A Dashboard That Hides the Problem

The dashboard is not a reliable measure of compliance performance. Clause 9.1 requires monitoring, measurement, analysis and evaluation against defined criteria, and the indicators chosen here measure activity, not effectiveness. Training completion says nothing about whether staff can recognise a bribery risk or use the hotline; a poster says nothing about whether concerns are handled. Zero substantiated cases over two years, in a 4,800-person retailer with 35% turnover, is more likely a sign of under-reporting than of perfect conduct - especially when 41% of employees say they do not know how to raise a concern. The hotline design makes under-reporting worse: reports go to the store manager named in the report, which suppresses escalation and invites retaliation. Internal audit's independence is also compromised because the finance team investigates the same cases it audits. A better monitoring set would include reporting channel awareness, time-to-resolution, substantiation rates, repeat issues, retaliation allegations, exit-interview data, and trend analysis by store and business unit.

Clause 9.2 requires internal audits at planned intervals to provide information on whether the CMS conforms and is effectively implemented. Harborline's arrangement fails the objectivity requirement: the finance team audits a system in which it also investigates hotline cases, and it reports to the same management whose controls are being tested. There is no audit programme, no defined criteria and no evidence of competent, independent auditors. Clause 9.3 requires management review at planned intervals, with specified inputs and outputs and decisions on improvement. A 26-month gap and no actions mean top management is not reviewing the CMS. The review should be chaired by the CEO, receive audit results, hotline trends, risk assessment changes, nonconformities and corrective actions, and produce documented decisions with owners and dates. The audit and risk committee should also receive the results. Without those two processes, the dashboard has no challenge function and the organization cannot know whether its controls work.

Clause 10.2 requires the organization to react to nonconformity, evaluate the need for corrective action, implement it, review its effectiveness, update risks if necessary, and retain documented information. The first action is to stop routing hotline reports to the manager named in the report. Reports should be triaged by an independent compliance function or external provider, with immediate conflict checks and a retaliation risk assessment. Historical reports should be reviewed for mishandling, and reporters should be contacted where possible. A corrective action should address the root cause: the absence of an independent reporting channel, unclear investigation ownership and a culture that discourages speaking up. Retraining alone would not be sufficient; the channel design and governance must change. The corrective action should be recorded, assigned an owner and a due date, and its effectiveness tested through follow-up reporting data and employee awareness. The board should receive a report on the past cases and the changes, because the issue is systemic, not a single incident.