Investigations have many names, in parts of the organization they may be called issues, loss, matters, events, cases, and incidents. I now turn our attention to a series of posts/newsletters on the topic of effectively managing corporate investigations.
Investigations, done right, minimize or control loss, uncover systemic issues, identify risk areas, and provide information that drive continuous improvement initiatives. As a result, investigations are a critical cornerstone to governance, risk management, and compliance (GRC) efforts in the ability to find and resolve issues to reduce exposure and contain loss to the organization.
GRC activities require that an organization have a solid approach to manage investigations and feed information into other GRC related processes. Consider that. . .
- Investigations are a GOVERNANCE activity: Most organizations do not connect investigations with how they maintain corporate culture and policy boundaries by holding parties accountable to policies and procedures. Without a consistent investigation process culture morphs and takes unintended paths.
- Investigations influence RISK models: Investigations inform risk management processes where the most significant risks have materialized in the past and drive evaluation and remediation priorities. Loss information gathered from investigations is a critical element of risk modeling.
- Investigations are a critical component of COMPLIANCE: Investigations enforce compliance through identification of areas that need improvement and increased monitoring. This includes policy and procedure revision, improved communications, changes to training programs, and enhancements to monitoring activities. Further, investigations are considered a fundamental element of a corporate compliance program (e.g., USSC Organizational Sentencing Guidelines).
Through a consistent investigation process the organization identifies damages, involved parties, evidence of policy violations, impacts, remedies, and maintains boundaries for acceptable behavior of business processes, relationships, systems, and individuals.
The right investigation process is necessary to define and communicate that the organization is serious about its policies, culture, and control and to facilitate enhancements that prevent reoccurrence of similar issues.
Stay tuned – more will be coming on the critical topic of effectively managing investigations. In the meantime, I would love to hear your thoughts on Investigation Management and corresponding organizations strategies. Please feel free to comment below . . .