Waheed Alkahtani, CFE, CISA, and ISO Lead Auditor

Transcription

1 Waheed Alkahtani, CFE, CISA, and ISO Lead Auditor Saudi Aramco Internal Auditing March 2012 Copyright 2012, Saudi Aramco. All rights reserved.

2 A Wealth of Data 46% employees who witnessed misconduct at work 65% reported the bad behavior

3 But it comes with its Risk Compliance We love tips R&R Volume , websites, telephone misheard mistreated Risk Mining for Hotline Gold, Robert Tie, Fraud Magazine, November/December 2011

4 Presentation Outline Overview: Understand your requirements Belling the cat: The implementation phase Hotline management and best practices

5 Section I

6 Saudi Aramco HR We employ almost 55,000 workers and are headquartered in Dhahran in the Eastern Province. Reserves The Company manages proven oil reserves of billion barrels, and the fourth largest gas reserves in the world, 279 trillion cubic feet. Operations Our operations span the Kingdom, with production and product distribution facilities linking all market areas. Integrated With operations in exploration, production, refining, petrochemicals, marketing and international shipping. International Hold significant interests in refining and marketing companies in China, Japan, India, the Netherlands, the Republic of Korea, Singapore, the United Arab Emirates, the United Kingdom and the United States.

7 Challenges with Saudi Aramco Global Presence Diverse Environment Wide Range of Services Business Solution Oriented

8 The Main Goal The main goal is to establish a mechanism for reporting noncompliance issues and other unethical behavior.

9 Best Practices Oil and Gas Service Providers GCC

10 Gulf Cooperation Council

11 Oil and Gas Companies Contact us In-house Outsource Contact info Phone and info Static web page Simple feedback page Service providers Multilingual International office

12 Service Provider Anonymous reporting mechanisms 24/7 Case Management Management Reports Training and Awareness

13 Available Options In-house Outsource Don t touch it

14 Don t Touch It If it is not Broken It is not our problem Compliance Management pressure The Tone at the Top

15 In-House Cheap, Customized, and One- Stop Shop Modest, Biased

16 Outsource IT Easy, Independent Costly, Compatibility Culture

17 Services providers are More efficient and proficient Provide flexibility Allow you to focus Save time, effort, and costs Share your business risks

18 But it may require Service Level Agreement (SLA) Legal and confidentiality agreements It may create potential redundancies Longer complicated approval process More agreements to manage

19 Double-Edged Sword Save Extra Save Extra Time Share Hidden Trust lack of trust Independent Cost Risk

20 There is no One size fits all Start small and grow over time. Fulfill your needs and take the interests of your shareholders into consideration. Outsourcing is a longterm partnership and you want to partner with the right service provider.

21 Factors to a Successful Hotline Planning Polices and Procedures Reacting Communicating Announcements Awareness and Marketing Campaigns

22 Section II

23 The Reporting Mechanisms Telephone IVR Fax Web Report

24 IVR Selections

25 Reporting Communication Marketing The Website General Goals Provides an avenue for individuals to report noncompliance issues and irregularities within the Saudi Aramco Businesses and Operations Provides an effective two-way communication, engaging all employees with the GA regarding case status and feedback Proactively promotes an ethical workplace, identifies conflicts of interest, and provides policies and procedures on business ethics

26 The GA ehotline Simple Independent Private Secure

27 The IA Hotline Process Report Register Follow-up

28 What to Report Violations of any law or regulation applicable to the Company s operations Falsification of records or reports Violation of the Company s policies Other irregularities, including fraud, theft and matters relating to conflicts of interest

29 Deployment Plan Intranet Home Employees Extranet Vendors Suppliers Internet Full access Everyone

30 What We Have Done Web Application Development Secure Application Server Pilot Phase Final Design Announcement

31 What s Next Awareness Meetings Announcements Posters Enhancements Links Extranet Tracking Number of hits Reports and logs

32 Section III Ask not what the hotline can do for you, ask what you will do with the hotline results

33 Fire hose Water hose

34 Ask the following questions What is your scope of work? Who will manage the hotline and who will administer it? How will you handle a call or a tip? Who will report it?

35 Call Handling The Hotline IVR system answers the hotline and forwards the calls to SAD auditors who interview the callers about their allegations Calls will be directed to Arabic and English speakers according to the caller selection Saudi Aramco General Auditor Hotline. This is YOUR NAME, how can I help you? The call coordinator should log the call manually to IA e- hotline/log system while or after completing the call Income Redirect Greeting Logging

36 Call Handling Questions should be constructed around when, where and how Logs the information, fills the e-hotline form, and generates a reference number Reference number A Complaint Report is ed to the GA Gathering Document Closing After the call

37 Overview s Fax e-hotline Phone Analysis Communicate items with the GA Special Audit Normal Audit HR or other Report Call categories Sources and allegation types Combine Dispatch

38 Useful Measures Type Identity Source Level of employees Reporting methods Allegation Anonymous Group Management Online Inquiries Named Location Professionals Phone Business lines Education Fax Walk in

39 Other Useful Measures Life cycle Actions Substation rates Geographic distribution Trends against prior years

40 26% Phone Call 24% 3% Fax 35% e-hotline 12% Others 20/12/ calls 1-2 calls/day Inbox Figures HR Other 30% Grievances Performance Management Discrimination Questions Appreciation Wrong Number Statistics on the Hotline

41 Finance Business Ethics Misuse Human Resources Other Hotline Main Categories Accounting, Auditing and Financial Statement Fraud, Conflicts of interest, and Bribes Vehicle Use, Employee Theft and Time-Clock Abuse Discrimination, Harassment and Compensation Environmental, Health and Safety

42 Call Volumes Company risk areas Organization culture and work climate Workforce break down and staffing Advertisements and marketing mechanism Alternatives and other channels

43 What May Cause Changes News and Media Regulatory Changes Awareness and Training A Real Problem

44 Hotline Trends

45 Challenges Working Hours 7:00 to 4:00 versus 24/7 Consolidation Hotline with multiple reporting mechanisms, requires well-defined logging procedure and consolidation efforts. Follow-up Many occasions require coordinating acts between various entities in the organization. Languages Companies with global presence and multinational employees have to consider multiple interfaces and translation issues.

46 Call Analysis Benchmarking Reporting Other Challenges So much data, but not always clear The need to demonstrate the hotline s effectiveness The need to report meaningful and actionable data to management

47 Hotline Kills Discouraging callers with questions or requests for advice Long investigation cycle Failure to publish sanitized outcomes for employees Neglecting trends and benchmarks

48 Final Thought The fear of retaliation Who cares? Nothing will happen Why don t people report?

49 Now LATER Conclusion Reaction Complex Collective 65% Prevision Simple Awareness 75%

50 Thank you

51 Association of Certified Fraud Examiners, Certified Fraud Examiner, CFE, ACFE, and the ACFE Logo are trademarks owned by the Association of Certified Fraud Examiners, Inc. The contents of this paper may not be transmitted, re-published, modified, reproduced, distributed, copied, or sold without the prior consent of the author.