How Best Practices in Triage Protocol
Can Boost Compliance and Reduce Risk
With: Tom Fox, “The Compliance Evangelist”

Today’s Presenter

Why the new (re) focus on case triage?

The Monaco Doctrine - 2022

• ABB enforcement action
• 2023 Corporate Enforcement Policy
• 2023 ECCP
• McDonald’s decision from Delaware
Court of Chancery
…and more…

Is your triage protocol doing enough?

• Part 1, Section D. Confidential Reporting Structure
and Investigation Process,
• Scoped Investigation by Qualified
Personnel [emphasis supplied],
• How does the company determine
which complaints or red flags merit
further investigation?
Evaluation of Corporate
Compliance Programs

It all begins with triage staging – M*A*S*H
1
2
3
4
5
Allegations that have a low threat level and do not suggest a breakdown of internal
controls.
More serious in nature, and often indicate some deficiency in the design of internal
controls.
Serious in nature, generally involve an override of internal controls, and thus are
at a minimum a serious deficiency.
Serious allegations that could have an impact on the completeness and accuracy of
the audited financial statements, and that could indicate a material weakness
in internal controls.
Serious allegations that involve one or more members of the senior management
team or are serious enough to damage the company’s reputation.

• These consist of allegations that have a low threat
level and do not suggest a breakdown of internal
controls.
• Triage determination must be made quickly
and efficiently; within 24 hours max.
• Document decision making!
• Can be investigated by triage decision maker
or managed by decision maker.
Stage 1 – low-level threat

• These allegations are more serious in nature, and
often indicate some deficiency in the design of
internal controls.
• Begin to separate the wheat from the chaff.
• Bring in independent audit/independent counsel.
Stage 2 – some deficiency in control design

• These allegations are serious in nature,
generally involve an override of internal controls,
and thus are at a minimum a serious deficiency.
• Effective triage can be important so you do not
face the dreaded “where else” question.
• Allows you should develop a logical plan with
the nexus to the facts.
• Critical that your initial triage is a
reasoned based decision.
Stage 3 – possible control override

• These are serious allegations that could have
an impact on the completeness and accuracy of
the audited financial statements, and that could
indicate a material weakness in internal controls.
• Through tactically scoping an allegation, it allows
you to move to the next step of developing a
reasonable investigation plan.
Stage 4 – indication of material weakness

• These are serious allegations that involve one or
more members of the senior management team
or are serious enough to damage the company’s
reputation.
• Help hold down costs.
• Aid in building credibility and trust with DOJ
during the pendency of an investigation.
Stage 5 – possible legal/regulatory violation

Who is responsible for triage?

…and who is the ultimate audience?
Senior management
Internal compliance committee
Regulator/DOJ
Shareholders
Trier of fact

• All reports made to government will be
turned over to defense counsel.
• Can you defend your triage protocol?
• Document Document Document!
The significance of “Coburn”

The role of a case management platform

• Document Document Document!
• Key repository for information during –
and after - an investigation.
• Determine if protocol is followed in real
time.
• Defend each step to regulators.
• The ultimate accountability.
• Analytics for greater insights =
continuous improvement, and
prevention.
Software supports triage protocol & teams

How to make the business case
1. Increased efficiency
Save significant
investigator time, and
provide faster case
resolution
2. Reduced risk
Reduce the chances
that errors will be
made, and help
demonstrate due
diligence to
mitigate legal costs
3. Better insights for
better decisions
Make data-driven
decisions to prevent
future incidents

• Proper triage protocols provide your organization
an initial understanding of what you may be facing.
• Use a consistent framework to quickly determine
the seriousness of the matter.
• Allocate an appropriate level of triage & investigation
resources.
• Document decision-making to support your
discussion with the DOJ if you must go that route.
• Meet requirements of 2023 ECCP.
• Use technology to reduce manual burden and
provide insights over time.
Takeaways: triage best practices

• Here are some resources to help you as you continue
to explore best practices in triage and case
management:
• White paper – Back to the Future: The Importance
of Triage and Investigative Protocol
• Webinar – Everything you Need to Get
E&C Investigations Right (According to the DOJ)
• Toolkit: Case management software buyers’ guide
Next steps: we’re here to help!
www.i-sight.com/resources

• Book an initial 30-minute personal consultation
• We’ll help you identify risks and scope ways to
improve your investigation process
• Let’s schedule a time to talk!
Talk to a case management expert
marketing@i-
sight.com

Q&A

Thank you!
Contact Tom Fox: tfox@foxlaw.com
www.compliancepodcastnetwork.net