In 2015, Heron discovered it was invested in private prison companies and subsequently divested. Here is the story, and the lessons we learned as a result.