Welcome to the WhistleB customer resource centre
Follow this project plan for setting up your whistleblowing system.
This is where you will find everything you need for an efficient, correct and positive roll-out of your whistleblowing system. Follow the steps to get the best out of our recommendations and templates. Use the templates as they are or customise them to suit your organisation’s profile and needs.
The project plan gives support for:
- Defining your whistleblowing guidelines and routines for case management
- Preparing your communication for building awareness of and trust in the whistleblowing system
- Account settings and user instructions
- Protecting your data. Security measures before launch
Define your whistleblowing guidelines and routines for case management
Define and publish your whistleblowing guidelines
The guidelines clarify the purpose of the whistleblowing system and how cases are managed. They provide information for the person reporting. They also serve as guidance and directives for the appointed case managers. The guideline templates comply with the EU General Data Protection Regulation (GDPR) requirements, which are the strictest such guidelines in the world.
The whistleblowing guidelines should be published so that they are easily available and accessible to all users of the system.
Download, edit and publish your guidelines:
Additional: You can download a short manual on receiving a whistleblower message. The manual is a summary of the whistleblowing guidelines. Download
Available on request: Access to legal guidance on handling personal data in your whistleblowing system in the jurisdictions where you operate. Contact us on firstname.lastname@example.org
Prepare your communication
Prepare your communication for the roll-out of your whistleblowing system
What? Building trust is important. Communicate the purpose of the service, which is to ensure sustainable and ethical operations. It is also important to communicate that, through the third-party supplier WhistleB, you provide a service that allows the whistleblower to be anonymous.
How? You need to make sure that people are aware of the service. Raise awareness through the most-used channel for communication, your organisation website, and include information in the Code of Conduct as well as in presentations and training sessions related to the company values.
Do not forget to include information about the whistleblower service in communication to new employees.
The downloads provide input for your communication manager and can easily be customised according to your needs.
Download, edit and publish your communication about the whistleblowing system:
Links: FAQ to whistleblowers WhistleB Trust Centre
Optional: Customise your whistleblower communication channel. You can
- Customise the text on the start page and in the questionnaire. Send us your new text clearly marking your requested changes or send us a completely new text. If you want to customise the questionnaire, for example remove or add questions, please send clear instructions. Download standard start page to indicate your changes. Download standard questionnaire to indicate your changes.
- Include your logo on the start page We can add your logo to the landing page. Send your logo in a jpg or png format. Please indicate whether you want both WhistleB and your organisation’s logo to be shown, or only your logo.
- Translate customised text Let us know whether you want us to translate the customised texts. We will get back to you with a quote for the translations.
Please send your instructions and requests to your contact person at WhistleB or to email@example.com
Account settings and user instructions
Log in to the Case management tool and follow the instructions under “Settings” to
- Add users to your Case management tool. You can also define the user roles.
- Add categories and sub-categories for categorisation of cases. The online statistics will show cases per your defined categories.
- Add pre-defined responses that you can use in your communication to the whistleblowers.
Log in to the Case management tool and follow the instructions under “Your account” to
- Decide how you want to be notified.
We recommend e-mail and text message (SMS) notifications. For text message (SMS) notifications, please include your mobile number and tick “SMS” If your organisation has decided to use two-factor authentication, an extra security level that we recommend, you will be asked to include two-factor authentication the first time you log in.
- The whistleblowing system is intuitive, but we recommend that you do a test of receiving a message before launch. Then open the message and categorise it. You can also try other tasks such as closing a case by deleting or archiving it.
- In the Case management tool under Help you will find information on all features of your Case management tool.
If you need more support on the basic features of the whistleblowing system you can download the User instructions for the whistleblowing system Download
Protect your data - Security measures before launch
Back up your encryption key and set a new secondary password
Log in to the Case management tool and follow the instructions under “Security” “New encryption key”
Before launch: To avoid having any test messages in the statistics, please ask us to empty your account from test messages before launch or categorise these messages as “test messages”. WhistleB needs two days’ prior notice for deleting test messages.
Your data is protected. This is how it works
Sensitive data, including messages to and from a whistleblower, is heavily encrypted in transmission and in storage. Your case and security managers are the only individuals that can decrypt and read messages. Neither WhistleB nor any other supplier can access or read your data, if you do not give access to them, for example during translations. You decrypt data with the “Secondary password”. The Secondary password is shared by all case and security managers connected to your account. You are responsible for keeping the Secondary password safe. WhistleB cannot restore it.
Ready to launch
You are now ready to publish your communication about your whistleblowing system. Write out the URL to the communication channel, so that a whistleblower can copy it and send the message from any device.
WhistleB tips and insights
Who should manage your whistleblowing system? “I have read about incidents in which the company actually has a whistleblowing system, yet messages have not reached the right people. How can I stop this from happening?” Think very carefully through how whistleblower messages should be received, investigated – and above all by whom. We advise customers to appoint an internal team that creates trust and ensures cases are dealt with in a secure way. The team should preferably include non-operational individuals, such as members of the Board and internal audit. We see managers from a range of functions, often Compliance, HR, Sustainability and the CFO represented on the whistleblowing teams at our customers. Ensure your team does not come from one single part of the organisation, but that it is spread across managers from a range of functions. The whistleblowing system itself should also support rigorous and correct case management. For example, through your case log it should be impossible to delete a case without notifying all team members. Finally, don’t forget to be transparent. Tell your employees and other stakeholders about how messages are managed. Make sure follow-up is transparent and that you communicate your results to the Board through regular messages on whistleblowing.
How to communicate efficiently? “I am not sure we get the whistleblower messages that we should receive to, those messages that really would matter to us” Raising awareness is essential for receiving messages that are vital to you.There are a couple of considerations when it comes to the number of whistleblower messages you can expect. Firstly, how can you increase the likeliness of people reporting suspicions on real whistleblowing cases? Here, whistleblower anonymity is key. Communication is also essential and must be continuous to really drive engagement. First, set the right tone at the top to create trust. That includes communicating the company’s core values and philosophy on how to do business, according to your Code of Conduct. Secondly, a person most likely blows the whistle only once in their lifetime making this a very stressful situation for the whistleblower. De-dramatize the process of whistleblowing in your communication and keep the reporting process simple. Don’t make it worse with complex questionnaires! The above two points underline why the whistleblower communication channel should be as easy and efficient to use as possible. Remove any thresholds, such as when, where or from which device a whistleblower can send a message. At the end of the day, you don’t want to risk not receiving business critical information, and in today’s environment, this basically boils down to solid whistleblowing software and technology. Many customers implement a whistleblowing whistleblowing system as a preventive measure. The very fact that the system is in place prevents misconduct occurring in the first place. A very low number of messages coming through the whistleblowing channel might actually mean that it is working.
How to give good and correct feedback to an anonymous whistleblower. What is expected? “We have just received a serious whistleblowing case, which we need to investigate. It came from an anonymous whistleblower – what shall I report back to him/her?” You know nothing about the whistleblower, which is why we advise you to proceed with caution in this situation. Be as careful and as brief as possible in your communication with the anonymous person. At least until you know more about who you are communicating with. Unfortunately, whistleblower anonymity allows for some level of abuse of the whistleblowing system from persons who may in some way want to harm the organisation, or a specific person within the organisation. Your whistleblowing system should provide you support in this situation, in terms of secure management of data and allowing for continued dialogue to build trust between the parties. For example, you need to ensure that all related data is protected, use secure encrypted systems, do not use e-mail, and so on. Keep investigation documents and communication within the protected whistleblowing system. Use a system that undergoes regular professional penetration and information security testing. Limit the number of persons involved. Once again, if you have the right team in place to manage whistleblowing messages, they will be able manage this process with integrity.