Internal Investigations for Nonprofits: A Means of Identifying and Addressing Misconduct Before the Regulators Come Calling
Cynthia Rowland: Welcome to EO Radio Show, Your Nonprofit Legal Resource, brought to you by the Exempt Organizations Group at Farella Braun + Martel. My name is Cynthia Roland and I'm a partner at Farella. I'm a business and tax lawyer with more than 30 years of experience advising clients on nonprofit and charity law.
The worst nightmare for most nonprofit board members is a complaint that sparks an investigation of misconduct at the organization. The ember may have been burning for some time before the board becomes aware of it, or may be a sudden wind-driven catastrophe that started with one person's bad or an inept act. No matter the source, how can the board best surround the organization with a defensible space? And once battling the heat of the disaster, what do we do?
In today's EO Radio Show, we'll discuss best practices in board policies that help to identify issues early, respond early, and minimize the toll of an investigation.
My guest today is Aviva Gilbert. Aviva is a partner at Farella Braun + Martel and co-chair of our White Collar Criminal Defense and Internal Corporate Investigations practice. Thank you Aviva for joining us today. Before we get into our conversation, I want to go over some of the types of misconduct that trigger these sorts of investigations and issues.
First, there's non-compliance with basic regulatory stuff like Internal Revenue Code and reporting obligations, state governance, and solicitation law missteps. Then there's probably more common, financial and fiscal misconduct, things like outright theft, embezzlement, accounting improprieties, and sometimes relationships with vendors that create problems.
Another big area that generates problems is employment practices. We all know about harassment claims, discrimination, claims, wrongful termination, and things like that. Our regulators and government investigators are particularly troubling. Those are often triggered by compliance reports, the Form 990 or the state form here in California known as the RRF-1. Sometimes this is triggered by simple failures to file that cause the regulator to start looking closely at the organization.
Disgruntled individual actors also trigger complaints at the regulators that can sometimes bring about an investigation. There's a website in California where disgruntled individuals can file a complaint quite easily. Just a few clicks on the webpage triggers an investigator to look into problems. And these individuals that can complain, it's not restricted to employees. It can include people who think they're beneficiaries of the charity, board members, members of the public, reporters. Anyone who wants to can file a complaint.
So internally, the kinds of reporters that we worry about are, of course, the whistleblowers; people who are aware of a problem and want to bring it to management's attention. Sometimes these whistleblowers are anonymous. Sometimes they're not anonymous, but it creates a swirl at the staff level and it may not even reach the board until it's been burning for quite some time.
So with that little bit of a background, I want to ask Aviva to join us and start out by introducing herself and telling us a little bit about her experience with investigations and her background in this kind of work. Hi Aviva.
Aviva Gilbert: Hi Cynthia. Thanks so much for having me. I'm happy to be here. I thought I would talk through building on what Cynthia just said, some of the different types of investigations and issues that I and my group have encountered in the past couple of years. They broadly fall into two categories. One is financial. We've done investigations into embezzlement, misuse of company credit cards, misuse of company assets, diversion of company or corporation assets, and various other types of financial misconduct, including misrepresenting financial information to the board. In that kind of scenario, the person at issue would be an executive or a director within the organization.
The other broad bucket is personal conduct. That can be harassment of the type that, Cynthia just noted. But there are also other types of hostile work environment-type claims that we've seen and had to investigate. Whether it's a conflict of interest type relationship we need to look into or even repeated comments made by a senior executive in the organization that were perceived as problematic by some stakeholder or employee.
Those are the two broad categories of investigation that we've done. And those investigations happen at large organizations. They happen at small organizations. I'm about to finish one for a publicly traded company. I did one for a private entity a couple of months ago and a number of investigations for nonprofit organizations, including organizations in the higher education space where allegations have risen to the board of trustees level.
Cynthia Rowland: Do you see any significant differences when you're working with a nonprofit organization as compared to the for-profit entities or does it just kind of unfold in the same way?
Aviva Gilbert: It's a really good question. And fundamentally, there can be bad behavior anywhere. Whether that's interpersonal or financial misconduct or allegations of misconduct, there's nothing inherently unique about a nonprofit organization that insulates it from the type of bad behavior that a board member or a trustee is obligated to investigate or to find a counsel to investigate.
I think the difference that one often sees or that I've seen at nonprofit organizations is there may be fewer resources directed at compliance and internal controls. Certainly, in a publicly traded corporation, the regulatory regimen and the existence of shareholders are going to create different kinds of pressures and more significant investment in compliance and internal controls around how resources or money are governed or moved around.
So that's what I would say is the biggest difference, but fundamentally there's no structural difference that the president of a university could mislead the board just as a CEO of a private for-profit company could mislead the board. And same thing for interpersonal interactions that you read about in the paper that we often find ourselves investigating.
Cynthia Rowland: So that's really interesting. That reminds me, not all of our listeners are in California, but the California AG's office does require that on the annual report form, which I mentioned earlier, the RRF-1, a California charity that's registered is required to report if there have been any bad actions, any financial improprieties on that form, which comes as a surprise to many small organizations.
Because for many small for-profit companies, embezzlement or fraud, or that sort of impropriety, sometimes nobody wants to know. It's like it is what it is. Let's move on. But in a nonprofit that's registered in California, they're required to tell the AG about the impropriety and what investigation they've done. That comes as a surprise a lot of times.
Aviva Gilbert: Interesting. Is that any kind of impropriety or is it limited to financial? What if their allegations are of harassment or something like that?
Cynthia Rowland: The particular question on the RRF-1 form is financial improprieties. And we'll add that as a link in the show notes, the RRF-1 form. That's a terribly named form. It comes across, it's very garbled. But anyway, I'll put a link to that in the show notes and the instructions are specific to what's required to be reported. So that's one little difference.
Aviva, can you give us some tips on how board members and senior staff can be taught or coached in advance so they aren't blindsided when one of these investigations comes up?
Aviva Gilbert: That's another good question. The fundamental point here is if you see something, say something. And habituating board members to really have open eyes and open ears to any type of allegation. It may be that it doesn't need investigating. But making good compliance hygiene and paying attention to any whiff of misconduct a part of board conversation, board training when a new board member or new trustee joins an organization, having a specific session dedicated to the importance of recognizing and taking seriously a complaint.
Whether it's a whistleblower or some other type of complaint, that's important. We'll talk about best practices at the end of our session, but board members should be trained on and knowledgeable about the company's reporting mechanisms. The company's internal controls, particularly as they relate to money, moving money, or other significant resources that the organization might be managing.
So a board member, if asked, should be able to say, "Before material dollar amount moves out of our accounts, this is who looks at it. This is who approves that kind of transfer." And just becoming facile with how the entity manages its resources is the best thing that a board member can do, as well as paying attention and putting the question to leadership of any complaints that have been raised.
It's very simple to not ask that question and just assume that an executive will or the director will come to the board when something comes up, but that doesn't always happen. There's often a habit of trying to manage things internally before they get to the board level. It's incumbent on board members to make sure that they're asking the right questions. And I think that's a good way to surface issues before they become bigger problems.
Cynthia Rowland: So this really goes back to our analogy of defensible space, having the board members trained and sensitive to the organization's practices and the way things happen on a day-to-day basis. So let's go back to that, some best practices.
And in addition to board education, what other sorts of policies, practices, and procedures help an organization, and I think this is nonprofit or for-profit, to create this defensible space and to have an organization that's prepared when an investigation comes up? What are your thoughts on that?
Aviva Gilbert: Sure. I've mentioned internal controls a few times in our discussion and making sure that the board not only is educated on the organization's internal controls, particularly around resources and money, but also that those internal controls are being audited, is more formal a word than I would normally use, but evaluated on a regular basis. Are the right people having to sign checks and oversee movement of resources and money? Making sure that just because those were looked at five years ago doesn't mean they don't need another look today. And the board should be at least on a yearly basis taking a look at those controls and making sure that they're comfortable with how things are done.
Another important thing that a lot of organizations don't put together until it's a little bit too late is a whistleblower policy and a formal way that stakeholders can memorialize their complaints or raise issues or concerns. A lot of organizations have this via a web form. More traditionally, there was a whistleblower phone number and these are usually relatively inexpensive third-party vendors that will run it and protect the identity of a complainant if that's something that the complainant wants. But making sure that there's a policy and that policy includes non-retaliation really makes it easy for somebody to raise concerns. That's really what we want. We don't want there to be a number of hurdles that somebody who notices some kind of misconduct or has a concern has to jump through to raise it to the board or to management.
Another type of policy that's important to make sure is in place is a conflict of interest policy and being very clear on what constitutes a conflict of interest. And the flip side of that is making sure that executives and board members are both required to disclose any potential or actual conflicts of interest in making sure that, again, is refreshed and updated on a yearly or biyearly basis. That's something we've seen a few times where an executive filled out a form indicating some potential conflict of interest five years ago when they joined the organization, but things have grown or issues have changed since then, their interests have changed and that needs to be refreshed, I would recommend, on a yearly basis.
And then another key area that the board may traditionally not be in the weeds on is document retention. That includes email, but other types of documents as well. Making sure that the organization has a defensible retention practice. So if things get deleted after two months, that's going to make it very difficult for issues to be investigated properly if they come up. I read recently that the average ember as you called it, the average issue might be kind of percolating within an organization for over a year before it elevates to the senior executive or to the board level.
So making sure that the relevant information is not going to be deleted is something really important for the board to do in the context of when an issue comes up and an investigation has been done. It’s critical for the board to make sure that it's documented properly so that a regulator, or hopefully not, but a potential litigant if they're going to make an accusation that an issue came up and the board didn't take it seriously enough, we want to be able to show the board heard about it, this is what happened, this is who investigated it. It took X number of weeks. They interviewed Y number of people. And making sure that it is documented contemporaneously with when it's happening so that if later there are concerns or any other questions asked that the board has created a paper trail showing how seriously it took the allegations.
Cynthia Rowland: Those three last things that you just talked about, the whistleblower, the conflict of interest policy, and the document retention policy, all three of those actually appear on the annual tax returns for nonprofit organizations. They're required to state whether they have those policies. And I've seen that sometimes that just becomes a routine check the box and the board doesn't really pay attention to it, but they're all very critical in the nonprofit context.
One area that's not mentioned on the 990 though, but I'm curious about your thoughts on the percentage of issues that arise out of employment practices, and the personnel handbook and employment policies. I know here in California, those handbooks need to be looked at just about every year because our state and local governments add on to that. So any thoughts about employment-related investigations that we haven't talked about yet that you want to bring top of mind?
Aviva Gilbert: You're exactly right that you can't open the newspaper today without reading about an executive or perhaps a board member at a for-profit or nonprofit organization who's been mired in some employment practice type of issue. So those are definitely, I would say, on the rise. I’ve seen a lot more of those in the last couple of years.
And the other thing to note is often these investigations can contain multiple issues. You learn about somebody who may be misusing an organizational asset and then in the course of interviews, you learn that they also have potentially been harassing someone or committing some other type of employment practice that is problematic. Just because I kind of siloed them in different categories of investigation doesn't mean there isn't a fair amount of overlap or investigations that contain both types of issues - financial and employment practices.
And that is another point that I wanted to bring up. Once the board determines that an investigation needs to occur because there's been some allegation, it's important to have an open mind regarding what might happen next. We've had a number of investigations where a whistleblower made some kind of allegation that was investigated and it turned out that it actually was not substantiated. There wasn't an issue there, but we learned about four other issues over the course of the investigation.
And that leads me to my last point, which is, I think it's important to view an internal investigation as good organizational hygiene. Sometimes it's really helpful to have an independent outside perspective on how things are going. Whether that is connected to a specific type of allegation of misconduct or a broader cultural inquiry. Board members would be wise to consider every few years, every so often having an investigator come and just evaluate how things are functioning.
Do executives have the confidence of the employees? Is there any department within the organization that people seem to think maybe isn't doing a great job? These are the types of issues that can be very helpful to evaluate with some regularity because that is a great way to avoid a bigger, more problematic allegation or situation down the road.
So I'd say another kind of best practice is to view an internal investigation not as a terrible thing, but as an opportunity to evaluate organizational health and culture. That's something we're seeing a little bit more of now. Organizations want to be a little bit more proactive and do an investigation.
Cynthia Rowland: Yeah, that's a really great point. And that makes me think that that would put the employees and the staff less on the defensive. That they're not concerned that, "Oh, there's an investigation? Who did something? I didn't hear about this. Maybe it's this, maybe it's that." But if it's a routine thing, or if it's messaged even if it's kind of more specific, but the investigation needs to be relayed to the staff as this isn't about anyone in particular, this is good corporate hygiene.
Maybe you get a greater willingness on the part of the staff to be open and less guarded in their responses. I know you and I could talk about this all day and we have. There's a webinar that we did. And again, it'll be linked in the show notes for those of you who want something like an hour of this conversation rather than 15 minutes, feel free to jump there. Aviva, any closing remarks? Anything top of mind that you want to leave the audience with?
Aviva Gilbert: Sure. I think one thing that we've done that hopefully will resonate with listeners is we often style inquiries as cultural investigations. We also find that staff and employees generally like being asked their opinion and what's going on and their experience. And from the board's perspective, building that kind of rapport and letting staff and employees know that the board is interested in how things are functioning I think is really valuable. I'm glad that there are a lot of organizations that are starting to do that.
Cynthia Rowland: Well, I think that's a great place to end our show today. I'm Cynthia Rowland and I'm with my colleague Aviva Gilbert, and you've been listening to EO Radio Show, Your Nonprofit Legal Resource, brought to you by the Exempt Organizations Group at Farella Braun + Martel.
If you have suggestions for topics you would like us to discuss, please email us at [email protected]. Thank you for joining us today. Until next time, make a difference.
Aviva J. Gilbert, Partner, Farella Braun + Martel
Additional episodes can be found at EORadioShowByFarella.com.