Article 8 of the EU Whistleblowing Directive: What Advisors Should Know

The EU Whistleblowing Directive was enacted to protect whistleblowers in the EU and to ensure that businesses followed up on reports of compliance breaches.  

There had been a number of cases in which people who reported wrongdoing had been seen to be punished for their actions. For example, an accountancy firm employee was subject to criminal charges after exposing his employer’s role in helping clients avoid tax. In another case, a European tax official exposed a fraud scheme that cost taxpayers €60 billion. However, her complaint was ignored for a significant amount of time before journalists took up the case and action was finally taken.   

Article 8 of the directive, as implemented into national laws in each of the EU member states, requires companies with more than 50 employees to set up internal reporting channels to allow whistleblowers to make confidential reports, in the knowledge that the business will carry out a follow-up investigation. This gives whistleblowers confidence that they will be taken seriously, maintains compliance with the law and prevents a situation where misconduct is allowed to prosper and cause reputational and regulatory damage to an organisation.  

Lawmakers understood that this could increase the administrative burden on businesses. For this reason, Article 8 states that “reporting channels may be operated internally by a person or department designated for that purpose or provided externally by a third party”. 

This provides an opportunity for advisory firms to offer this service to clients who might not have the capacity to employ a team to investigate whistleblowing reports or run their own reporting channels, helping them maintain compliance and reducing regulatory risk.  

1. Understanding Article 8: how it shapes whistleblowing case management 

The key element of Article 8 of the EU Whistleblowing Directive is that “Member States shall ensure that legal entities in the private and public sector establish channels and procedures for internal reporting and for follow-up.”. The directive then proceeds to set out the requirements.  

Given this obligation and the ability to outsource the implementation and functioning of the whistleblowing process, Article 8 binds organisations and, by extension, advisors to follow the correct procedures for running their channels. This includes: 

• Creating secure and confidential reporting platforms that meet the requirements for data protection under GDPR. These channels can allow for written and/or verbal reporting and the process must allow for the identity of the reporting person and any other individuals mentioned in the report to be kept confidential. Advisors must ensure that no unauthorised persons can access the details of whistleblowing cases. 

• As a third party operating your client’s whistleblowing channel, you must support your client to acknowledge the receipt of a report within seven days of it being logged by the reporting person. This ensures that the whistleblower knows their report has been received and is being reported.  

• Organisations must designate a competent person or department to investigate whistleblowing reports which, in this case, is the advisory firm. The directive demands that “their function should be such as to ensure independence and absence of conflict of interest” in the process. You should maintain impartiality during your case management oversight as a neutral third-party evaluator. 
• The directive sets in place ‘a reasonable timeframe to provide feedback, not exceeding three months from the acknowledgment of receipt [of the report].’ As the external operator of the reporting channel, you must ensure the reporting person receives an update of the progress of the investigation by this deadline.  
• On the occasions on which it is not possible to resolve the issue internally, or where the whistleblower is not satisfied with the outcome of the investigation, another function of the party running the channel is to facilitate ‘provision of clear and easily accessible information regarding the procedures for reporting externally to competent authorities pursuant to Article 10 and, where relevant, to institutions, bodies, offices or agencies of the Union.’ 

2. Key responsibilities of advisors in whistleblowing case handling 

As well as your regulatory duties under the local implementation of the EU Whistleblowing Directive, you also have a number of responsibilities as an advisor running whistleblowing channels for clients. These include:  

3. Challenges to whistleblower case handling for advisors 

Although there is a real opportunity to create additional revenue streams and to enhance your offering to clients, handling whistleblowing cases does also generate challenges. They include:  

• Managing multiple cases across different clients can create an environment in which it is possible to miss some cases and overlook issues that need investigation and resolution. This would contravene the whistleblowing laws and create a situation where you and your client may face compliance sanctions. This is why it is important to centralise your case management workflow, using a tool that will allow you to maintain an overview of the progress of your cases and their respective deadlines.  

• Maintaining confidentiality is crucial under the EU Whistleblowing Directive, especially when you have a number of cases across a range of clients. You need to use a tool that allows for customisable access control for each client and case. Granular access management is a key feature that ensures only the advisors that need access to each case are able to access it, without being able to see information relating to other cases or clients if not assigned to them. 

• Allowing for anonymous reporting where the national law and/or company policy allows whistleblowers to withhold their identity can mean you struggle to find enough evidence and cannot go back to the reporting person for clarification and additional testimony. This is why using a tool that allows for two-way communication without revealing the identity of the whistleblower is essential for better-informed investigations.  

4. Best practices for advisors in whistleblowing case handling

4.1 Set up a case management framework 

Preparation is key to the smooth functioning of your whistleblower case handling. Discuss the scope of the client’s reporting channel with them. Does it simply adhere to the minimum standards in law or do they want to allow the reporting and investigation of additional behaviours? Does the client want to accept anonymous reporting, too? Establish this before you create your process.

You will need to create clear workflows for receiving reports, assessing their severity, evidence gathering and follow-up in order to prioritise them and ensure you meet your deadlines in as efficient a manner as possible.  

4.2 Implement role-based access control 

However you receive reports, you must have a system in place that allows only authorised individuals to access the details of each complaint. Creating a system with access controls that limit who can view and manage each case within both your company and your client’s business is essential. This is also important for GDPR compliance.  

4.3 Automate acknowledgements and notifications 

As notifying whistleblowers about the receipt of their report and the outcomes of the investigation is an obligation under European whistleblowing laws, finding a reporting channel solution that automates this process can save a significant amount of time and manual work, as well as maintaining compliance. 

You can also automate notifications of other significant events in the case to improve engagement with the reporting person and display transparency in the process. This will create a supportive relationship between parties and help with managing their reaction to the outcome of the investigation.  

4.4 Regular reporting to clients 

Maintain regular communication with clients to reassure them that you are on track to complete cases in a timely manner and in accordance with the law. This keeps them informed about their compliance status and provides insight into misconduct within their organisation, allowing for timely resolution. 

4.5 Developing new policies and procedures

By handling clients’ cases, you gain an insight into areas in which they can improve their processes. This will help them prevent similar incidents in the future, enabling them to develop policies that address the vulnerabilities which led to wrongdoing occurring. An advisory firm that handles its clients’ whistleblowing management has clear oversight over the issues that the company faces. It is also best placed to find practical, intuitive and effective preventative solutions, given the wealth of experience and expertise available within the firm. 

5. Conclusion

Article 8 of the EU Whistleblowing Directive introduces the requirement for creating internal reporting channels that can be operated by external bodies, such as advisory firms. This opportunity to serve your clients who might not have the resources to run full investigations themselves also generates a range of challenges. The need for confidentiality, security and efficiency in meeting deadlines are amongst the most pressing.  

Using IntegrityLog alleviates these issues and more. You can manage multiple clients’ cases in one centralised dashboard, allowing you to customise the access settings for each different company and case. As a reporting channel, it can be accessed by whistleblowers anywhere in a confidential manner. You can communicate back and forth during the course of the investigation, even if they remain anonymous, and the handy dashboard displays the progress of each of your open cases.  

Request a demo of IntegrityLog for advisors to find out how it helps you serve your clients.  

6. References and further reading

• How to meet whistleblowing requirements for company groups 

• 10 benefits of a whistleblowing system 

• EU rights and protections for whistleblowers 

• Guide on implementing a whistleblowing system 

• Whistleblower interview questions