top of page
Search

Case Study: Multi-Site Employer Builds Continuous Misconduct Risk Monitoring

Jan 8
6 min read

Executive Summary

A multi-site private sector organization headquartered in Delaware kept discovering the same problems at the same sites, two and three years in a row. Each discovery followed the same script: an incident, an investigation, a corrective action plan, a quiet wind-down of attention, and then the same failure pattern surfacing again at a different location. Misconduct risk management ran on an incident-by-incident cadence, so nothing the organization learned ever accumulated into anything it could measure. Leadership had no way to tell a site that had genuinely improved from one that had simply gone quiet.

This case study shows how a multi-site employer can move from episodic response to continuous monitoring: a defined set of key risk indicators, scheduled control testing, leadership review on a fixed cadence, and corrective action tracking that keeps every finding open until it is verified closed.

Industry and Organizational Context

The organization operates facilities across several states with a shared corporate risk function and site-level leadership. Enterprise risk management guidance treats a risk-aware culture and proactive assessment as core disciplines, and the CDC's framework pairs a common risk language with integrated risk assessment and frequent risk monitoring and communication (CDC, 2020). COSO's thought paper on key risk indicators describes them as leading indicators that help management and the board continuously monitor emerging risk and improve the execution of strategy (COSO, 2011).

Cadence matters because averages hide variation. The MSPB found that organizations vary in how likely their employees are to experience harassment, and that averaging results across agencies can obscure substantial and important differences (MSPB, 2018). The same logic applies between sites of one employer. This organization had none of this measurement for misconduct. Its incident data was scattered across sites, its reviews were ad hoc, and its corrective actions closed on declaration rather than verification.

Identified Risk

The trigger was a repeat incident at a site that had completed a corrective action plan eighteen months earlier, with no evidence the plan's controls had ever been tested. Federal enforcement guidance turns on what an organization knew and whether it took prompt, effective corrective action (EEOC, 1999). A corrective action that is declared complete but never tested is neither demonstrably prompt nor demonstrably effective, and the paper trail showing a plan existed can sharpen exposure by showing the organization knew its controls were unverified.

Initial Vulnerabilities

Four gaps characterized the episodic system:

  • No defined indicators. The organization could not say what rising misconduct risk looked like until an incident had already occurred.

  • Untested controls. Corrective action plans closed on self-report from the responsible site, with no scheduled control testing and no evidence of performance. The EEOC Select Task Force recommends that employers periodically test their reporting systems to learn how well they work (EEOC Select Task Force, 2016).

  • No accumulation. Lessons from each site stayed local, so the same failure patterns recurred at locations that had never heard of them.

  • Cadence dependent on champions. Risk attention tracked the energy of individual leaders and faded when they moved on.

Psychological and Behavioral Considerations

Staff across sites described a familiar dynamic documented in national research: roughly three out of four people who experience harassment never talk to a supervisor, manager, or union representative about it, and the least common response is formal reporting (EEOC Select Task Force, 2016). That silence means raw incident counts are a poor indicator of organizational health. A site that reports nothing may be the safest site or the most afraid.

Continuous monitoring had to be designed around that ambiguity. It measures reporting confidence as an indicator in its own right, through climate surveys the Task Force recommends, and treats falling confidence alongside flat incident counts as a signal for closer review.

Criminal Justice and Accountability Considerations

The organization's accountability rests on demonstrated response, not intent. Enforcement guidance holds organizations to a standard of reasonable care to prevent and promptly correct misconduct (EEOC, 1999). Multi-site employers also carry knowledge that aggregates across sites: a pattern visible across locations is organizational knowledge even when no single site connects the dots.

Where conduct crosses into criminal territory such as image-based abuse or coercion, individual criminal exposure runs in parallel (Congressional Research Service, 2025). The employer's own duty is unchanged by where individual matters end up.

RMA's Proposed Intervention

Through its Risk Exposure Audit and enterprise risk integration advisory work, RMA would build four structures:

  1. A defined key risk indicator set for misconduct exposure, covering reporting volume and confidence, escalation timeliness, control test results, and repeat-incident patterns, consistent with established indicator practice (COSO, 2011).

  2. Scheduled control testing with verification-based closure. No corrective action closes until its control is tested and performs.

  3. A fixed leadership review cadence that puts the indicator set in front of executives and the board on the same schedule as financial and operational risk (CDC, 2020).

  4. Cross-site learning loops, so that findings, patterns, and fixes circulate between locations instead of dying in the site where they arose.

Innovative Methodology

RMA applies the PROTECT Framework (Policy Review, Risk Identification, Operational Gaps, Training and Culture, Employee Safeguards, Compliance Alignment, Threat Response Plan) together with the Risk Vulnerability Matrix (RVM): predictive risk mapping across sites, prioritization scoring, preventative action roadmaps, and key risk indicators monitored continuously rather than reviewed annually. Behavioral risk is read through observable conduct and organizational conditions, never personal profiles or protected characteristics.

Implementation Strategy

Rollout proceeds in phases: indicator definition and baseline measurement in months one and two, control testing design and the first test cycle in month three, the leadership dashboard and review cadence live in month four, and cross-site learning loops operating from month five. Indicator thresholds are reviewed and recalibrated after two full quarters of data.

Safeguards and Corrective Actions

Corrective actions remain tracked and time-bound, now with verification built into closure. The EEOC Select Task Force recommends discipline that is prompt, proportionate, and consistent across the organization (EEOC Select Task Force, 2016). The organization's contemporaneous record of knowledge, testing, and response becomes the backbone of its accountability posture (EEOC, 1999).

Measurement and Monitoring

The system itself is measured: indicator coverage, control test pass rates, on-time corrective action closure, cadence adherence, and movement in reporting confidence across sites. The quiet-site signature, falling confidence with flat reporting, is treated as a trigger for closer review.

Outcomes

In this case study, continuous monitoring produces earlier detection of deterioration, verified closure of corrective actions, and measurable gains in reporting confidence across sites within three quarters. The pattern they illustrate is consistent with published enterprise risk guidance: organizations that monitor leading indicators and review them on a fixed cadence are positioned to see emerging problems earlier than organizations that manage by incident (COSO, 2011; CDC, 2020).

Lessons for Leadership

  • An organization that only measures incidents is managing its misconduct risk in the past tense.

  • Controls that are never tested are assumptions, not safeguards.

  • Silence is ambiguous. Measure confidence as an indicator in its own right.

  • A pattern across sites is organizational knowledge, and knowledge triggers duty (EEOC, 1999).

  • Cadence must survive the departure of champions. Fix the review schedule, not the enthusiasm.

Recommendations for Similar Organizations

Multi-site employers should define a misconduct indicator set, schedule control testing with verified closure, and put behavioral risk on the leadership cadence alongside financial and operational risk. Start by listing every corrective action closed in the last two years and asking which ones have ever been tested.

How RMA Can Help

RMA supports multi-site employers through its Risk Exposure Audit and enterprise risk integration work, including RVM-based risk mapping, key risk indicator design, and leadership accountability structures. Learn more on the RMA solutions page and in about RMA.

Take the First Step

If your organization manages misconduct risk incident by incident, RMA can build the indicator set, control testing rhythm, and leadership review cadence that turn episodic response into continuous monitoring. Explore RMA's solutions to begin.

Related reading

Continue with these related RMA articles:

References

bottom of page