How to Assess the Maturity (and Effectiveness) of Your Investigations Program

Case IQ recently introduced the “Workplace Investigations Maturity Model,” a tool we consider a must-have for any organizational compliance officer, HR leader, security manager or fraud investigator.

Our partner Meric Bloch created this handy assessment to help you objectively gauge how your own organization stacks up when it comes to managing internal cases and investigations. Maturity in this context speaks to the quality and resources of a program while measuring how defined and controlled your investigative processes are. A high maturity score is the goal; this indicates that your investigators document their work well, understand and follow standard procedures and are always working to improve those processes.

Case IQ recommends this tool as a way to help determine the long-term trajectory and performance of your program, along with its overall impact on positive business outcomes. It also offers helpful guidance on improving future performance in this important area.

Exactly which factors matter most when assessing your workplace investigations acumen? We suggest starting with the following questions.

Are procedural steps clearly defined, producing consistent results?

Predefined workflows create a more efficient, consistent process that benefits both individual investigators and the organization as a whole. Handling similar incidents in the same way not only saves time, but can also prevent wrongful employee lawsuits. A consistent workflow also eliminates system bottlenecks while reducing the risk of missed steps or missing information.

Modern case management software like Case IQ lets you configure the whole process to best meet your specific needs – everything from capturing incidents and complaints to creating report templates for fast, consistent documentation.

Is the process cumbersome? Are case delays common, or the exception?

According to a Case IQ poll, case managers spend nearly 2/3 of their time on cumbersome manual tasks, with 81% reporting this as the toughest part of the job. Unfortunately, the more time you spend on busy work, the less time there is for the real investigative work. This gives ongoing issues time to escalate. So streamlining cumbersome processes actually helps you do a better job protecting your employees and the organization at large.

A comprehensive case management solution also helps investigative teams keep all their work and case data in one centralized location, which can speed case resolution while making investigators’ jobs easier. If that solution also integrates easily with your current tech stack, so much the better.

How detailed and documented are the decision points around report intake, preliminary assessment and fact-gathering?

“You literally need to ‘kick the tires’ of any allegations or information so that you know the circumstances in front of you before you make decisions,” explains compliance expert Tom Fox. “You can achieve this through a robust triage process.” In other words, not every report or incident warrants a full-fledged, all-hands-on-deck investigation. So if you’re not triaging, you may be wasting precious time.

Tom suggests categorizing incidents into one of five levels to best determine how to respond:
1. Low threat level: no evidence of breakdown of internal controls
2. Medium threat level: clear deficiency in one or more controls
3. High threat level: serious deficiency of control that requires an override to stop threat
4. High threat level: “could have an impact on the completeness and accuracy of the audited financial statements, and that could indicate a material weakness in internal controls”
5. High threat level: involves member of senior leadership and/or could damage organization’s reputation if not dealt with immediately; could result in regulatory penalties/fines or lawsuits

If you triage using this system, says Fox, “you will be able to respond more quickly and efficiently to any allegations that arise,” reducing resolution time. “Of course,” he notes, “as more information is developed during an investigation, the matter can be moved up or down this scale.”

Is the process automated at any or all suitable case management touch points?

Workplace investigations rarely exist within the bubble of a single department. There could be compliance elements to a safety case, such as needing to report to OSHA when an employee is injured on the job. Or security might need to be involved in an HR investigation, such as when an employee is harassing a coworker through digital means.
Having one shared case management system linking your entire organization can streamline your investigative processes significantly. By cross-linking cases with other departments, you’ll be better able to pinpoint specific trends and areas of risk that need to be addressed.

While this approach can help you resolve incidents more efficiently and effectively, it also requires an eye toward overall system security. Ease of data sharing is great for collaborating with other departments and external subject matter experts, but you don’t want to risk any case information falling into the wrong hands. Our recommendation: choose a system with role-based access to ensure that only those who truly need to see and update cases for their job are able to access these sensitive files.

Important Strategic Considerations

Case managers should consider these additional factors, which tend to be overlooked:

Is your case management approach proactive?

It’s not enough to simply react to incident reports and other potential concerns. A mature program is always looking for vulnerabilities that may enable future employee misconduct. Example: increasing reports of inappropriate conduct at company-sponsored events in certain locations can be analyzed to identify weaknesses in business controls. Any corrective steps can then be applied to other company locations as well, reducing the risk that similar problems may emerge elsewhere.

Are case investigators considering the entire organization?

The reporter and subject of a workplace investigation are not the only stakeholders. A mature case management process must consider the needs and perspectives of management, auditors, regulators and stockholders. To learn more, check out our webinar on how (and why) investigators can become strategic business advisors here.

Are case managers seeing the big picture?

A high-performing investigative case management team always considers the regulatory framework in which the company operates. Your particular framework might be mandatory, such as the Joint Commission’s standards for healthcare providers or the Equal Employment Opportunity Commission.

Or, it may be advisory, such as the US Department of Justice’s standards for the Evaluation of Corporate Compliance Programs. Either way, awareness of broader regulatory context is essential.

Ready to rate your own program maturity?

Evaluating your investigations program’s effectiveness is an important first step toward creating a safer work environment – something that benefits everyone throughout your organization. To learn more about assessing your program using a maturity model, watch Meric’s fireside chat on this timely topic here.