Someone on Your Campus Reported a Concern Today.

Do you know what happened next?

Not in theory. Not according to your policy. Actually — what happened? Who received it? Did they acknowledge it? Does the person who reported it know their concern was heard? Do they have any sense of what, if anything, is being done?

If you can't answer those questions with confidence, you have a gap in your compliance program. And it may be the most consequential gap you have.

We spend enormous energy on the front end of reporting. We build hotlines. We adopt anti-retaliation policies. We train employees on how and when to report. We put the reporting number on posters in break rooms and footers of emails and compliance awareness week flyers.

All of that matters. None of it matters as much as what happens after someone actually uses it.

Because the way an institution responds to the first report shapes every report that follows.

If someone reports a concern and hears nothing — no acknowledgment, no update, no sense that anything happened — they will not report again. They will tell their colleagues what happened. And their colleagues will not report either. The culture you have spent years trying to build, the trust you have tried to earn, the hotline you paid for — all of it erodes in the silence after a single report that went nowhere anyone could see.

Here's what most institutions actually have:

A mechanism for receiving reports. A policy that says what should happen. And somewhere between those two things, a gap that nobody has fully mapped.

The gap has a few common shapes.

Nobody owns the inbox.

Reports come in through a hotline, or an email address, or a web form, or a supervisor, or directly to HR or the Title IX Coordinator or the compliance office. Each pathway has someone who technically receives it. But is there a person — one person — who knows about every report that comes in through any channel? Who has a complete picture? Who can see when two separate reports are describing the same pattern, or when the same person has been reported multiple times through different pathways?

At most institutions, the answer is no. Reports exist in silos. The hotline vendor sends a report to one inbox. The HR grievance goes to another. The Title IX concern goes to the coordinator. Nobody is connecting the dots.

Triage is informal or nonexistent.

Not every concern requires a formal investigation. Some need a conversation. Some need a policy clarification. Some need to be routed to a different office entirely. Some are urgent. Some are not.

But if there's no documented triage process — no criteria for how concerns are classified, no defined timeframe for initial review, no decision about who makes the routing call — then triage is happening based on whoever happens to be available and whatever they feel like doing. That's not a process. That's improvisation. And improvisation under pressure, in situations that may have legal implications, is how institutions make expensive mistakes.

The reporter disappears from the picture.

This is the one that bothers me most.

Someone worked up the courage to report a concern. That is not a small thing. For many people — particularly in institutions where power dynamics are real and retaliation is a genuine fear, even where policy prohibits it — making a report is an act of trust. They are trusting that the institution will take them seriously. That something will happen. That they will not be worse off for having spoken up.

And then they hear nothing.

I understand why institutions default to silence. Investigations are confidential. Employment actions cannot be disclosed. There are good legal reasons why you cannot send a reporter a detailed account of what happened to the person they reported.

But here's what many institutions don't realize: with most hotline platforms available today, you can respond directly to an anonymous reporter without ever learning who they are. The reporter receives a message through the same anonymous channel they used to submit the concern. The anonymity is preserved on both sides. There is no excuse — not confidentiality, not anonymity — for complete silence.

There is a significant difference between "we cannot tell you everything" and "we cannot tell you anything." At a minimum, a reporter deserves to know that their concern was received. That it was reviewed. That it was taken seriously. That the institution responded — even if the details of that response cannot be shared. And if they reported anonymously through a hotline, they should still be able to hear that much — because the technology exists to tell them.

That acknowledgment costs nothing. Its absence costs everything.

The process becomes the obstacle.

This one is subtler but just as damaging.

Someone reports a concern. They hear back — which is good. But what they hear is: please fill out this form to officially request an investigation. And also, the office that received your report only handles part of what you described, so you'll need to separately contact this other office for that piece. And that office will need you to schedule an intake meeting before they can proceed.

Every additional step after the initial report is a message. It may not be the intended message — but it is received clearly: this is going to be hard. This is going to take a long time. You are going to have to keep doing things to keep this moving. And if at any point you stop, it will stop.

Some people will keep going. Many will not.

The institution's reporting process should do the work of connecting the pieces — not require the reporter to navigate the org chart on their own. If a concern touches multiple offices, those offices should coordinate with each other. The reporter made one report. They should not have to make five.

What a good intake and response process actually looks like:

Acknowledgment is automatic and prompt. Within 24 to 48 hours of a report coming in through any channel, the reporter receives confirmation that their concern was received and is being reviewed. This applies to anonymous reporters too — most hotline platforms today allow institutions to respond through the same anonymous channel without learning the reporter's identity. There is no longer a technical reason for silence. This is not a substantive response. It is a human one.

Someone owns the picture. One person or function has visibility into all reports coming in through all channels. Not to override other processes — Human Resources still handles employment matters through their established procedures — but to see patterns, identify urgency, and ensure nothing falls through a gap between offices.

Triage is documented. For every concern that comes in: what is it? Who is responsible for reviewing it? What is the timeframe for initial assessment? What is the decision — investigate, route elsewhere, resolve informally, close with no action? Who made that decision and when?

Reporters receive appropriate follow-up. Not a detailed account of what happened. But something. "Your concern has been reviewed and addressed" is not much. It is infinitely more than silence.

The institution does the coordination, not the reporter. If a concern touches multiple offices — compliance, Human Resources, Title IX, General Counsel — those offices communicate with each other. The reporter is not handed a map of the institution's internal structure and told to find their way. One point of contact acknowledges the report, coordinates across offices as needed, and keeps the reporter informed. One report. One relationship.

Trends go somewhere. Aggregated, anonymized data about reporting volume, type, and disposition goes to the Compliance Committee and eventually to the Board. Not to expose individuals — to see patterns. If the same concern keeps surfacing from the same area, that is information the institution needs to act on.

Here is the question I'd encourage you to sit with:

If someone at your institution reported a concern tomorrow — through whatever channel they used, about whatever issue they were worried about — could you trace exactly what would happen? Could you show me the person who would receive it, the criteria they would use to assess it, the timeframe they would work within, the decision they would make about what to do next, and the communication that would go back to the person who reported?

If yes: you have a process. Document it, train people on it, and review it regularly to make sure it's working.

If no: that's where I'd start. Not with a new hotline. Not with a new training module. With a piece of paper that maps what actually happens — step by step, from the moment a concern comes in to the moment it is resolved — and identifies every gap between what the policy says and what actually occurs.

The compliance program that catches problems and responds to them well is worth more — legally, reputationally, culturally — than any program that simply tries to prevent them.

Because prevention is not always possible. Response always is.

The person who reported a concern today is watching to see what your institution does with it. So, in a quieter way, is everyone who knows them.

Make sure the answer is worth watching.