Finance teams like things they can measure. A speak-up programme looks, at first glance, like a cost with no output: a licence, some training, a few people's time. I'd argue it belongs on the other side of the ledger.
The numbers we don't usually see
The ACFE's Occupational Fraud 2024: A Report to the Nations studied 1,921 cases in 138 countries. A typical organisation loses about 5% of its revenue to fraud each year. The median case cost $145,000 and ran for 12 months before anyone found it. Tips uncovered 43% of cases, more than three times any other method, and more than half of those tips came from employees.
The line that matters most to me: organisations without a hotline had a median loss of $200,000, twice that of organisations with one. A hotline doesn't stop fraud. It shortens how long fraud runs, and with fraud, time is money in the most literal sense.
The penalties are already on the books
- POSH Act 2013: an employer who doesn't set up an Internal Committee, or doesn't act on its findings, can be fined up to ₹50,000. Do it again and the fine can double, and a licence or registration can be cancelled.
- DPDP Act 2023: failing to take reasonable security safeguards for personal data can cost up to ₹250 crore. Speak-up reports are full of personal data, often the most sensitive kind.
- Companies Act 2013: in a listed company, the directors' responsibility statement says internal financial controls are in place and working (section 134(5)(e)). A vigil mechanism that exists only as a PDF is hard to sign off on.
None of these are distant risks. They are line items waiting to happen.
How I'd budget for it
Treat it like any other internal control, with three costs: the tool, the time of the people who handle cases, and the effort to set it up properly (policies, categories, the Internal Committee, training). The tool should be the smallest of the three. Case-handling time is where good tooling pays for itself: legal clocks, templates and letters mean fewer hours per case and fewer missed deadlines.
Then measure the return the way you would for any control: losses found earlier, penalties avoided, hours spent per case, and audit findings closed.
What to put in front of the Board
The Board doesn't need the stories. It needs one short, honest page each quarter: reports received and closed, time to acknowledge and to close, how many were substantiated, the main categories, and anything overdue. Counts only, no names. If that page is easy to produce, the programme is probably working. If someone has to build it by hand from emails, it probably isn't.
Silence looks free on the P&L. It isn't. It's just booked later, usually with interest.