What is Whistleblowing?
The benefits, how to blow the whistle & the top 10
most asked questions about whistleblowing.
Whistleblowing in 2022
Whistleblowing is the act of reporting waste, fraud, corruption, abuse, or an activity that puts at risk the public’s health and safety. Whistleblowing is usually made to someone in a position to act and rectify the wrongdoing exposed. It typically happens from inside the organisation but not always.
Whistleblowing policies usually can make clear your organisation’s expectations about these types of wrongdoing and how they should be reported. It should allow you to capture the key information you need to conduct the investigation process while also maintaining confidentiality. Whistleblowing requires you to put guard rails in place to avoid retaliation against people who disclose wrongdoing.
“We discovered crooked account officers were stealing money from their own clients. I disclosed internally that there were huge problems with the system in terms of compliance. It was at that point that I was charged with espionage.” – Hervé Falciani, a former employee at HSBC
Whistleblowing by the numbers
Source: European Commission Report on Whistleblower Protection, 2017
%
In 2017, the European Commission reported that 34% of whistleblowers were employees, 18% were self-employed, 12% were civil servants, 4% were managers, and 19% classified themselves as “other”.
%
The majority of whistleblower cases occur in private organisations (77%), organisations with over 250 employees (56%), and organisations based in an EU country (56%).
%
Organisations are more likely to have knowledge of whistleblower cases when they collect information about them (66%). Individuals are most often involved as whistleblowers or witnesses (64%).
Whistleblowing step by step
The process of disclosing, receiving, investigating and following up a case.
Step 1: Employee discloses wrongdoing
If an employee witnesses what they believe to be wrongdoing related to existing laws or organisational policies, or if they have information suggesting an unlawful act was committed, they should make sure to disclose the information to the right place. Anyone can make a disclosure, an employee working at the organisation where the wrongdoing allegedly took place, an external vendor or subcontractor working with the organisation concerned, or anyone else such as a citizen, a student, or a client. Disclosure can be made by any stakeholder regardless of rank, or by any business or group working with the organisation. In most cases, you can disclose anonymously.
Step 2: Organisation receives the disclosure
The organisation should begin by making sure the employee knows and understands their rights as a whistleblower. The organisation receiving the disclosure of wrongdoing should put clear handling procedures in place and share the process with employees. They should also take the necessary measures to guarantee the confidentiality of communications received. Employees should be informed of the channel by which they can disclose wrongdoing, such as having access to a whistleblowing app or a hotline. During the disclosure process, key information will need to be collected about the person or group that has allegedly committed or participated in wrongdoing. The data collected concerning the incident should include when, how and where this took place and should be saved in a secure server in a password-protected file.
Step 3: Case investigation Is conducted
The next step is to determine the admissibility of the disclosure of wrongdoing and whether it is within the jurisdiction of the law. A decision on the case admissibility should be made quickly. A period of 10 working days is normally recommended. If necessary, the organisation should forward any relevant information to other oversight bodies with jurisdiction over specific wrongdoings. The processing of the disclosure should be prioritized according to its seriousness, the fact that the wrongdoing persists or not, the risk of reprisal to the whistleblower, and the risk to human health and safety or to the environment. When investigating a disclosure, the goal should be to protect the whistleblower from pressure from their superiors. The investigator should request and collect relevant documents needed to conduct the investigation.
Step 4: Organisation follows up
When a decision is made about whether to go ahead with the investigation, the organisation should follow up with the whistleblower. The whistleblower should also be informed of the outcome of the investigation. The wrongdoer should be informed of their rights, and board members and senior executives should receive a brief on any serious wrongdoings, along with any recommendations from the investigator. At the end of the investigation, wrongdoing will be determined to have occurred or not occurred. If wrongdoing has occurred, it is the responsibility of the organisation to report its conclusions and take action to ensure the wrongdoing does not occur again. If there is no wrongdoing, the case should be closed.
The many benefits of whistleblowing
And the reasons why you need a strong whistleblowing system and policy in your organisation.
top 10 FAQ
The most asked questions
What are the consequences of not having a strong whistleblower program in place?
The consequences of having weak whistleblower protection are that private workers become reluctant to report wrongdoing, levels of tax evasion and criminal activity increase, and working conditions begin to decline. In the public sector, workers become reluctant to report wrongdoings, and their well-being is negatively impacted. It can also have a negative impact on public trust as well as the company’s financial interests. Supporting whistleblowing is also key to ensuring your organisation maintains its Environmental, Social, and Governance credentials.
What are the different types of reporting channels to consider?
Effective whistleblower protection provides measures for protecting whistleblowers against retaliation at work and gives them the option to report wrongdoings anonymously. The process should involve internal reporting channels, put measures in place for receiving, reviewing, and investigating cases, and offer support to whistleblowers with internal administrative proceedings and in cases where disclosure becomes public, provide immunity from civil action and criminal liability. The confidentiality of whistleblower data should be prioritized to ensure protection against harassment by superiors or colleagues, reduced wages, demotions, punitive transfers, dismissals, or blacklisting.
What is the best reporting channel for private companies?
The best reporting channel for private companies is using a digital whistleblowing system. These systems have the advantage of ensuring confidentiality and are available at any time of the day, which reduces costs and makes the channel more accessible to employees. A digital system also allows the whistleblower to share documents or images easily while maintaining anonymity. An example of a digital system is NorthWhistle, a plug-and-play whistleblowing solution for helping your organization get and stay compliant.
Other channels have become less viable. Using a call centre means speaking to a person who will likely ask in-depth questions, which can reduce the whistleblower’s confidence in disclosing information. Reports made by phone are steadily decreasing and make it difficult to provide support after the disclosure is made. Using an ombudsperson allows you to have a legal expert on hand, but there may be a lack of trust or assurance of anonymity, which can stop potential whistleblowers from disclosing. An anonymous mailbox makes following up with the whistleblower nearly impossible and does not comply with the EU directive.
Does it matter how the disclosed information was obtained?
The way information is disclosed is less important than the way the organisation responds to the disclosure. When internal channels fail to properly respond to disclosures, external channels may be used for bringing attention to misconduct. Whistleblowing should be encouraged internally if the organisation’s actions may lead to serious or considerable harm to others and if the employee has reported their concerns to a direct supervisor and no action has been taken. This can be done through a variety of internal or external channels but acting on disclosures early can help mitigate the risk to the public, financial stakeholders, and the organisation’s reputation.
Should there be specialized training for employees to teach them how to handle and process reports?
Yes, whistleblowing awareness is important, and specialized training can help you create a ‘speak up’ culture. Compliance training is one of your best instruments for reducing the risk of wrongdoing in your organisation. A specialized training program for employees will allow you to share information about regulations, guidelines, and internal procedures for whistleblowing. It will also make it easier for people to navigate the requirements of the whistleblowing process and understand what they should and shouldn’t be disclosing. This will have a positive impact on your business outcomes and create a safer healthier workplace for employees.
Who should be receiving whistleblowing reports?
A whistleblowing report should be received by an independent individual within the organisation who is not subject to pressure or influence by management. This may include a member of the auditing firm or financial oversight committee, a person from a dedicated department that handles internal investigations of misconduct, or an independent advice centre. A report should also be made to oversight authorities when a breach is confirmed.
What type of concerns can be reported through a Whistleblowing channel?
Allegations of fraud, corruption, professional misconduct or unethical behaviour can be reported through your whistleblowing channel. Concerns regarding questionable business practices, as well as any non-compliance regarding company policies or the law observed, should also be reported. Any warnings about risk areas that have gone unchecked should be disclosed.
Should anonymous disclosures be allowed?
Yes. Anonymity can help you ensure the success of your whistleblower policy. When you allow employees to disclose anonymously, this increases confidence in reporting concerns. You may however find that some employees disclose irrelevant issues. These should be re-directed. Your whistleblowing program should insist on employees sharing information about alleged perpetrators, the location of the incident, the names of any other employees who were involved, as well as specific amounts or details involved, and any evidence the employee has collected. When organisations required whistleblowers to disclose their identity, they receive very few complaints or begin to receive anonymous complaints externally since employees no longer use internal channels.
What happens if my organisation doesn’t have effective reporting channels in place?
Ideally, an employee should have the option to first report information about wrongdoings internally to his/her direct supervisor. If no action is taken or there is no internal channel, the whistleblower can choose to disclose to external authorities. This may also happen when internal channels did not function properly due to a fear of retaliation, concerns about confidentiality, the implication of management in the breach, or concealment or destruction of evidence. The EU Directive provides direction for reporting incidents to national or European authorities. In some circumstances, whistleblowers may choose to report the incident to the media if nothing is done. Acting quickly on complaints is essential.