Three Warning Signs Your Speak-Up Program Needs an Upgrade, and What to Do About It

As compliance professionals, we audit, monitor and continuously improve almost everything else we own. The speak-up program itself often escapes that same discipline. The hotline gets stood up. The branding gets launched. The training slide gets written. And then nobody goes back to ask whether any of it is still working.

When I look closely at speak-up programs, the gaps I find are rarely in the process. The process is usually fine. What's missing is what colleagues know and believe about it. Below are three warning signs that are commonly overlooked, and how to check whether your own program is showing them.

Employees Don't Know What Happens to Reports

Transparency isn't a value we tend to associate with investigations. By their very nature they should be confidential, so compliance departments commonly share very little about them. That often extends to the process in general.

But there's a difference between the confidentiality of a case and the secrecy of a procedure. A little high-level information that de-mystifies the process for colleagues can go a long way toward building a culture of organizational trust.

One of the most effective examples I've seen comes from Hyatt Hotels. They're transparent enough that their investigation process is set out on page 7 of their publicly available Code of Conduct, a document titled "Doing What's Right". It's a wonderful example of a principles-based way to present a code. Honestly, I can't say enough good things about it. I think it's world class.

Investigations are an area where you can't be too proactive about level-setting and giving colleagues information in advance. Every question left unanswered, and every part of the process left unclear, is an opening for people to lose faith in it.

How to check: read your own code and intranet the way a nervous first-time reporter would. Can they find out what happens after they press send? Who sees the report, what the broad steps are, roughly how long it takes, and whether they'll hear anything back. If not, that's your gap.

Branding That Doesn't Stick

If the first sign is about what colleagues can find out, the second is about whether they recognize the thing when they see it.

You may have come up with a fantastic hotline name. A clever pun, a nod to one of your company values, or branding you're genuinely proud of. It means very little if only the compliance department, and a few astute others, understand what it actually is.

I'm going to ask you to be humble for a moment here. Senior management teams are prone to wearing rose-tinted glasses when they describe their company's culture, or when they judge whether they themselves have an open door. Compliance functions are just as prone to a blind spot of our own. We communicate something a few times, we draw specific attention to it in a training, and we conclude we've successfully cascaded it across the entire organization.

It can be eye opening to check. Look for an opening: a Compliance Week quiz, risk assessment questionnaires and interviews, an employee engagement survey. Then ask outright, "What is the Courage line?", tailored to your own branding. If there's no broad understanding, you know you need to get into the weeds and make the connection explicit.

The standard I keep in mind here comes from Lisa Beth Lentini Walker, author of the compliance communication book Raise Your Game, Not Your Voice: seven times, seven ways. For every important compliance message and educational nugget we need to land, we should be able to satisfy ourselves that we've said it at least seven times, in seven different ways or forums.

Colleagues Don't Believe Anonymous Reports Are Taken Seriously

The third sign is the hardest to see, because it lives in what people believe rather than in anything they say to us.

It isn't uncommon for a rumor to spread that anonymous reports don't carry the same weight as reports from named individuals. And many people would only ever report anonymously.

As investigators, we know anonymous cases genuinely can be harder to work. A reporter drops an allegation and then disappears. Many reports lack the detail or clarity to investigate without asking for further and better particulars. That puts us on the back foot.

Here's how the damage compounds. A case that might have been substantiated, had someone been able to point us in the right direction, ends up unsubstantiated because investigators have no line of inquiry to follow. The reporter then watches for something in the organization to change. Nothing does. So they conclude the investigation process is a sham, when in fact it's merely flawed. And that conclusion doesn't stay only with them. It becomes the rumor the next potential reporter hears.

So we need to be clear on both halves of the message. Anonymous reports are welcome and are investigated thoroughly. And there are real limitations to what we can do with them.

Hyatt again offers a way to get ahead of this. On page 6 of the same code, they set out expectations for reporters. It names a problem investigators encounter with anonymous reports, diplomatically, without discouraging anyone from making one: "Keep in mind that if you make an anonymous report, it may be difficult for the Company to ask follow-up questions, so try to provide enough detail so that someone can investigate."

As an aside, AI-generated writing is getting a bad rap overall, but I take a more positive view of one use of it. Reporters using AI to tidy up their draft has likely reduced the number of long, hard-to-follow reports landing in compliance departments. There are swings and roundabouts to everything.

Where to Look Next

These are three of the ways a speak-up program can drift without anyone noticing. They aren't the only ones.

Make the time to identify other elements worth reviewing. Partner with your internal audit team and ask what they would look at. And check in with your hotline provider about the features they've implemented recently. Some of them may make you more effective than the setup you've been running for years.