The EU Whistleblower Directive; what changes will you make?

In order to meet the various criteria and requirements laid out in the Directive, many organizations are engaging or consider to engage third party suppliers to buy an ‘off-the-shelf’ whistleblowing platform or tool. Although many fit-for-purpose solutions are available within the market, organizations will find that simply putting a whistleblower tool or platform in place will most likely not do the trick. Instead we experienced that clients need more than just a whistleblower hotline in order to successfully design and implement an effective and compliant process. Although solutions bought from third parties are often more than helpful, in itself they are hardly ever sufficient for the buyer. 

Designing and implementing an effective whistleblower process requires proper embedding within the organization. The practical guide that has been issued earlier, depicts the various functions, processes and procedures that are in play, divided over 4 pillars. 

In this blog we will provide a high level perspective on what we believe organizations should typically consider about their (i) Governance, (ii) Policies & Procedures, (iii) Deployment, and (iv) Systems & Tooling, before they embark on designing and implementing a whistleblower or speak-up process. 

Governance

A conscious and appropriately considered governance lies at the basis of any successful whistleblower process. By not clearly articulating the roles and responsibilities, and not deliberately assigning these to the various functions and departments, an organization significantly jeopardizes the overall effectiveness of its process. Organizations may have an initial tendency to rely on already existing governance structures, in particular larger organizations with a certain maturity level in terms of how they are structured and governed. This tendency is often based on an assumption that certain whistleblower processes fall within the remit of already existing functions and departments, instead of having verified this with the relevant stakeholders. We have however experienced that a variety of circumstances and reasons can negatively influence this ‘copy-paste’ approach. Following up on whistleblower reports may very well be similar to already existing processes and procedures, it is never quite the same. The design and implementation will therefore benefit strongly from conscious governance decisions, and it is of great importance to allow time for consultation of and obtaining buy-in from the involved functions and departments, before assigning them with new roles or responsibilities.

As a tangible outcome of the time and effort spent on thinking out the governance of whistleblowing / speak up, organizations may aim for a governance charter. All relevant stakeholders should have provided input to such charter, and it should clearly articulate and appoint the various roles and responsibilities in the whistleblowing / speak-up process. Another often seen result is the identification of certain (staffing) gaps in organizations’ functions and departments, which need to be filled (internally or by means of outsourcing) in order to effectively assign all roles and responsibilities that come into play in the whistleblowing process. 

Policies & Procedures

It almost goes without saying that policies and procedures are at the heart of an organisation’s whistleblower or speak-up process. The reason that we nevertheless emphasize the importance of policies and procedures, is the fact that these cannot be limited to a whistleblower or speak-up policy alone. Instead, an effective whistleblower process consists of a constellation of various policies and procedures, most of which should be complementary to the other, and none of which may be contradictive to the other. One realises that this is more easily said than done, once you start to map the various policies and procedures that are of relevance for the whistleblower process in its entirety. To name a few: Code of Conduct, Whistleblower or Speak-up policy, triaging/escalation/reporting instructions/criteria, non-retaliation policy, HR policy, investigation procedure, disciplinary/remedial action policy, etc.

Getting all the policies in place and implemented can prove to be challenging due to the already existing policies in your organization that have a link with whistleblowing or speak up.  These policies are often designed and implemented for other reasons than the whistleblower / speak-up process, which may result in the need to revisit and amend these existing policies, or to draft appendices or waivers to these. Given the many steps and phases in the lifecycle of a whistleblower report, it quickly becomes a complex and meticulous exercise to make all the pieces fit.

Deployment

Once the governance of the whistleblower / speak-up process has been laid out, and the required framework of policies and procedures is built, organizations are well underway but not quite there yet. In order to start executing, an additional deployment effort is required, consisting of 3 major elements: communication and awareness, training, and monitoring. 

An organisation’s whistleblower process is not considered effective if people have limited knowledge of it or do not know how to find it. Therefore it is highly recommended to actively raise awareness by means of communication, regardless of it being an enhancement of the already existing process or a process which has been built from scratch. Communication preferably includes a strong and unequivocal message from the organisation’s senior management, as research has proven that ‘tone at the top’ has a very significant impact on how the safety to speak-up is perceived throughout the organisation. Furthermore, organizations should strive to emphasize the principles that are the core of a healthy speak-up culture, i.e. encouragement to speak up, non-retaliation, confidentiality, integrity, and independent and objective assessment. 

Closely related to communication and awareness, organizations should also focus on training their people. A way to do so, is by adding the specific topic of speak-up to a potentially already existing learning on business ethics or conduct. It is important to thereby not only take the perspective of the person speaking up into account, but also that of the person at the receiving end of a speak-up concern (e.g., line managers, HR representatives). Goal is to ensure that people throughout the organization know when, where and how to speak up, as well as what to do if someone speaks up to them. In addition to such a broader training initiative, organizations often also need further specialized training programmes, such as an investigation training.

Quite different from communication and training, but an equally important component of deploying a whistleblower process, is setting up monitoring and control mechanisms specifically focused towards speak up. For this, organizations may want to consider using the already existing monitoring and control framework, and tweak this towards the whistleblower process. Any monitoring or control mechanism likely needs to be informed by the larger governance of the speak-up process. This governance dictates the parties, committees, or functions to which whistleblower cases get reported, both on an individual and aggregated level (i.e., single escalated case vs. monthly or quarterly reports with total number of cases). 

Systems & Tooling

As with many operational processes, the whistleblower or speak-up process can benefit significantly from systems and tooling. However, organizations will likely try to make an estimation of the number of whistleblower reports they expect to receive, before deciding on procuring a sophisticated (and often also expensive) case management system. Aside from the total number of (expected) cases, the decision to implement a designated system or tool may also be based on the number of people involved in the further handling of these cases. For centralised organizations that effectively have 1 or 2 people handling the majority of cases, a manual process will probably suffice. Contrary to strongly decentralised organizations, with offices and locations across multiple countries and jurisdictions, and with 10 or more people handling whistleblower reports. For the latter organization to maintain effective oversight of its whistleblower process, and to apply the required consistency in its response to reported cases, a designated system or tool may be indispensable. 

It’s worth noting that the earlier described components and the systems and tooling component in a whistleblowing process can mutually benefit from each other. In particular this is the case regarding governance and monitoring and control. A customised case management system can automatically appoint a case to the person or committee that should decide on the case, and also function as a trigger for certain follow-up procedures. Furthermore, these systems are often equipped with monitoring and reporting functionalities, which decrease an organisation’s reliance on a more manual procedure.         

The way forward

In our opinion, organizations will design and implement a whistleblower process more efficiently and effectively, and make the necessary enhancements based on the EU Whistleblower Directive to their already existing processes, if they decide to proactively put thought in its various components. At the same time, we strongly believe that chances of setbacks or failures significantly increase if an organization chooses not to apply the approach that we’ve tried to explore in this blog. After all, an appropriate and effective whistleblower process is more than simply putting a hotline in place, or adding a non-retaliation paragraph to your organisation’s Code of Conduct.