Fact finding and
Root cause analysis
When an incident or wrongdoing has occurred
FACT FINDING INCLUDING ROOT CAUSE ANALYSIS:
What is the company’s root cause analysis of the misconduct at issue? What systemic issues were identified? Who in the company was involved in making the analysis?
Has the company’s investigation been used to identify root causes, system vulnerabilities, and accountability lapses, including among supervisory manager and senior executives? What has been the process for responding to investigative findings? How high up in the company do investigative findings go?
THOROUGH ANALYSIS OF CAUSES of underlying conduct (i.e. a root cause analysis) and, where appropriate, remediation to address the root causes.
TESTING AND IMPLEMENTATION of an effective compliance and ethics program, the criteria for which will be periodically updated and which may vary based on the size and resources of the organization:
The company’s culture of compliance, including awareness among employees.
The resources the company has dedicated to compliance.
The quality and experience of the personnel involved in compliance, such that they can understand and identify the transactions and activities that pose a potential risk.
The authority and independence of the compliance function.
The effectiveness of the company’s risk assessment and the manner in which the company’s compliance program has been tailored based on that risk assessment.
The compensation and promotion of the personnel.
The auditing of the compliance program to assure its effectiveness; and the reporting structure of any compliance personnel employed or contracted by the company.
APPROPRIATE DISCIPLINE OF EMPLOYEES, including those identified by the company as responsible for the misconduct, either through direct participation or failure in oversight, as well as those with supervisory authority over the area in which the criminal conduct occurred.
APPROPRIATE RETENTION OF BUSINESS RECORDS, and prohibiting the improper destruction or deletion of business records, including prohibiting employees from using software that generates but does not appropriately retain business records or communications.
IF RELEVANT; voluntary self-disclosure to the authorities and follow-up cooperation.
INTERNAL AND EXTERNAL communication.
The KA-model
Kvamme Associates has developed a unique corporate investigations model. The six-step process is designed to fully diagnose underlying issues and to prevent future compliance breaches. Investigation results and root cause analyses are used to build a stronger culture of trust and increased transparency and business integrity.
The US Department of Justice’s 2020 Evaluation of Corporate Compliance Programs and the US Foreign Corrupt Practices Act’s 2020 Resource Guide underlines that the truest measure of an effective compliance program is how it responds to misconduct. Accordingly, for a compliance program to be truly effective, it should have a well-functioning and appropriately funded mechanism for the timely and thorough investigations of any allegations or suspicions of misconduct by the company, its employees, or agents. A company’s compliance program should also integrate lessons learned from any misconduct into the company’s policies, training, and controls. To do so, a company will need to analyze the root causes of the misconduct to timely and appropriately remediate those causes to prevent future compliance breaches.
There is an international interesting and innovative movement regarding corporate investigations that is encouraging; a movement from the focus of investigations towards Sanctioning and Disciplinary Measures to also include Value Propositions and building an ethical and sustainable business integrity culture.
