The forthcoming EU Whistleblower Protection Directive has many companies asking how to manage whistleblowing reporting for the first time. But even companies that already have a compliant whistleblowing system in place, such as many of our customers, are wondering whether more and/or different resources will be needed to manage the reporting under the new directive. The EU Whistleblower Protection Directive says that organisations must designate an impartial person or department with the competence for following up on and managing the whistleblower reports. What does that really mean, then?
Competences to manage whistleblowing reporting
Companies need to appoint a credible professional who can build trust when communicating with and asking for further information from the whistleblower, something that is often needed.
Whistleblower reports can vary widely in nature, covering matters as broad as fraud or environmental crime. Very few people have deep expertise in all possible subjects, which is why the person receiving the report needs to have the ability to assess the content of the report and determine whether they are real whistleblowing or non-whistleblowing cases and allocate them appropriately. Often, this kind of competence exists within the legal or compliance departments of organisations.
The person should also know when to bring in special expertise, for example for investigations, sourced either internally or externally.
Many of our customers set up a whistleblower team with roles from different parts of the organisation. The range of roles strengthens the integrity of the team. In the WhistleB customer study on organisational whistleblowing , the whistleblowing team most often included these competences: legal and compliance, internal audit and risk, ethics and HR. Having Board representatives on the team is also becoming more common.
More or less whistleblowing resources?
And what about the amount of resource required? The directive requires companies to be able to receive, respond to and provide feedback on whistleblower reports in a timely fashion. This need not demand significant additional resources though. If companies select a digital whistleblowing solution that seamlessly integrates the reporting channel with the case management tool, with feedback functionality embedded, then parts of this work can be automated.
Companies looking at how to manage whistleblowing reporting going forward have also asked us whether they should expect a drastic increase in the number of reports received, and therefore need more people to sort through them. It is hard for us to give a definite answer, but our view is this. With legal protection in place, yes, there is likely to be an increased chance that companies will actually receive reports of misconduct where misconduct exists. That is the whole idea of the new directive. On the other hand, according to our customers they receive an average of one report per approximately 400 employees per year, and they do not generally receive a high amount of irrelevant reports. So, the information received is largely valuable.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
