports per 100 employees; percentage of employees who can name a channel (re-survey); share of reports arriving anonymously versus named; median days from report to closure; substantiation rate by report category, not in aggregate; retaliation complaints; and cost per report compared with losses detected by audit and by analytics.
Judgment to state explicitly to the committee: a one-year volume increase after awareness fixes would be evidence of success, not of a worsening culture. Agree that expectation in advance so the metric is not misread next year.