The Importance of Internal Investigations
04/15/2008

Article originally appeared in Gaming Management on 04/15/08

The decision to begin a gaming investigation is an important one. In fact, it may be critical to keeping a gaming company’s most valuable asset: its gaming license. Efforts to discover potential compliance violations and the timing and diligence of subsequent investigations can show regulators and others that the gaming licensee can effectively identify and respond to allegations of wrongdoing. More importantly, a thorough and objective investigation shows the gaming enterprise’s commitment to comply with all governing laws and regulations. Together, a proactive issue discovery process and the prompt, objective and comprehensive investigation of compliance issues demonstrate that the gaming company can self-regulate without undue outside intervention.

Issue Discovery

The process used to discover potential compliance violations is an important part of a credible and effective compliance program. A gaming enterprise must establish methods and procedures, and provide the necessary resources to actively seek information about potential problems. This is best accomplished through a clear set of written and communicated polices that define acceptable behavior and practices.

Whistleblower complaints are a common way to find potential fraud or to become aware of compliance violations. Regulators and stakeholders expect that gaming companies establish and maintain a system to effectively receive and deal with whistleblower complaints. Creating a process designed to properly receive and screen complaints, analyze claims, investigate and resolve any issues, report the results, and retain essential documents is the best way to handle whistleblower complaints.

Whistleblowers

The first step to establishing an effective whistleblower complaint handling system is to identify possible users and understand their needs. Employees, management and directors of the gaming operation are all potential users.These individuals can be the whistleblowers or the targets of complaints. In addition, customers, vendors, suppliers and investors from outside the gaming company also may generate complaints. Once potential users are identified, understanding each user group’s unique, and often disparate, needs is critical.To do this, management should determine user awareness of any existing complaint handling process. Knowing how and when the process has been used in the past, or may be used in the future, is important. For example, users may be most comfortable reporting suspicions directly to supervisors, through telephone hotlines or via e-mail. In general, user preferences relate to a choice of methods to report problems, a need for confidentiality and anonymity, ease of use or convenience, and a desire to access information on the progress of a complaint.The whistleblower complaint handling system will not be fully functional if users perceive barriers to its use or if it fails to effectively meet their perceived needs. A busy tip hotline, a breach of confidentiality or an unanswered e-mail can cause the process to fail. Therefore, potential obstacles should be identified and removed.

Receiving a Complaint

The act of receiving a complaint may seem like a simple task.You listen to a problem and do something about it. Receiving a whistleblower complaint, however, is more complicated.To ensure all complaints are captured and reported to the appropriate level of management, a standardized method should exist for employees to accept and document concerns.This requires that employees be trained to accept and document claims. Each complaint, whether spoken or written, should be documented, reported and tracked to ensure proper and timely resolution. Information that is critical to understanding and investigating a complaint, like documents and files, should be obtained from whistleblowers and secured — a step that can save valuable time, costs and effort later on in an investigation. If the whistleblower is an employee, a promise of anonymity must be honored, as required by federal and state laws.

Investigative Analysis

After accepting a complaint, gaming companies face the challenge of determining whether to pursue a specific matter based on available facts, making it imperative that complaints are screened properly. Frivolous complaints are common, and disgruntled employees may use the whistleblower process to vent frustrations or sabotage management.Others may use it to make harmless suggestions to improve company operations.Therefore, company officials need a process to screen complaints, sorting out red herrings and false positives from substantive concerns. In other words, gaming companies need a reliable way to separate real issues requiring urgent responses from those that can be safely ignored or classified as lower priority. One method sorts complaints into classes based on two criteria: sensitivity and materiality. Sensitivity rates claims on the basis that, if disclosed, they may cause significant harm to the company.They might include allegations involving senior ranking officials and violations of gaming or other laws.Materiality relates to matters that have the potential to significantly affect financial statements, regulatory filings, restrictive covenants or incentive-based compensation. Both require an analysis of qualitative factors, such as potential adverse consequences, and quantitative factors, such as dollar amounts.

Conducting the Investigation

How a whistleblower complaint is investigated depends on its sensitivity and materiality. Specifically, the attributes of the complaint determine which groups within and outside the gaming operation will need to be involved. For publicly owned gaming companies, federal law requires that matters directly concerning financial reporting and internal accounting controls fall under the responsibility of the audit committee. If a complaint is neither sensitive nor material, the compliance officer, a disinterested member of management or the internal audit group can conduct the investigation. Depending on the situation, gaming companies may engage independent advisors to avoid any appearance of a conflict of interest or to supplement internal resources with specialty skills. For example, whistleblower investigations often require the use of forensic accountants, specialized legal counsel and credit advisors. Identifying, qualifying and contracting for expertise should be done in the planning phase of the whistleblower complaint handling process — before an actual whistleblower event occurs — to ensure that resources are available when needed and at a reasonable cost. Before beginning an investigation, the company should set a clear definition of success and an understanding of the time and resources needed to achieve it. Success may include prosecution of a suspected criminal, recovery of lost assets, preparing a proof of claim under insurance coverage, or the strengthening of a weak internalcontrol system. Such objectives should be shared with the investigation team and used to measure progress and issue resolution.

Gaming companies should also evaluate the impact of the investigation on key stakeholders inside and outside the organization.The whistleblower will want to know what is happening with the complaint, and implicated individuals will need information to defend themselves.Others, such as regulators, investors, external auditors and lenders, also may have a stake. External auditors may even want to shadow the company’s investigation. All will want to know the possible effects the investigation will have on their interests.Of course, an investigation never goes exactly as planned, so consideration of possible adverse consequences, such as counterclaims and regulatory inquiries, is important. A complete and comprehensive investigation will consist of all necessary procedures and actions to provide for the discovery, location and recovery of sufficient facts to reach an accurate and defensible conclusion.This will often require the use of forensic specialists to identify, analyze and preserve evidence, particularly in connection with mass quantities of electronic data prevalent in gaming operations. In connection with this, the investigation team must determine who should receive sensitive information as it becomes available.There should be a plan to handle information leaks and rumors that will inevitably occur during the course of the investigation. In certain cases, public and investor relations personnel may assist in the design and delivery of an effective communication plan. In any case, it is prudent to request the assistance of legal counsel to most appropriately manage the timing and delivery of information and disclosures.

Issue Resolution

The resolution of a complaint may only affect a narrow segment of the company, as in the case of the correction of a single invoice or expense report. Alternatively, a corrective action (e.g., terminating a senior executive for cheating or restating previously issued financial statements) could be pervasive and far-reaching. In either case, preparing and adopting a formal corrective action plan is helpful. A corrective action plan sets out the matters to be addressed, the measurements to be used to determine success, the procedures to

be performed, and actions to be taken to resolve a complaint. The investigation team, management, the board of directors or outside advisors may prepare the corrective action plan. In most cases, combined efforts of all these groups, along with input solicited from the outside auditors, legal counsel and potentially regulators, contribute to the plan.The highest level of oversight at the gaming company (usually the board of directors) should approve and adopt the plan. Before finalizing a corrective action plan, the directors normally will consult with management and external advisors to adequately consider company resource requirements and costs, and to address practical limitations. The corrective action plan should be monitored after implementation to ensure each matter is completed and satisfactorily closed. Any material changes to the plan should be reported, reviewed and approved by the board of directors. In somecases, the plan will call for action to be taken before an investigation is complete. For example,weak or compromised internal controls require immediate attention and remediation. Such actions should be documented and reported.

Reporting

Every action related to an investigation will create curiosity. Interested parties may carefully monitor each step. Suspects may want their innocence to be communicated quickly.Guilty parties must be dealt with promptly and appropriately.The gaming company’s responsiveness shows that it takes complaints seriously and is prepared to deal with them.Therefore, thoughtful communication and reporting protocols are critical. Investigation communication protocols must honor privacy, confidentiality and, as appropriate, anonymity.They also should provide a reasonable level of information to interested parties both inside and outside the company.Management, directors, investors and employees require different treatment than regulators, auditors, creditors and the press.Gaming regulators may require that detailed reports of the investigation be maintained and subject to review and audit. Whistleblowers may expect reports on the status of their claims.Therefore, the preparation of a good communication protocol may require the assistance of legal counsel, public relations professionals and others to avoid liability for improper or incomplete disclosures. In addition, to protect privacy, anonymity and confidentiality, any materials collected as part of the investigation must be strictly controlled and secured. A well-documented chain of custody should be prepared and maintained, and the distribution and use of documents and reports should be restricted. However, the company should have a system to capture experiences from handling complaints to avoid future problems or to identify best practices.

Retention

Materials, data and reports produced during an investigation are evidence to be preserved, safeguarded and retained according to company document retention policies and gaming laws and regulations. Once again, to protect sensitive information and the identities of certain parties, care must be taken to limit access to hard copy documents, and to store and secure electronic data and information.This material also serves as a record of the gaming company’s compliance with internal policies and procedures and federal and state control requirements.

Overview

Gaming companies must have programs in place to ensure that concerns about gaming compliance are discovered and properly investigated in a timely and complete manner. Such programs are expected to include an effective whistleblower complaint handling system.This requires a thorough assessment of the organization and a careful consideration of key stakeholders to develop appropriate procedures and to ensure appropriate resources are in place to respond to complaints should an investigation be required.Most importantly, gaming companies must create an environment of trust among those who may use the system, ensuring confidentiality and anonymity as necessary. Ultimately, by doing this, the company can demonstrate compliance with regulatory expectations and organizational objectives to protect its valuable gaming license.

Click here to view a PDF of original article