Five steps towards a credible and efficient whistleblowing service

A whistleblowing service is a tool that allows companies to monitor their guidelines on business ethics, their codes of conduct. It provides a means of obtaining information on irregularities that should be acted upon at an early stage. Whistleblowers act in the best interest of the company. The whistleblower must be able to trust the company’s whistleblowing service; that there is no risk of retaliation against members of staff and that reports can be submitted anonymously. Management has a responsibility to deal with any information obtained through whistleblowing in an appropriate and confidential manner and ensure that innocent individuals are protected from harm by incorrect whistleblowing reports.

In this White Paper we emphasise five important steps that should be considered in the implementation of a company whistleblowing service.

FIRST STEP | The company code of conduct is key

Today the code of conduct constitutes a key steering document in companies, and is often the first document a new CEO or members of staff and suppliers are asked to sign up to.

The code of conduct may well be based on the UN Global Compact international guidelines on responsible business.

It should appear relevant and realistic to the company and its suppliers; it should be easy to comprehend, and worded so as to create pride and commitment to the company’s business aspirations. The code may well be supplemented with cases of ethical dilemmas to illustrate the practical application of the guidelines, and policies on areas that are of particular importance or pose a particular risk to the company.

Strong support is vital and it is therefore important that the management team and board are involved in the development of the code. The subsequent step is regular communications and discussion of the code throughout the organisation. There are a number of ways of doing this, such as via interactive e-learning platforms or in games.

However, having a code of conduct in place is not enough; it must also be monitored. The most efficient way of achieving this is through a credible whistleblowing service.

The need for whistleblowing services in companies is driven partly by increased expectations on ethical business conduct, partly by tightened anti-corruption legislation which is making management teams increasingly responsible for taking pre-emptive action to prevent corruption in companies.

Lesson 1: The company code of conduct must be easy to embrace and take pride in. Management involvement, anchoring of the code and follow-up on deviations are important for making it trustworthy.

SECOND STEP | Safety for the whistleblower and for the accused

A whistleblower is acting in the best interest of the company; whistleblowing for one’s own direct gain is rare. The whistleblower is acting on perceived unethical behaviour or a potential danger. The whistleblower must be able to trust the company whistleblowing service and the way the submitted information is dealt with.

It is important to make it clear that whistleblowers must act in good faith, even if they will not be asked to prove that the information is correct. Honest suspicion is sufficient.

Whistleblowers are primarily encouraged to be open about their identity, but the option of submitting reports anonymously must be offered. The option of anonymous reporting is used frequently and has proved vital for obtaining business-critical tip-offs.

Information about alleged offenders must be handled appropriately. As long as this does not hinder the investigation, the accused must be informed of the whistleblowing report and given a chance to respond to it.

If you are offering whistleblowing services in markets with inadequate legislation or poor observance of the rule of law, it is especially important to consider how the identities of alleged offenders, and of whistleblowers who choose to be open about their identities can be protected.

EU countries have national guidelines on the processing of personal data and whether the service must be registered with the national data protection agency. It is important that you are aware of these regulations before launching the service.