Which Whistleblowing Reporting Channels Should You Implement?

Member states must integrate the EU Whistleblowing Directive into national law by the 17th December 2021. This piece of legislation provides whistleblower protection for employees of private businesses and government agencies, as well as the staff of municipalities that serve more than 10,000 citizens, who report breaches of the law at work. One of the key provisions of the directive is the requirement to set up an internal system of whistleblowing reporting channels.

1. EU Whistleblowing Directive: The Reporting Channels

1.1 Internal Reporting Channels

All organisations with 50 or more employees must create safe, secure and confidential internal reporting channels that allow their staff members to report breaches of the law orally, in writing or both. This extends to workers across a company’s subsidiaries and affiliates, as well as to agents and suppliers of the business, where possible. 

1.2 External Reporting Channels

Certain third party organisations can serve as an external reporting channel in case whistleblowers do not feel comfortable reporting internally or they feel that their report has not been dealt with effectively. These organisations include trades unions, other employee representatives, an audit committee or any other body that gains the authority to accept reports. They must guarantee “independence, confidentiality, data protection and secrecy” in order to qualify. It is up to the individual member states to establish their own external reporting channels. 

1.3 Public Disclosure

These channels are typically media outlets and they should be used in cases where:

• the reporting person does not believe the follow up of their internal or external whistleblowing report addressed the wrongdoing; 
• they fear retaliation for using other reporting channels;
• they believe that internal or external reporting could lead to evidence being destroyed or hidden;
• they believe there is a danger to the public interest and they will be protected by the directive if they make a disclosure to the media. 

2. What Are the Employer’s Obligations?

• Employers are only responsible for implementing the internal reporting channels. External reporting and public disclosure occur outside of the organisation. This makes it important for organisations to ensure that their internal whistleblowing arrangements and channels provide the best possible service to potential reporting persons. 
• Organisations must allow employees to issue reports in good faith in writing, orally or both. 
• Internal reporting channels include allowing whistleblowers to bring attention to misconduct by post, using a physical complaints box for them to drop reports into, e-mail, an online reporting system such as IntegrityLog, a telephone hotline or other voice messaging solution. Additionally, whistleblowers can request a face-to-face meeting. 
• The organisation must task a dedicated and impartial person or department to handle the report. This stakeholder should be responsible for maintaining communication with the reporting person, including gathering evidence to help the investigation and relaying the outcomes of that investigation. 
• The employer must deal with the investigation in a secure and confidential manner. All identities must be withheld, including those of the reporting person, their colleagues who supported them and anyone accused of breaching the law. No other person other than the designated individual or department tasked with handling the report should be able to access the details of the case. 
• There should be a code of conduct in place to prevent discrimination or retaliation against the reporting person, their supporters and family. This includes dismissal, demotion, preventing promotion, harassment, disciplinary action and any other punishment for contacting the whistleblower hotline. There should also be sanctions in place for anyone flouting these rules.
• The organisation cannot limit the protection to employees alone. The guidelines say it also covers freelancers, suppliers, contractors, non-executive directors, shareholders, volunteers, interns, former staff and prospective employees who discovered wrongdoing in the process of applying for the job. 
• The reporting channel must be fully compliant with the General Data Protection Requirement (GDPR) regulations. 
• The designated person or department who accepts and handles the report must acknowledge receipt within seven days and should follow up providing feedback within three months. 

3. Considerations when Introducing Whistleblowing Channels

3.1 Tailor Your Channels to Your Culture

The idea is to make the process as simple and intuitive as possible to encourage anyone with knowledge of corruption or another lawbreaking to make their report internally. This means ensuring your reporting channels fit in with your corporate culture and ethics. If you use an intranet to conduct a large proportion of the internal communication, it would make sense for the reporting system to sit within that or to use a separate online reporting tool. If you already run a physical ‘suggestion box’ system, implementing a similar channel for reports remains within the comfort zone of your employees. 

3.2 Ensure Consistent Processes for All Reports

For employees to have any confidence in the reporting system, you need to make sure that all reports follow the same process. This is why the designated individual or department in charge of running the process should be independent and impartial. The key is to set in place a comprehensive whistleblowing policy in advance so that all report cases are submitted and handled in the same manner. 

3.3 Provide Multiple Ways for Employees to Report

The more options for reporting available, the more likely it is that a whistleblower will be able to find a method that suits them. When you limit the whistleblowing channels, you risk reporting persons taking their story to an external or public channel if they do not feel comfortable using the internal solutions. Attempt to offer at least one oral and one written method, if not multiple variations of each. 

3.4 Train And Engage Stakeholders

You need a ‘Speak Up’ culture in order to properly encourage whistleblowers. If employees have any reservations at all about how open to reporting your organisation is, it could dissuade them from making an internal report. This is why you need to engage all stakeholders, from employees to those tasked with handling reports to management, who need to buy into the value offered by internal reporting. Training should take workers through the process so they understand how it works and how they will be protected should they need to make a report. Teach all parties about how reporting is beneficial to the company in terms of efficiency, morale and compliance. 

3.5 Protect Whistleblower Identity

One of the key responsibilities is to protect the identities of the reporting person and any other people named in the report. Whichever reporting channels you implement, this is essential and, if you cannot guarantee it with one method, you should not use that channel as it stands.  

4. Key Features of an Effective Whistleblowing Channel

4.1 Accessibility

The way your employees work will dictate what makes an effective whistleblowing channel. If they are based remotely, there is little point in implementing a physical postal box in the office. An online tool would be far more accessible. If they often work outside, a telephone hotline would probably be the most effective course of action. Accessibility also means keeping these channels open 24 hours a day to be there for employees in all circumstances. 

4.2 Confidentiality

You must be able to keep all identities confidential throughout the investigation process. Whether it is the reporting person, anyone who has helped them or any individual named in the report in connection with wrongdoing, the channel needs to be able to keep these names private as the case continues. 

4.3 Security and Compliance

Only the impartial designated person or department should be able to access details of each case as it is ongoing. According to the directive, you should ensure any whistleblowing channel “prevents access thereto by non-authorised staff members.”

In addition, you must be able to handle all data as prescribed by GDPR. Your whistleblowing reporting channel(s) should all guarantee compliance. 

4.4 Visibility

It is important that employees know exactly where they need to go and what they need to do to make whistleblower reports. This means you must advertise your reporting channels. This could be on notices around the office, on the staff intranet, labels on desks, modules from staff training and any other visible place you can display the information. Make sure everyone knows the channels that are available and how they can use them. 

4.5 Measurability

You should track the progress of each case and use the data to plot the success or otherwise of the channels you use. How quickly are you investigating and responding? What is the satisfaction rate of the reporting persons? Are there any branches of the business that produce more reports than others and is there a reason why? 

With whistleblower software such as IntegrityLog, the inbuilt reporting function allows you to generate these insights automatically. This means you can constantly streamline and improve your internal reporting workflow.

4.6 Management Support

Management must show that they are behind the programme and support the systems you have in place. In order to encourage buy-in from employees, they need to see that the company is committed to change and growth, as well as stamping out corruption and preventing retaliation. One way to engage management is to show them the benefits whistleblowing has for internal control and corporate governance.

5. Advantages and Disadvantages of Common Whistleblowing Channels

Here is some guidance about the reporting options available to public sector and private sector organisations. 

6. FAQs

6.1 Can the reports be anonymous?

Member states can decide whether public or private organisations in their jurisdiction should accept anonymous reports. If they do allow this, the whistleblower is protected by the local legislation even if their identity is revealed at a later date. Whether the nation does or does not allow anonymous reporting channels, all reports and further actions should be considered confidential by default. 

7. Final Word

There are many different whistleblowing reporting channels to choose from, but using an online solution offers the complete package in your anti-corruption strategy. In terms of ease of use, confidentiality, security, privacy, data protection and ease of investigating, a web portal meets all of the requirements for employers as part of the EU whistleblowing directive. Request a demo of IntegrityLog or request a 14-day free trial right now to see how it can help your organisation display integrity and comply with this new law on the protection of whistleblowers. 

8. References and further reading

• Speak Up Channels Compared
• Transparency International Best Practice Guide
• Example of KPMG Reporting Channels
• Anonymity for Whistleblowers
• Working with Whistleblowers