A hallmark of an effective compliance program is the existence of a well-functioning process for the investigation of allegations of misconduct. Is your compliance investigation process well-functioning? The four signs I look for are (1) a comprehensive written protocol; (2) consistency of handling and discipline; (3) after-action learning takes place; and (4) reporters are directly acknowledged.
1/The written protocol
It surprises me how many commercial stage life science companies don’t have a written investigations protocol. You need one!
Your written protocol should cover:
Who handles intake of reports
What type of reports must be elevated to the investigation function
What are the criteria for when conduct becomes an investigation
Who is informed about an investigation - likely this will be tiered based on the significance of the conduct or people involved
Who conducts the investigation, determines if done under privilege
Expected timelines for completion of investigations
Documentation required and where stored, typically investigation plan, interview memos, final report
A process for closing investigations, including how and who determines discipline, who receives notice, plan for after-action learning
2/Consistency of process and discipline
You have an investigation protocol, but what happens in practice? Bottom line is shortcuts to the normal process are a problem, especially if based on a person’s level in the company, whether they are a critical employee, a high performer or if the findings could hurt the company.
In fact, in these circumstances it is often more important to have more process. Shortcuts resonate through your organization, undermine trust in your compliance systems and the investigation process.
On discipline, many companies have written guidance on what type of discipline is required by specific deviations of policy. This is a good practice and worth the investment of time.
3/Effective After-Action Planning
A process failure I often see is a lack of follow-up when the investigation is done. Lessons learned need to be communicated to the right people and an action plan developed and executed. Failure to do this is a missed opportunity. A formal part of your investigation process should be communicating after-action learnings and tracking an action plan to make sure learnings are implemented.
4/Reporters are acknowledged
I’ve had the misfortune of handling numerous government investigations and whistleblower cases and in most the whistleblower made efforts to reach out to compliance. What happened? Most often they didn’t feel heard. Do you have a system for acknowledging reports? Is there follow-up directly with the reporter? Do you close out with the reporter?