How your organisation structures and manages its whistleblowing arrangements is vital to maximising the value of your whistleblowing programme and managing the risks which your organisation faces.
Whistleblowing Arrangements
In an environment where the treatment of Whistleblowers is under increasing public scrutiny, legislators, regulators, investors, boards and employees are all taking notice. Recognising the value of Whistleblowers to organisations and the wider economy, the EU passed a directive in 2019 which will be in full force by the end of 2021.
The resulting changes to legislation will dramatically increase protection for Whistleblowers and mandate the implementation of internal and external reporting mechanisms. The UK is currently looking to replace the Public Interest Disclosure Act 1998. Once seen as a leading piece of legislation, the Act has now been called 'unfit for purpose' and 'toothless' in the Commons. This is in addition to recent legislative changes such as SAPIN II in France, Sarbanes Oxley (SOX) in the US and recent amendments to the Whistleblower Protection Act (2004) in Japan.
Your organisation's Whistleblowing arrangements will differ by jurisdiction as each piece of legislation will vary, however there are a range of best practices which are applicable regardless of physical location. Your arrangements will also vary depending on the size and complexity of your business and the sector in which you operate.
Whistleblowing Principles
The following principles are generally applicable to all organisations regardless of geography, size and sector;
Policies
Your whistleblowing arrangements should be clearly articulated in a
policy. This may be a specific whistleblowing policy or covered in
a code of conduct, employee handbook or similar document.
Processes
Your whistleblowing processes should also be fully documented
including your promotion, intake, triage, investigation and outcome
processes to ensure that those looking to raise concerns know what
to expect.
Responsibility
It should be clear who the responsible people are in an
organisation. This responsibility typically sits with senior
managers, risk and compliance, internal audit or human resources.
45% of Safecall clients have four or more responsible people with
authorisation to view and manage whistleblowing cases. The number
of responsible people increases in line with organisational size
and complexity.
You may want to establish a RACI (Responsible, Accountable, Consulted, Informed) model involving all relevant parties to ensure clear demarcation of roles and responsibilities.
Nominating a Whistleblowing Champion at Executive or Board level to oversee the Whistleblowing procedure ,whether you're mandated by regulation or not, highlights the seriousness which the organisation attributes to whistleblowing and is a clear statement of intent.
Commitment
Senior management should make it clear that employees and managers
are expected to adhere to high standards of behaviour and those
falling short will be subject to disciplinary action. In addition a
clear message that those that raise concerns will be appreciated
and protected should be publicised.
Feedback
Updates should be provided to the reporting party at appropriate
times, including acknowledgement of receipt, status updates and
where appropriate outcomes.
Protection
There should be a clear commitment to protect individuals that
raise concerns. The focus should be on preventing the reporting
party from suffering a detriment as a result of their concerns. An
effective means of doing this is safeguarding their identity.
Scope
Organisations will often have a grievance process in addition to
typical day to day management activity. It should be clear which
types of behaviour should be reported through which reporting
channel, how each should be accessed and the protection afforded by
each route.
The following is an example of an issue escalation diagram;
In a typical organisation there are six opportunities which may allow a situation to be identified and resolved before a reporting person makes contact with an independent agency such as a regulator.
While steps can be skipped depending on the seriousness of the activity witnessed, most reporting parties do follow this escalation path. This means that by the time the concern has reached the Whistleblowing Service they are likely frustrated that action has not been taken and in all likelihood the behaviour has become more serious over time.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
