What an excellent compliance system and hotline look like, for businesses big and small

Every business has problems it does not know about yet. A supervisor who crosses the line. A safety shortcut that is going to hurt someone. A vendor kickback. Overtime that is not being paid. The question is not whether those problems exist. It is who hears about them first: you, or a government agency, a plaintiff’s lawyer, or the internet.

A good compliance system makes sure the answer is you, while the problem is still small. And at the center of nearly every good compliance system is a way for people to speak up safely: a reporting channel, or hotline, that people trust and that leads to action.

Why speaking up matters, by the numbers

• Tips find wrongdoing. In the Association of Certified Fraud Examiners’ 2024 global study of occupational fraud, tips were the most common way fraud was detected, in 43 percent of cases, far ahead of internal audit or management review. More than half of those tips came from employees.
• Retaliation is the most common charge. Retaliation has been the most frequently alleged basis in EEOC discrimination charges for years, cited in about 48 percent of charges in fiscal year 2024. How a company handles a complaint often matters as much as the complaint itself.
• The law rewards a real complaint process. Under the Supreme Court’s Faragher and Ellerth decisions, an employer facing certain supervisor harassment claims can defend itself by showing it had a reasonable way for employees to complain and acted promptly when they did. Texas law holds employers liable for sexual harassment if they knew or should have known and failed to take immediate and appropriate corrective action, and that rule covers employers with even one employee.
• Prosecutors ask about it. The U.S. Sentencing Guidelines list a reporting mechanism that allows anonymous or confidential reports, without fear of retaliation, as part of an effective compliance program, and the Department of Justice’s guidance for evaluating compliance programs, updated in 2024, asks whether a company has one, whether employees use it, and how it protects them.

What a compliance system actually is

A compliance system is not a binder. The Sentencing Guidelines describe the core elements of an effective program, and they scale from a five-person shop to a public company. The guidelines expressly allow smaller organizations to use less formal methods, but the elements are the same:

1. Standards. A short, readable code of conduct and the policies behind it: harassment, discrimination, retaliation, conflicts of interest, safety, wage and hour, confidentiality, and fraud.
2. Ownership. Someone with authority who is responsible for the program, and leaders who visibly support it.
3. Care in who gets authority. Not putting people with a history of misconduct in positions of trust.
4. Training and communication. People know the rules, know how to raise a concern, and believe it is safe to do so. See workplace training done right.
5. Monitoring and reporting. Checking that the rules are followed, and a channel for people to report concerns, including anonymously.
6. Consistent enforcement. Incentives for doing the right thing and discipline for misconduct, applied the same way at every level. See discipline in an at-will state.
7. Response and improvement. When something goes wrong, investigate, fix it, and change the system so it does not happen again. See effective workplace investigations.

The hotline is element five, but it touches all of them. A reporting channel nobody trusts is a sign the rest of the system is not working either.

What makes a hotline excellent

People can reach it, any time, in more than one way

Problems do not happen during business hours, and people often decide to report late at night. An excellent hotline takes reports at any hour, by phone and in writing, in the languages the workforce speaks, and its number is on posters, in the handbook, and in onboarding, not buried in a policy no one reads.

It sits outside the chain of command

The most common reason employees do not report is that the obvious person to tell is part of the problem, or close to it. A good hotline is run independently of the managers being reported on, and it has written rules for what happens when a report names the owner, a senior executive, or the person who normally receives reports: those reports go around that person, not to them.

Anonymity is offered, and described honestly

People should be able to report without giving their name. But anonymity has limits, and an excellent hotline tells people what they are. Phone carriers keep their own records of calls. Email is not anonymous, because the sender’s address travels with the message. And in a small workplace, details like a shift, a location, or a specific conversation can make it possible to guess who reported. A trustworthy hotline does not promise “100 percent anonymous.” It promises not to record identifying details with an anonymous report, warns callers about details that could identify them, and follows through.

Reporters can follow up without identifying themselves

An anonymous reporter who never hears anything back assumes nothing happened. Giving each reporter a report number and a PIN lets them call back, add information, answer questions, and hear a status update, all without giving a name.

Every report is triaged, and urgent ones move fast

A threat of violence, a weapon, an active safety hazard, or a child at risk cannot wait for a weekly review. An excellent hotline tells callers to call 911 in an emergency, flags urgent reports for immediate attention, and has a written plan for duties that a report might trigger, such as the Texas duty to report suspected child abuse.

A qualified person reviews every report

Intake is the easy part. The value is in what happens next: someone who can recognize retaliation risk, a wage-and-hour exposure, a harassment complaint that requires immediate corrective action, or a report that needs an outside investigator, and who can advise the company on what to do.

Nobody gets punished for using it

A good-faith report is protected activity under many laws, including Title VII, the Texas Labor Code, and federal safety and whistleblower laws. The moment a report comes in, the company has a retaliation risk to manage: no sudden schedule changes, no cold shoulder, no hunting for the anonymous reporter. Managers need to know that, in writing.

It never discourages going to the government

A hotline is an additional option, not a gate. Scripts, policies, and confidentiality language must never suggest that employees have to use the hotline first, or cannot contact the EEOC, OSHA, the Texas Workforce Commission, the SEC, or law enforcement. The SEC has brought enforcement actions over agreements that impede people from reporting to it, and federal labor law protects employees’ right to discuss working conditions with each other. The safest practice is to say so plainly: using the hotline does not affect anyone’s right to contact a government agency.

It closes the loop

Reporters hear that their report was received and is being looked at. Leaders get regular summaries of what is being reported, with small numbers combined or suppressed so that counts do not identify anyone in a small workplace. The company tracks trends: one report about a location is a concern, five is a pattern.

The data is protected and separated

Reports contain some of the most sensitive information a company has. Each company’s reports should be stored separately, encrypted, with access limited to the people who need it, and every view, change, and export logged. Vendors that handle the data should be bound by business terms on confidentiality and retention.

Where hotlines fail

• Nobody knows it exists. A number in an old handbook is not a reporting channel.
• Reports go to the person accused, or to their friend in HR.
• Reports disappear. No acknowledgment, no follow-up, no visible change.
• “Anonymous” is not. Caller ID shows up in an email, or a manager sets out to figure out who called.
• Retaliation follows a report, and the next person who sees something says nothing.
• The language chills reporting, such as confidentiality rules that seem to forbid going to an agency.
• It is a box to check, not a system anyone owns.

Big company or small business

A small business does not need a compliance department. It needs the same core pieces, sized to fit: a short code of conduct and non-retaliation policy, a reporting channel outside the owner’s circle, a qualified person to review reports, and a plan for what happens next. A mid-sized company typically adds its own dedicated hotline number, regular trend reporting, and training for every manager. Public companies have additional, specific requirements: the Sarbanes-Oxley Act requires their audit committees to establish procedures for confidential, anonymous submission of accounting and auditing concerns, and those reports must reach the audit committee.

A compliance hotline run by your employment lawyer

Crawford Law offers a compliance hotline as a service available for setup for employer clients, set up on request as part of the firm’s legal services to the employer. Here is how it works once it is live, and where its limits are.

1. Employees call or write. Employees can call the hotline at any hour or send an email. A phone report is taken by an automated AI voice assistant that says up front that it is an AI. It explains that the line is run by Crawford Law, a law firm that represents the company, not the caller; that it cannot give the caller legal advice; that what the caller says may be shared with the company so it can look into the concern; and that anyone in immediate danger should hang up and call 911.
2. Named or anonymous, the caller’s choice. Anonymous callers are not asked for identifying information, and the report record does not store their phone number. Callers get a report number and PIN for follow-up. Email reports are not anonymous, and the firm says so.
3. A structured report. The assistant asks what happened, when, where, who was involved, whether a supervisor or leader is involved, whether there is evidence, and whether anyone is in danger, then reads back a summary for the caller to confirm. It does not give legal opinions, predict outcomes, or make promises.
4. An attorney reviews every report, on the response standard set out in the engagement letter, and urgent reports are flagged for immediate attention.
5. Escalation around the problem. Reports that involve the owner, a senior leader, or the company’s usual contact are routed to the alternate contacts the company designates in advance, not to the person involved.
6. Advice on what to do next. The firm advises the company on next steps: an investigation, interim measures, retaliation safeguards, and any reporting obligations.
7. Regular summaries of reports by category and status, de-identified and with small numbers combined.

Two tiers fit different businesses:

• Shared line. One firm-wide hotline number for small employers. Callers identify their employer with a short company code from the workplace poster. The line never reveals which companies use it.
• Dedicated line. A phone number used only by your company, on your own posters and handbook, for larger employers or those who want their own number.

What it is not

• It does not make a company “compliant” with any law, and it is not offered as a public company’s Sarbanes-Oxley audit committee channel.
• The firm represents the company, not the people who call. The firm will not represent a client’s employees against that client.
• Routing reports to counsel may help support attorney-client privilege or work-product protection for some later investigation material, but privilege depends on the facts and is never guaranteed. The facts reported are generally not privileged, and the company controls any privilege that exists.
• It does not replace any channel a regulator requires, or anyone’s right to go to a government agency.
• An AI takes the initial report at any hour; a lawyer is not on the line around the clock.

What the company does

• Adopts, or confirms, a written non-retaliation policy, and agrees not to try to identify anonymous reporters.
• Posts the hotline information where employees will see it, in handbooks and onboarding, and keeps it current.
• Designates alternate contacts for reports that involve leadership.
• Responds when the firm recommends action, and trains managers on what to do, and not do, after a report.

A note on technology and data

The hotline runs on commercial phone and AI voice services. Before any client’s hotline goes live, the firm puts in place business terms with those vendors covering confidentiality and data retention, and it uses AI the way Texas ethics guidance expects: as a tool supervised by a lawyer. Each client’s reports are stored separately, anonymous reports are kept free of the caller’s number, and access is limited and logged. Calls are disclosed as transcribed at the start of every call, because some callers may be in states that require everyone’s consent to recording.

Setting up and managing your compliance system

Crawford Law can do more than answer the phone. The firm can assess your current reporting and compliance practices, write or update your code of conduct, non-retaliation, and reporting policies, set up the hotline and the posters and handbook language that go with it, train managers and supervisors, review and triage every report, advise on investigations and remediation, and give leadership regular, de-identified summaries. It is part of the firm’s workplace practice and HR consulting.

Shared and dedicated options are designed to make this practical for small businesses as well as larger ones, and everything is quoted up front. See the compliance hotline page, or request a free call.