How to implement a whistleblowing system – organisation

Welcome to the second blog in WhistleB’s short series on how to implement a whistleblowing system. In the first blog we highlighted the importance of communication ahead of your implementation and provided tips on audiences, messages and channels for communication. 

In this article we focus on initial organisational considerations, including the whistleblowing team, processes and procedures and legalities surrounding how to implement a whistleblowing system.

Create and train the right whistleblowing team

Who will receive and deal with the whistleblowing reports sent through your whistleblowing system? 

Proper consideration must be given to appointing the right people to the whistleblowing team. There are several reasons for this. The first is a legal point; under the EU Whistleblowing Protection Directive, most organisations in EU member states will need to appoint a competent, independent person to receive and follow up all reports. Companies will be required to designate such a person, be they internal or external, during the next few years. The second reason is that the capability and perception of the receiving person or team has a determining influence on the success and credibility of the whistleblowing process. Whistleblowers need to trust that their concerns are being taken seriously and handled professionally, and the “who” behind this process is a critical factor.

So who should be in the team? We recommend selecting at least two receivers, people with great integrity and trust, preferably trained for the role and with the skills to assess and manage sensitive cases that vary broadly in subject matter. As a rule of thumb, the team should be kept tight but include different competences from different parts of the organisation. This range of skills strengthens the integrity of the team and typically includes people from Legal and Compliance, Internal Audit and Risk, Ethics and HR. Board representation is also becoming more common. 

Define whistleblowing procedures and processes 

There are a range of key processes to define prior to implementing a whistleblowing system. We will dedicate separate articles to the three major ones, the reporting procedure, case management procedure and investigations procedures. In this article we will focus on two less obvious procedures; the escalation procedure and how to deal with non-whistleblowing cases.

Escalation: Defining an escalation procedure means that your organisation will always be prepared for the worst. If someone in your team or perhaps the Managing Director/CEO or the Chairperson is accused by a whistleblower – falsely or not – this is an unpleasant situation, and the team should have sufficient support and knowledge for how to act. The following steps are commonly adopted:

• If someone in the whistleblowing team is accused, this person should be immediately excluded from the investigation.
• If the MD/CEO is accused, the team should report this to the Chair of the Board.
• If the Chairperson is accused, the team will need to report to the other members of the Board.

Non-whistleblowing cases: Through clear communication (LINK to blog 1 in the series) and a definition of whistleblowing matters, your organisation will have reduced the probability that non-whistleblowing cases are received. Nonetheless, such reports may still come in, such as grievances related to promotions, the workplace environment, or colleagues behaving inappropriately. 

The right process for reports that are not strictly whistleblowing in nature is to re-direct them to where the matter belongs. It is good practice to notify the person who sent the report and refer them to the relevant manager or other departments, such as Human Resources, as appropriate. Once again, you should always be mindful of garnering trust in the whistleblowing process, so even non-whistleblowing reports should be processed professionally. To help with this, the whistleblowing system should allow the report to be securely assigned to other appropriate departments.

Pay close attention to legal matters

The legal aspects of whistleblowing cannot be under-estimated. Do you have to keep the identity of the whistleblower confidential? Which level of data protection do you need to provide? Is there specific functionality that must be present in the system? Below are some of the most important considerations as well as a top-level summary of some of the most pertinent legal matters.

National laws: Around the world, national laws related to whistleblowing are different. Currently, where whistleblower protection exists on a national level, it often applies to a restricted number of sectors, for example financial services or the public sector. In other countries there are rules on whether anonymous reporting is permitted or not. Still other countries are specific about the content and extent of organisational whistleblower policies.  The critical point here is that your organisation must comply with the current laws and regulations on data protection, whistleblower protection, etc in all countries where you offer the whistleblowing solution.

Stricter data protection laws: Regulation regarding theprotection of personal data is becoming tighter on a global scale. The EU was at the forefront of this trend and through the General Data Protection Regulation (GDPR) it set the strictest data protection law globally. Whistleblowing systems potentially hold highly sensitive data. So understandably, the GDPR had a wide-reaching impact on organisational whistleblowing systems when it came into force across the EU in 2018.

EU Whistleblower Protection Directive: This regulation has been mentioned several times in this article and it will start to come into force in December 2021. It aims to protect and encourage whistleblowers throughout the EU who report on misconduct in their workplace that contravenes EU laws. The new rules encompass fraud, corruption, corporate tax avoidance and damage to people’s health and the environment. 

In this article we have touched upon organisational matters. If you would like more practical guidance on how to implement a whistleblowing system, we recommend you take a look at our easily digestible handbook: The ABC guide for establishing a whistleblowing solution that increases customer and employee satisfaction. Download the e-book or order a hard copy from Amazon or Bokus.