BY: ComplyLog|April 9, 2021|Whistleblowing
Member states must integrate the EU Whistleblowing Directive into national law by the 17th December 2021. This piece of legislation provides whistleblower protection for employees of private businesses and government agencies, as well as the staff of municipalities that serve more than 10,000 citizens, who report breaches of the law at work. One of the key provisions of the directive is the requirement to set up an internal system of whistleblowing reporting channels.
Table of Contents
1 EU Whistleblowing Directive: The Reporting Channels
3 Considerations when Introducing Whistleblowing Channels
4 Key Features of an Effective Whistleblowing Channel
Prior to the inception of the directive in 2019, protection across EU states was inconsistent. In ten of the 28 (at the time) EU nations, there were comprehensive protections for whistleblowers, such as the Whistleblowers Authority Act in the Netherlands, but some countries offered little or no help. The new directive benefits your organisation by giving it the opportunity to tackle corporate fraud, questionable accounting, human rights breaches, conflicts of interest and corruption before any of these become endemic. From a business or government point of view, it helps prevent public scandals and address wrongdoing quickly. With that in mind, it is important that organisations begin planning which channels they will implement to ensure compliance.
All organisations with 50 or more employees must create safe, secure and confidential internal reporting channels that allow their staff members to report breaches of the law orally, in writing or both. This extends to workers across a company’s subsidiaries and affiliates, as well as to agents and suppliers of the business, where possible.
Certain third party organisations can serve as an external reporting channel in case whistleblowers do not feel comfortable reporting internally or they feel that their report has not been dealt with effectively. These organisations include trades unions, other employee representatives, an audit committee or any other body that gains the authority to accept reports. They must guarantee “independence, confidentiality, data protection and secrecy” in order to qualify. It is up to the individual member states to establish their own external reporting channels.
These channels are typically media outlets and they should be used in cases where:
The idea is to make the process as simple and intuitive as possible to encourage anyone with knowledge of corruption or another lawbreaking to make their report internally. This means ensuring your reporting channels fit in with your corporate culture and ethics. If you use an intranet to conduct a large proportion of the internal communication, it would make sense for the reporting system to sit within that or to use a separate online reporting tool. If you already run a physical ‘suggestion box’ system, implementing a similar channel for reports remains within the comfort zone of your employees.
For employees to have any confidence in the reporting system, you need to make sure that all reports follow the same process. This is why the designated individual or department in charge of running the process should be independent and impartial. The key is to set in place a comprehensive whistleblowing policy in advance so that all report cases are submitted and handled in the same manner.
The more options for reporting available, the more likely it is that a whistleblower will be able to find a method that suits them. When you limit the whistleblowing channels, you risk reporting persons taking their story to an external or public channel if they do not feel comfortable using the internal solutions. Attempt to offer at least one oral and one written method, if not multiple variations of each.
You need a ‘Speak Up’ culture in order to properly encourage whistleblowers. If employees have any reservations at all about how open to reporting your organisation is, it could dissuade them from making an internal report. This is why you need to engage all stakeholders, from employees to those tasked with handling reports to management, who need to buy into the value offered by internal reporting. Training should take workers through the process so they understand how it works and how they will be protected should they need to make a report. Teach all parties about how reporting is beneficial to the company in terms of efficiency, morale and compliance.
One of the key responsibilities is to protect the identities of the reporting person and any other people named in the report. Whichever reporting channels you implement, this is essential and, if you cannot guarantee it with one method, you should not use that channel as it stands.
The way your employees work will dictate what makes an effective whistleblowing channel. If they are based remotely, there is little point in implementing a physical postal box in the office. An online tool would be far more accessible. If they often work outside, a telephone hotline would probably be the most effective course of action. Accessibility also means keeping these channels open 24 hours a day to be there for employees in all circumstances.
You must be able to keep all identities confidential throughout the investigation process. Whether it is the reporting person, anyone who has helped them or any individual named in the report in connection with wrongdoing, the channel needs to be able to keep these names private as the case continues.
Only the impartial designated person or department should be able to access details of each case as it is ongoing. According to the directive, you should ensure any whistleblowing channel “prevents access thereto by non-authorised staff members.”
In addition, you must be able to handle all data as prescribed by GDPR. Your whistleblowing reporting channel(s) should all guarantee compliance.
It is important that employees know exactly where they need to go and what they need to do to make whistleblower reports. This means you must advertise your reporting channels. This could be on notices around the office, on the staff intranet, labels on desks, modules from staff training and any other visible place you can display the information. Make sure everyone knows the channels that are available and how they can use them.
You should track the progress of each case and use the data to plot the success or otherwise of the channels you use. How quickly are you investigating and responding? What is the satisfaction rate of the reporting persons? Are there any branches of the business that produce more reports than others and is there a reason why?
With an online whistleblowing portal such as IntegrityLog, the inbuilt reporting function allows you to generate these insights automatically. This means you can constantly streamline and improve your internal reporting workflow.
Management must show that they are behind the programme and support the systems you have in place. In order to encourage buy-in from employees, they need to see that the company is committed to change and growth, as well as stamping out corruption and preventing retaliation. One way to engage management is to show them the benefits whistleblowing has for internal control and corporate governance.
Here is some guidance about the reporting options available to public sector and private sector organisations.
|Digital Whistleblowing System||
Member states can decide whether public or private organisations in their jurisdiction should accept anonymous reports. If they do allow this, the whistleblower is protected by the local legislation even if their identity is revealed at a later date. Whether the nation does or does not allow anonymous reporting channels, all reports and further actions should be considered confidential by default.
There are many different whistleblowing reporting channels to choose from, but using an online solution offers the complete package in your anti-corruption strategy. In terms of ease of use, confidentiality, security, privacy, data protection and ease of investigating, a web portal meets all of the requirements for employers as part of the EU whistleblowing directive. Request a demo of IntegrityLog right now to see how it can help your organisation display integrity and comply with this new law on the protection of whistleblowers.