Matt Kelly:
Hello everyone and welcome to another episode of Coping through COVID. I'm your host, Matt Kelly, editor of Radical Compliance. This is a limited podcast series sponsored by NAVEX Global where we talk about corporate compliance and risk management challenges posed or amplified by the COVID-19 crisis. In each episode we take a deep dive into some specific risk or compliance issue and then we talk with a thought leader in that field, so compliance and risk professionals can get a better understanding of the challenges we're all facing right now and how to navigate them.
In today's episode, we are going to talk about investigations, something near and dear to every compliance professionals heart. They are a central part of what we all do, but how exactly can you conduct an effective investigation when COVID-19 has everybody essentially confined to quarters. To talk with us about that, I am joined by Jonathan Marks. Jonathan is a partner at audit and assurance firm, Baker Tilly, where he leads the forensics investigation and compliance practice. He is a veteran player in forensics and investigations and he writes about and speaks about this subject often. He even runs his own blog on these issues boredandfraud.com. Jonathan, welcome. Thank you for being with us today.
Jonathan Marks:
Thanks Matt.
Matt Kelly:
Let's begin by picking up on what I mentioned during the introduction. How much has COVID-19 turned investigations upside down? Because if you can't travel, if you can't conduct in person interviews, that sounds like a gut punch to good investigations practice to me. What are your first impressions about the challenges that are cropping up here?
Jonathan Marks:
It's something that... Obviously I was in the trenches when this all happened and conducting an investigation, across border investigation. So, it really did change the way we're approaching things from a bunch of different perspectives. We were in the middle of interviewing witnesses and the like and we were in the middle of collecting information. Obviously conducting an investigation, there's obviously questions that you have for people along the way. It really did force us to quickly pivot into a remote environment, which we took very seriously but did so literally on a dime. It really did change the whole focus of what we were doing from an investigatory perspective, not only from the conducting the interviews but also collecting the evidence.
Matt Kelly:
Well tell us more about what investigation teams can do right now, even under these circumstances. You had mentioned collection of evidence or could a team do some types of interviews by teleconference but not others? I guess, what things could investigators still do today that are productive and feasible and they make sense to keep plowing ahead?
Jonathan Marks:
Well, one of the things that we did was, we made sure from an interview perspective, and certainly you can not ideally conduct interviews via some type of software which we actually had to do. We were concerned about other things as well. For example, we were concerned about privacy laws and things of that nature and privilege. Those were the things that we discussed with council. I think it's really important when you pivot to doing remote investigations to make sure that those risks that were not there before, which are a result of the current situation, are vetted appropriately. One of the things that we were extremely concerned about was the other side recording the conversation. How do we ensure that the conversation is not being recorded and how did the other side know that we're not recording the conversation. Another thing that we we're cognizant about is obviously reading the Upjohn warnings and giving people the corporate Miranda's effectively and making sure that those blocking and tackling things were done appropriately as we went about the investigation. Especially from a cross border perspective, it makes things a little bit more complicated. Remote document collection like I mentioned before, was also an issue.
Matt Kelly:
Hold on. Let's talk about forensics and document review for a moment. Because if employees or interview targets, if they are working remotely, that does raise questions such as, what's the authenticity of the document they're providing and I'm looking at? So I'm curious, how does somebody figure out whether the document is authentic or would companies need to be thinking about document retention strategy, data management strategy to address these sorts of questions? How does an investigator think through these kinds of points and these risks?
Jonathan Marks:
I think it's a risk. Again I can tell you that it's come up in prior investigations where we've done this where you had no choice but to do things remotely. Now we're full bore into the remote environment. But from a document collection perspective, when fraudsters are concealing the bad behavior, there's a propensity to continue that or try to fool the investigators. So not providing complete information or falsifying information certainly does become a risk. I think those are the things that you really have to be cognizant of.
I'll give you an example. In rev rec matters, when you're looking at sales and sales practices and you're looking at particular documentation related to shipping and and those types of things, those things are easily manipulated with someone that can use some programs online to change things, where it does look authentic. Obviously getting the real documentation is first priority here, but there are risks associated with that for sure. One of the things we even talked about is the other party saying, well we'll scan that in and send it to you. Well who's scanning it in? Is somebody watching them scan it in? Is there a process around that? Very similar to when we collect electronically stored data, today one of the things that we're doing is we're logging on and sharing screens with the IT professionals that are able to pull that information down from their systems. We make sure that they're not changing the parameters and that we're actually collecting data cleanly and there's no manipulation of the data once it's exported and sent to us. Some of them are real risks regardless of whether an investigation is remote. But again, there has to be some heightened level of skepticism here when conducting a truly remote investigation.
Matt Kelly:
One question... I should've followed up with this earlier. You had mentioned fears that the other party might try to record an interview. How do you figure out what to do with that? Or did you figure out a solution at all?
Jonathan Marks:
Well one of the things that we have always done and we have to be very careful on protecting privilege and we work hand in glove with obviously legal counsel on this - what the show and what not to show. There's always the sense that when you're on a video conference that somebody quickly whips out their iPhone or other selected device and starts taking photos of the slides or photos of your screen. So one of the things that we did was we made very clear up front and actually had disclaimers before we actually began and made people acknowledge that they would not do this. Now we cannot prevent them from doing it because we do not see that happening. But we took all steps that we thought were appropriate in order to try to preserve and protect privilege and confidentiality in all respects when it comes to this.
How can you be certain? You can never be certain even from an in person interview. I remember one time conducting an interview with somebody in a garden variety asset misappropriation case. While we're conducting the interview, I heard a beep beep. I said, "Is that your phone?" They said, "No." I said, "Well what is that?" It didn't sound like a phone and they were actually recording the interview. You run that risk all the time. I think it's one of those things where you just have to be really careful of, and if you're savvy and you've done this a lot, it's just blocking and tackling. These things are not to be recorded. In some instances recording is permissible or videotaping is permissible.
But even nowadays, teleconference is in the cloud, a lot of times when you join a teleconference, those conferences are being recorded. Who's watching out for that? Does anybody ask when they get on the phone, "Is this being recorded?" A lot of times there's no... I don't know if you remember a long time ago when a line was being recorded, there was a beep every 10 or 15 seconds.
Matt Kelly:
Sure.
Jonathan Marks:
That doesn't exist, I don't think today anymore. Or it's something that could be turned on or turned off. Again, I think it's just about being really careful and cognizant that this can happen and to try to take all appropriate steps to make sure that you do protect and preserve the investigation as best you possibly can.
Matt Kelly:
What about the idea of putting an investigation on pause because you can't feasibly get it done? For example, I've heard of some instances in higher education where they're looking into sexual assault or academic misconduct or something like that. They've basically said, "We can't do this because the parties aren't available, so we will continue it sometime later when we can." What are your thoughts about that idea of putting an investigation on pause until further notice?
Jonathan Marks:
I think there's two things that need to be considered, especially in an environment like we're dealing with today, which is really unprecedented. What's important as compared to what's urgent. When you triage an allegation and the allegation has some teeth to it and an investigation ensues, there are some things that are more important than others. Now you don't want to have investigations linger. I think one of the great things about NAVEX Global is they do that study every year and they do track that, the time to complete an investigation. One of the things I think if I read it correctly, was there was a little bit of an uptick this year with regards to the number of days it takes to close certain investigations.
You don't want that pull to keep building up. It becomes problematic. What happens is, when things start to build up, you tend to shortcut things. We've seen it happen in financial institutions when banks do look backs and the like and they're trying to catch up. Anytime you're trying to catch up, there's always the propensity to shortcut things. So I think anybody out there that's conducting an investigation today, it's imperative if you have an allegation review board or something very similar to that, is to take a look at the pool of those allegations that are there, how they're classified, the ones that are subject to regulatory scrutiny. For example, those that would be an SCC or DOJ type or an OCC or any of the three letter organization investigations that do have timelines on them. I think those should obviously rise to the level of the top.
I don't recommend pausing or putting things on hold. What I recommend is looking at those and marshaling them out accordingly, but actually keeping the pipeline moving even if it's a little bit slower, but really focusing on the ones that are urgent that could have what I call the best of company type of things where reputation can be harmed. I mean that to be very, very, sincere about that because if those things are not done and it's just a haphazard approach, I think that's where companies can get themselves in trouble. It's really easy to use a situation like we have today in a crisis to pause things and say, "Hey we'll get through it." I think that's a bad, bad thing to do.
Matt Kelly:
One last question about investigation techniques specifically. Because I've heard you talk about this before, that the success of an investigation interview really is that you're there, physically. You're looking at the target in the eye when it is time to go in for the kill. So how can we do that if we're not there, if we can't directly eyeball the person to see if they're getting squirrelly or something like that. What's your advice about how to get through that final phase today given the circumstances that we face?
Jonathan Marks:
I'll give some folks some advice. I mean we're trained on this obviously and we continue to be trained on these things on a regular and ongoing basis. I think it's a great point.
One of the things is, as you well know, when you log on to a video conference with folks and those that haven't you'll appreciate this at some point. People tend to focus completely and totally on their face. I think one of the things that you could certainly do is to make sure that you have the right angle and the right view of the individual that you're interviewing so that you can actually see their hands. You can actually see them as you were sitting there from that perspective. We've become very accustomed to looking for certain behaviors, body language, tapping the feet, hand movements to the face, certain facial gestures, things of that nature. It's the same exact thing.
When you're conducting those types of interviews, the ones that we just went through, I paid more attention -- I had one of my colleagues asking the questions -- and I paid more attention to the physical presence of the individual and how they were answering the questions, the intonation of their voice, the gestures that they were making or not making, their whole face and their whole body. We've asked the other side to adjust their camera accordingly so we could see them appropriately. Hopefully most people will comply. Some don't and sometimes you're limited based on technology. So I think you need to be prepared for that. There are better tools out there today to do this. One of the things I also suggest is, if people don't have that type of equipment, have it ready to go to send to the interviewees in a package. Have a kit ready to go where there is a webcam, or something that's easily connected, that has the right fields of view and the right level of quality that you can actually see the individual as best you possibly can as if you were right in front of them.
Again, as you say and as I always say, it's better to be right in front of them, watching them, and making sure, but there are tactics and strategies here. And again, you cannot shortcut this. Like I said in our interviews we had somebody asking the questions and I specifically was watching for tone and other indications that somebody could be deceiving us.
It's a great question and I think it's one of those things where if you're not highly skilled and highly trained, it's easily missed. I think that if you truly are a bad actor on the other side, it's one of those things where you can use to your advantage in order to help conceal whatever the behavior might be.
Matt Kelly:
Okay. Then last question, do you have any sense of whether regulators will be more accommodating or patient about all this too? Because after all, they haven't been through a pandemic before either. They're pretty much in the same boat as the rest of us, trying to figure out on the fly what will actually work. So will their expectations for corporate investigations perhaps change given our present circumstances? Do you have any thoughts on that?
Jonathan Marks:
I do. I think there'll be, certainly, some wiggle room there, but I would not count on it. Like I said before, if you're triaging an allegation or you have a whistleblower complaint and it's one of those things where stage five is an independent outside investigation and it's something that you're working with outside legal counsel on, I would make sure that you move through that investigation with the same cadence that you normally would, regardless of whether it's being done remote or not. I would make sure that you execute on all the things that we talked about previously in our discussion today.
If they do give you some flex, I think it's some flex with regards to maybe there's a hiccup that goes along the way. So I would make sure that there's good communication with them and if there are circumstances where there needs to be I guess some leniency as a result of things not being as fluid as you would like them to be in order to make deadlines and deliverables, that those conversations happen at the time that you determine that this investigation needs to turn remotely. I think that's the time to start thinking about, can we meet this deadline? What are the obstacles and hurdles? What are the rate limiting steps? We need to get in front of those people and let them know that we can't do this in 60 days and here's why. Or, we can't meet your deadline and here's why. Get those conversations done right up front. Don't wait for the back end of this thing and hope and pray that someone will be compassionate about you dealing with a crisis. We deal with crisis these all the time. I think there's some level of expectation by the regulators that we're dealing this and we're doing the best we possibly can. But I do think there's also an expectation of continuing communication and cooperation with them.
Matt Kelly:
All right. Well Jonathan, that's all the time we have today, but you covered a lot of ground and gave us a lot to think about. So thank you very much for your time.
Jonathan Marks:
You're very welcome, Matt. Thanks for having me today.
Matt Kelly:
Again everybody, that was Jonathan Marks, leader of the fraud and forensics investigation and compliance practice at Baker Tilly. He joined us today to talk about how to conduct or manage investigations during the COVID-19 crisis.
If you have an idea of what you'd like this podcast to explore, do let us know. You can drop me an email anytime at mkelly@radicalcompliance.com. We'd love to hear your thoughts. That's all for this episode of Coping through COVID. I'm Matt Kelly, editor of Radical Compliance. Thank you all for listening. Thanks to NAVEX Global for sponsoring this series and I hope you'll join us again next time.