Reporting An Issue On Campus: Here’s What Happens After You Contact ICO
On the job, you come across a compliance issue. Maybe it’s the way someone was addressed at the office, sensitive information was handled incorrectly or a situation that goes against university policy comes up.
You consider reaching out to the Integrity and Compliance Office, but are unsure.
Will this start an investigation? What proof do I need? Will this be reported to my supervisor? Will my anonymity be protected?
Before reaching out, know that contacting ICO is simply starting a conversation. Here are a few things to know before making your decision.
Remember, you don’t need all the answers
Employees contact ICO for a variety of reasons. They can reach out to our office to clarify policies, discuss concerns or determine which office is best positioned to help with the matter at hand.
You don’t need to formally prove that misconduct occurred before reaching out. Conducting an investigation is our job, and you should not run your own investigation by interviewing coworkers, confronting someone or accessing records outside of your normal responsibilities.
Instead, start with what you know. Explain what you observed, when it happened and why it raised a concern. Be clear about the difference between what you witnessed and what someone else told you.
Through the ICO helpline, employees can choose to report anonymously. If you choose to report anonymously, it is important to include some contact information so we can follow up. The ICO cannot see or access that contact information but we can communicate via the CaseIQ system, which routes the communication appropriately without sharing the contact information with us.
Raising a concern is the initial step, and is not the same as reaching a conclusion.
What happens first?
When ICO receives a question or report, the first step is generally to understand the situation in its entirety.
ICO may consider:
- What happened
- Where and when it happened
- Who or what office may be involved
- Whether the issue is ongoing or a one-time offense
- Whether there is an immediate safety, legal or operational concern
- Which policies or university values may apply
- Whether ICO or another office should respond
Some questions can be answered through policy guidance or a referral. Others may require additional review. It’s important to remember that not every report becomes an investigation.
ICO may ask follow-up questions
Someone may contact you to clarify the information you shared. You may be asked what you directly observed, what documentation exists in regards to this case or anyone else that may have relevant information.
Follow-up questions do not mean that ICO doubts you or that a formal investigation has begun. They help determine the appropriate next step.
Your concern may be referred
VCU has different offices responsible for different types of concerns. Depending on the issue, ICO may coordinate with or refer the matter to another area such as Human Resources, Title IX, student conduct, research compliance, information security, public safety, procurement or another compliance partner.
A referral does not mean your concern was dismissed. It means the issue is being directed to the office with the appropriate authority or expertise.
You are not expected to know the correct office before reaching out, but we will work with you to ensure teh issue has been referred to the appropriate office.
What could happen next?
After reviewing the available information, ICO or another responsible office may:
- Provide policy guidance
- Ask for additional information
- Correct or clarify a process
- Refer the matter to another office
- Recommend education, coaching or stronger controls
- Conduct an audit, review or investigation
- Determine that the available information does not require further action
There are more possible outcomes than to simply “investigate” or “do nothing.” Compliance work is often preventive and educational. A question may identify a confusing process or risk that can be corrected before it becomes a larger problem.
Will everything remain confidential?
ICO handles sensitive information with care and discretion, but complete confidentiality is not always guaranteed.
Information may need to be shared with individuals who are responsible for assessing the concern, preserving records, protecting the university community or responding under policy or law.
Privacy and legal considerations may also limit what ICO can share with the person who raised the concern. A lack of detailed updates does not necessarily mean that the case is closed.
What about retaliation?
VCU values a workplace where employees can raise concerns in good faith and engage with ICO without retaliation.
If you believe you are experiencing retaliation after contacting ICO or participating in an inquiry, report that concern promptly. Do not assume the university already knows what is happening.
Start with what you know
You do not need to identify the correct policy, prepare a complete case file or know exactly which office should handle the issue. That’s our job.
Start with what you know, and let us work with you to resolve the issue from there. When in doubt, ask. You are not expected to navigate Integrity and Compliance concerns alone!