Are Your Whistleblowing Arrangements Up To Scratch - Part 1

How your organisation structures and manages its whistleblowing arrangements is vital to maximising the value of your whistleblowing programme and managing the risks which your organisation faces.

Whistleblowing Arrangements

In an environment where the treatment of Whistleblowers is under increasing public scrutiny, legislators, regulators, investors, boards and employees are all taking notice. Recognising the value of Whistleblowers to organisations and the wider economy, the EU passed a directive in 2019 which will be in full force by the end of 2021.

The resulting changes to legislation will dramatically increase protection for Whistleblowers and mandate the implementation of internal and external reporting mechanisms. The UK is currently looking to replace the Public Interest Disclosure Act 1998. Once seen as a leading piece of legislation, the Act has now been called ‘unfit for purpose’ and ‘toothless’ in the Commons. This is in addition to recent legislative changes such as SAPIN II in France, Sarbanes Oxley (SOX) in the US and recent amendments to the Whistleblower Protection Act (2004) in Japan.

Your organisation's Whistleblowing arrangements will differ by jurisdiction as each piece of legislation will vary, however there are a range of best practices which are applicable regardless of physical location. Your arrangements will also vary depending on the size and complexity of your business and the sector in which you operate.

Whistleblowing Principles

The following principles are generally applicable to all organisations regardless of geography, size and sector;

Policies
Your whistleblowing arrangements should be clearly articulated in a policy. This may be a specific whistleblowing policy or covered in a code of conduct, employee handbook or similar document.

Processes
Your whistleblowing processes should also be fully documented including your promotion, intake, triage, investigation and outcome processes to ensure that those looking to raise concerns know what to expect.

Responsibility
It should be clear who the responsible people are in an organisation. This responsibility typically sits with senior managers, risk and compliance, internal audit or human resources. 45% of Safecall clients have four or more responsible people with authorisation to view and manage whistleblowing cases. The number of responsible people increases in line with organisational size and complexity.

You may want to establish a RACI (Responsible, Accountable, Consulted, Informed) model involving all relevant parties to ensure clear demarcation of roles and responsibilities.

Nominating a Whistleblowing Champion at Executive or Board level to oversee the Whistleblowing procedure ,whether you’re mandated by regulation or not, highlights the seriousness which the organisation attributes to whistleblowing and is a clear statement of intent.

Commitment
Senior management should make it clear that employees and managers are expected to adhere to high standards of behaviour and those falling short will be subject to disciplinary action. In addition a clear message that those that raise concerns will be appreciated and protected should be publicised.

Feedback
Updates should be provided to the reporting party at appropriate times, including acknowledgement of receipt, status updates and where appropriate outcomes.

Protection
There should be a clear commitment to protect individuals that raise concerns. The focus should be on preventing the reporting party from suffering a detriment as a result of their concerns. An effective means of doing this is safeguarding their identity.

Scope
Organisations will often have a grievance process in addition to typical day to day management activity. It should be clear which types of behaviour should be reported through which reporting channel, how each should be accessed and the protection afforded by each route.

The following is an example of an issue escalation diagram;

In a typical organisation there are six opportunities which may allow a situation to be identified and resolved before a reporting person makes contact with an independent agency such as a regulator.

While steps can be skipped depending on the seriousness of the activity witnessed, most reporting parties do follow this escalation path. This means that by the time the concern has reached the Whistleblowing Service they are likely frustrated that action has not been taken and in all likelihood the behaviour has become more serious over time.