Guide for Companies: Outsourcing Full Whistleblowing Case Handling vs Preliminary Screening

Estonia and Poland became the final countries to incorporate the EU Whistleblowing Directive into national law, in autumn 2024. This means that all 27 European Union member states now have robust laws regarding how companies manage reports of wrongdoing, investigate the issues surrounding them and protect whistleblowers from the threat of retaliation.  

However, as all businesses with 50 or more employees are now within the scope of the law, for many organisations, this represents a significant administrative burden. There are also questions over whether it is possible for some businesses to meet the requirements of the law, given the nature of their operations.  

This is why a large number of businesses look to outsource elements of their whistleblowing case management to advisory firms. But should you engage an advisor to take on the whole process or just the preliminary case screening? This article, and a short questionnaire, will help guide you to the right choice for your business. 

1. Requirements for businesses  

All EU organisations with 50 or more employers must:  

• Implement confidential internal reporting channels for whistleblowers 

• Understand which aspects of misconduct fall within the scope of the national whistleblowing law 

• Acknowledge receipt of the report within seven days 

• Appoint an independent and impartial party – either internally or externally – to carry out the investigation 

• Feed back on the outcome of the investigation within three months 

• Support the whistleblower with free comprehensive information about their rights, legal aid for fighting retaliation, financial assistance and access to psychological help 
• Protect them against retaliation, such as bullying, demotion, being blocked from promotion and other such actions.

2. Why you might choose to outsource 

There are many reasons why businesses might choose to outsource some or all of their whistleblowing case management processes. They include: 

• Not having the resources or technology to manage the full process in a manner that meets the requirements for confidentiality 

• Not having the available staff to conduct investigations 

• Not being able to find a party to investigate the whistleblowing complaint who does not have a connection to the reporting person or someone named in the complaint 

• Not having the capacity to analyse and fully understand the complexities of the law 

• The risk of significant sanctions and reputational damage for failing to fulfil their obligations.  

3. The case for full outsourcing 

Outsourcing the whole whistleblowing management process takes the responsibility from your hands, from initial report to resolution. This means you do not need to worry about hitting deadlines and adding more tasks to your to-do list.  

You benefit from the expertise in compliance, legal and regulatory matters that an advisory firm can provide. This reduces the risk of your cases being mishandled and ensures that the procedure is run in the correct manner, leaving you in a strong position to improve your processes based on the findings of the investigation. 

The advisory firm can run the case management in a manner that meets the exact legislation in the country or countries in which you operate and in line with your policies that might be stricter than the minimum standards of your national law. For example, you might allow for anonymous reporting of internal misconduct. 

You do not need to overstretch your internal resources or employ more staff to handle investigations and you can avoid the potential conflicts of interest between fellow employees by having a third party take on the investigations for you. Also, having that distance between the internal team and external investigators can build trust among employees, making them feel more confident in coming forward with reports.  

3.1 Businesses that would benefit  

• Companies with no internal compliance or legal function 

• Organisations with fewer than 100 employees 

• Businesses with limited resources 

• Firms with high compliance risks and that are likely to field significant volumes of reports. 

4. The case for outsourcing preliminary screening only 

By only outsourcing preliminary screening, you take a more cost-effective approach, but still benefit from the expertise of the advisory company albeit in a more limited manner than when taking the full case handling option. The advisor accepts the reports and assesses whether they constitute a protected whistleblowing case under national law and within your own whistleblowing policy. This saves you time and ensures the validation process meets the legal requirements.  

The advisory firm can also categorise the case for you to help streamline your approach to investigating it, providing guidance on the priority level of the case as well.  

You maintain the ability to handle investigations in-house in the manner you wish, creating the outcomes you believe are best for your organisation. This gives you greater control over how you implement your compliance efforts. You can also still engage the advisory firm if you need additional legal guidance, if the matter is escalated, for example. The advisor can also help you create new policies to prevent similar issues in the future.

4.1 Businesses that would benefit  

• Companies which have an existing dedicated compliance or legal department 

• Larger organisations with established investigation processes 

• Businesses looking for a cost-effective way to supplement their internal processes. 

5. How to decide how much to outsource

• Assess your internal resources to understand how much you can realistically take on. This includes your staffing levels and the availability of reporting channels that will allow you to meet your obligation to keep the identity of the whistleblower and all persons named in the report confidential. Can you guarantee that no unauthorised person will be able to access the details of the case? If not, you should look for a full-service option.  
• Evaluate your industry risks to understand the likely number of whistleblowing reports you may receive. For example, in the financial sector, there are significant risks of money laundering, market manipulation and conflicts of interest with clients. Assess your capacity to manage the number of reports you might receive.  
• Consider your ability to be able to find independent investigators within your internal team. With a small cohort of staff, can you be sure that all investigations will be impartial?  
• Understand your budget to guide you towards a solution that works for your business.  

6. Questionnaire

Take this questionnaire to help you gain insight into how much of your whistleblowing case management to outsource: 

• Yes 

• No 

• Yes 

• No 

• Yes 

• No 

• Yes 

• No 

• Yes 

• No 

• Yes 

• No 

• Yes 

• No 

If you answered: 

• Mostly “yes”: You likely have the resources and infrastructure in place to handle your investigations internally. You could still benefit from having an advisor filter and categorise your reports. They can maintain availability to offer advice about case escalation and help you form new policies and procedures if necessary.  
• Mostly “no”: Full outsourcing of whistleblowing case management would be a better fit to ensure end-to-end compliance and effective management of whistleblowing cases.  

6. Conclusion

There is no doubt that the new whistleblowing laws have added to the compliance burden felt by organisations across the European Union. Having the capability to run independent, secure and confidential investigations into allegations of wrongdoing and completing them in compliance with the law and on time will stretch the resources of many businesses. This is why advisory firms can prove to be a valuable asset. But working out how much of the case handling to outsource takes some consideration.  

For those smaller firms without internal compliance functions and businesses where there is a risk of large volumes of reports, a full-service option is more desirable. Otherwise, opting for preliminary screening only provides a welcome enhancement and legal expertise to your current operations.  

If you opt to run the investigations in-house, using IntegrityLog helps you monitor the status of cases whilst maintaining robust security. Granular access management means only authorised people can access the details of each case, communicating with the whistleblower throughout the investigation without compromising their confidentiality. Request a demo of IntegrityLog for your business.

In case you need legal support for your whistleblowing case handling, we work with many trusted law firms and can provide recommendations. Contact us to learn more. 

7. References and further reading

• Examples of workplace whistleblowing 

• Benefits of a whistleblowing system 

• EU rights and protections for whistleblowers 

• How to prevent unethical behaviour 

• How to build a speak-up culture