How to implement an effective whistleblower policy: best practices and key findings
Creating a whistleblower policy is not enough to ensure that legal breaches are reported and costly reputational harm is avoided. Building an appropriate workplace culture with the right mix of contextual and success factors is crucial to encourage whistleblowing without fear of workplace retaliation.
The implementation of an effective internal system is crucial to maintaining control over an issue and to managing external reporting. A study conducted in the 1980s, following the implementation of whistleblower protection laws in the United States, found that the threat of retaliation was more likely to result in whistleblowers reporting to external entities. Such external reports could lead to leaks of sensitive information creating irreparable harm to the business. Businesses should strive to create internal reporting mechanisms which are perceived positively by employees.
The Whistleblowing Guide: Speak-Up Arrangements, Challenges and Best Practices by professors Kenny, Fotaki and Vandekerckhove conducted an extensive review of the available quantitative and qualitative evidence on whistleblowing systems. It was found that there are two key contextual factors, trust and ethical culture, which alongside three ‘success’ factors, independence, responsiveness and reporting channels, combine to create a sustainable whistleblowing system.
Pillars of a Good Whistleblowing System: Contextual Factors
A certain level of trust is needed in order to facilitate the whistleblowing process. The study found that employees may be reluctant to report concerns internally to compliance departments due to perceptions about their impartiality and function.
When compliance departments were viewed as disciplinary in nature, trust was lower. However, when viewed in an advisory capacity, trust in compliance was higher. This would suggest that different individuals or departments should be responsible for a report’s initial receipt and any subsequent investigation or discipline made on this basis.
Ethical Company Culture
The professors also found that a company’s internal culture may either constrain or facilitate whistleblower reporting. A 2016 study reinforced the importance that company culture has on whistleblower reporting. The researchers studied 256 Indonesian accountants finding that an accounting firm’s perceived moral integrity, team norms and perceived organisational support either increased or decreased the studied individuals’ likelihood of reporting unethical and illegal behaviour.
The study also found that senior management should implement positive norms to enable their staff to report ethical breaches. Similarly, both Transparency International and the US Department of Labor have encouraged the establishment of a “speak up organisational culture” in order to facilitate whistleblowing.
A legally and morally sound ethical culture can be accomplished through frequent and transparent communication from management to employees as well as statements from management demonstrating their support for whistleblowing policies. Other sources suggest making employees sign a waiver on hiring stating that they will not engage in and will report any breaches of law or ethics during the term of their employment, to help further facilitate a positive internal culture.
How to Achieve This: Success Factors
Perceptions on independence are important to building trust and thus facilitating the whistleblowing process. It is highly unlikely that employees would wish to report an issue to someone who works closely with the wrongdoer, due to the reputational effect this could have for an individual within their workplace. The EU public consultations that lead to the Whistleblower Directive’s creation flagged the fear of a bad reputation as the third most prevalent reason that surveyed individuals did not blow the whistle on illegal behaviour.
It may be more prudent to have a department such as human resources take over this role. For organisations which do not have the staff or budget to create such independence, outsourcing this role, which is allowed by the Directive, may be the best option.
Responsiveness to a complaint in terms of taking steps to rectify the behaviour which was reported was identified as another key success factor. Several studies have demonstrated that inadequate responses from management can be a key factor influencing the decision to not report illegal or immoral behaviour.
A European study conducted earlier this year found that many potential whistleblowers did not do so as they thought authorities would not act on the information. Similarly, lack of follow-through was shown to give potential whistleblowers in the UK’s public healthcare system the impression that reporting was futile.
Researchers also found that preferences for certain reporting channels within a company may change over time. Furthermore, individuals may hold different preferences as to their favoured reporting methods. It is to a company’s advantage to establish multiple reporting channels in order to facilitate the reporting of violations. Allowing multiple officers within a company to receive reports may also be advantageous, by providing for maximum choice as to where reports are made.
Other Effectiveness Considerations
Ensuring the accessibility of reporting channels to all potential whistleblowers is central to avoiding external reports and maintaining the integrity of a system. As the Whistleblower Directive protects whistleblowers who are not employees, organisations should consider sending a notice of their revised policy, as well as information on where to access it, to all those eligible to become whistleblowers under the new regulation.
A whistleblowing policy is less effective if employees do not understand it or are unaware of its presence. Upon implementation, it is recommended that organisations hold mandatory training sessions for all employees to get acquainted with the new policy.
Auditing and Evaluation Procedures
As noted by the US Department of Labor and Transparency International, routine conduct of auditing procedures may be necessary to ensure that a system is operating efficiently. This is important as systems may not function as desired and may need adjusting based on specific organisational contexts.
Michael SchweigerLocal Partner Attorney at law / Solicitor
Michael Schweiger, local partner, is a member of the Banking & Finance practice group in our Luxembourg office. He leads the Luxembourg financial regulatory team and regularly advises banks, e-money and payment institutions, insurers, and other clients regarding financial regulation.T: +352 466 230 520 E: firstname.lastname@example.org
Adrien PierreSenior Associate Attorney at law / Avocat à la Cour
Adrien Pierre, senior associate, is a member of the Banking & Finance Practice Group in our Luxembourg office. He advises banks, asset managers, fintechs, payment institutions, insurance companies and other financial institutions on regulatory matters.T: +352 466 230 523 E: email@example.com