With recent announcements of increasingly stringent federal policies around record-keeping and due diligence, compliance and investigation professionals are feeling the pressure to demonstrate consistency and rigor in their case management processes. Planning your investigation, having the right team members involved and reporting on outcomes of an investigation can all be difficult phases of the process. However, being able to demonstrate that you are quickly, consistently and accurately triaging incidents is even more important now. The key is to establish decision-making approaches and plan out your entire protocol before the matter comes to your attention through hotline reporting or other mechanism. This ensures structure and success as you triage, investigate, staff the investigation properly and meet the inevitable challenges of reporting and addressing the root causes of incidents.

1. How Best Practices in Triage Protocol
Can Boost Compliance and Reduce Risk
With: Tom Fox, “The Compliance Evangelist”

2. Today’s Presenter

3. Why the new (re) focus on case triage?

4. The Monaco Doctrine - 2022

5. • ABB enforcement action
• 2023 Corporate Enforcement Policy
• 2023 ECCP
• McDonald’s decision from Delaware
Court of Chancery
…and more…

6. Is your triage protocol doing enough?

7. • Part 1, Section D. Confidential Reporting Structure
and Investigation Process,
• Scoped Investigation by Qualified
Personnel [emphasis supplied],
• How does the company determine
which complaints or red flags merit
further investigation?
Evaluation of Corporate
Compliance Programs

8. It all begins with triage staging – M*A*S*H
1
2
3
4
5
Allegations that have a low threat level and do not suggest a breakdown of internal
controls.
More serious in nature, and often indicate some deficiency in the design of internal
controls.
Serious in nature, generally involve an override of internal controls, and thus are
at a minimum a serious deficiency.
Serious allegations that could have an impact on the completeness and accuracy of
the audited financial statements, and that could indicate a material weakness
in internal controls.
Serious allegations that involve one or more members of the senior management
team or are serious enough to damage the company’s reputation.

9. • These consist of allegations that have a low threat
level and do not suggest a breakdown of internal
controls.
• Triage determination must be made quickly
and efficiently; within 24 hours max.
• Document decision making!
• Can be investigated by triage decision maker
or managed by decision maker.
Stage 1 – low-level threat

10. • These allegations are more serious in nature, and
often indicate some deficiency in the design of
internal controls.
• Begin to separate the wheat from the chaff.
• Bring in independent audit/independent counsel.
Stage 2 – some deficiency in control design

11. • These allegations are serious in nature,
generally involve an override of internal controls,
and thus are at a minimum a serious deficiency.
• Effective triage can be important so you do not
face the dreaded “where else” question.
• Allows you should develop a logical plan with
the nexus to the facts.
• Critical that your initial triage is a
reasoned based decision.
Stage 3 – possible control override

12. • These are serious allegations that could have
an impact on the completeness and accuracy of
the audited financial statements, and that could
indicate a material weakness in internal controls.
• Through tactically scoping an allegation, it allows
you to move to the next step of developing a
reasonable investigation plan.
Stage 4 – indication of material weakness

13. • These are serious allegations that involve one or
more members of the senior management team
or are serious enough to damage the company’s
reputation.
• Help hold down costs.
• Aid in building credibility and trust with DOJ
during the pendency of an investigation.
Stage 5 – possible legal/regulatory violation

14. Who is responsible for triage?

15. …and who is the ultimate audience?
Senior management
Internal compliance committee
Regulator/DOJ
Shareholders
Trier of fact

16. • All reports made to government will be
turned over to defense counsel.
• Can you defend your triage protocol?
• Document Document Document!
The significance of “Coburn”

17. The role of a case management platform

18. • Document Document Document!
• Key repository for information during –
and after - an investigation.
• Determine if protocol is followed in real
time.
• Defend each step to regulators.
• The ultimate accountability.
• Analytics for greater insights =
continuous improvement, and
prevention.
Software supports triage protocol & teams

19. How to make the business case
1. Increased efficiency
Save significant
investigator time, and
provide faster case
resolution
2. Reduced risk
Reduce the chances
that errors will be
made, and help
demonstrate due
diligence to
mitigate legal costs
3. Better insights for
better decisions
Make data-driven
decisions to prevent
future incidents

20. • Proper triage protocols provide your organization
an initial understanding of what you may be facing.
• Use a consistent framework to quickly determine
the seriousness of the matter.
• Allocate an appropriate level of triage & investigation
resources.
• Document decision-making to support your
discussion with the DOJ if you must go that route.
• Meet requirements of 2023 ECCP.
• Use technology to reduce manual burden and
provide insights over time.
Takeaways: triage best practices

21. • Here are some resources to help you as you continue
to explore best practices in triage and case
management:
• White paper – Back to the Future: The Importance
of Triage and Investigative Protocol
• Webinar – Everything you Need to Get
E&C Investigations Right (According to the DOJ)
• Toolkit: Case management software buyers’ guide
Next steps: we’re here to help!
www.i-sight.com/resources

22. • Book an initial 30-minute personal consultation
• We’ll help you identify risks and scope ways to
improve your investigation process
• Let’s schedule a time to talk!
Talk to a case management expert
marketing@i-
sight.com

23. Q&A

24. Thank you!
Contact Tom Fox: tfox@foxlaw.com
www.compliancepodcastnetwork.net