Whistleblowing Management Webinar

A part of ICC Integrity Week we broadcasted a webinar on Whistleblowing Management Systems. The discussion was moderated by Lucianne Verweij, a specialist in Business & Integrity.

Geert Vermeulen of The Integrity Coordinator kicked off the webinar. He explained that there are good reasons for setting up proper whistleblowing management systems. For starters, each legal entity with 50 employees or more in the EU is legally obliged to do so, as well all entities in financial services and/or subject to anti-money laundering legislation. But more importantly, there are also good business reasons to do this. 

The Association of Certified Fraud Examiners for example consistently reported that around 5% of the revenue of organizations is lost due to fraud, while most of the frauds are discovered through whistleblowers. Other research demonstrates that companies with more reports actually perform better. This may seem counterintuitive, but it appears that when you have a good speak-up culture, problems can be identified and addressed at an earlier stage, leading to fewer investigation and litigation costs, fewer lawsuits and a better reputation. This will increase the trust in the organization and create a better, more creative work environment.

At the same time, there are also quite a few challenges and misconceptions. The legal definition of what constitutes a whistleblower report is quite complex and also varies from country to country. In The Netherlands, reports on unwanted behaviour can for example also be whistleblower reports, if certain conditions are met. An easy way to solve this issue would be to invite everybody to raise any concerns and promise not to retaliate, as long as the report is submitted based on reasonable grounds. 

Another challenge is who should be nominated to receive and follow up on whistleblower reports. According to Dutch law this person should be independent. According to EU legislation, this person should be impartial. In The Netherlands many companies appointed the confidential counselor as the recipient of the reports. However, this person should support the reporter and is therefore not impartial. Still, they should be properly trained on the legislation so they can inform potential reporters correctly.

Many employees would first raise their concerns with their manager. Or with the HR department. Or the HSEQ manager. It would not make sense to prohibit them from doing so. However, it is important that a manager recognizes a whistleblower report and has been trained on what to do when they receive one. For starters, they should ensure that it is registered in the central reporting register to ensure appropriate follow up on the report.

While managers can be one of the reporting channels, they are not impartial or independent. So somebody else should be appointed to receive reports as well. Managers also should not follow up on whistleblower reports. Not only do they often lack the knowledge and experience to do that, whistleblower legislation prescribes that the identity of the reporter should be kept confidential, unless agreed otherwise, so the management often should not know the identity of the reporter and therefore cannot provide the feedback to them. 

While organizations can have multiple reporting channels, it is important that at least one of them is independent and that everything ends up with a central coordinator and in the central register, which should be properly secured so that non-authorized staff, including the IT manager, does not have access to it. 

The best candidate to receive and follow up on whistleblower reports is an independent and authorized Ethics & Compliance Officer or Integrity Manager with an independence charter and a dual reporting line. And if you don’t have such a person, one can outsource this to an experienced third party. 

Professor Wim Vandekerckhove of the EDHEC business school indicated that the EU Directive and national legislation on the protection of whistleblowers provide minimum standards. Good practices can be found in the 2022 ICC Guidelines on Whistleblowing or in the ISO 37002 standard on Whistleblowing Management Systems. This standard promotes continuous improvement via the Plan Do Check Act cycle. Wim developed a free tool called SUSA: Speak Up Self Assessment, allowing professionals to self-assess how well their system aligns with the EU Directive and with best practices. The tool will provide suggestions on where one can improve things. 

Some conclusions can be derived from what people have filled in so far. It is surprising to see that many of them do not manage to always confirm the receipt of a report within 7 days, which is a relatively simple legal requirement, neither do they provide the mandatory feedback to the reporter within three months. On other aspects there is a lot of room for improvement as well. Often there is no plan on how to protect and support whistleblowers. And the functioning of the system is not evaluated. 

Geert indicated that this is remarkable, because in The Netherlands the management should report annually to the Works Council on developments regarding the whistleblowing procedure. 

Following up on a question of an attendee, Wim added that is important to discuss the outcome of the self-assessment with various stakeholders and it may be useful to include outsiders in that discussion. It is also important to explain how the process works. 

Marijntje Zweegers of the Dutch Whistleblowing Authority used the opportunity to launch the English language version of a free online tool, the Integrity Guide, where one can self-assess the Integrity System of your organization. It contains important elements like leadership, strategy, culture, values, procedures, communication, reporting, enforcement and accountability. Completing the self-assessment will provide a good view on where the organization stands. The Integrity Guide has been used hundreds of times already and the statistics show that there is still a lot of room for improvement here as well.

Marijntje also referred to a Dutch employers survey that indicated that 60% of Dutch organizations had not adapted their whistleblower procedure to comply with the current legislation. Also, over 80% of the hundreds of people who reach out to the Authority mention that they have experienced retaliation. 

Geert responded that it is a common misunderstanding that people think it always ends badly for the whistleblower. Every year millions of whistleblower reports are submitted and only a small percentage of whistleblowers face retaliation. However, these are the stories that we read about in the press. And these are the people who reach out to the Whistleblowing Authority. He is convinced that the majority of the reports are handled without too many problems.

This does not take away the fact that retaliation does occur sometimes and measures should be taken to prevent it. There is an important role here for the coordinator of the whistleblowing procedure. Other companies have also appointed specific people who protect reporters from retaliation. Another good practice would be to launch anonymous channels. You can’t retaliate against somebody if you don’t know who it is. 

Marijntje added that it is important that employees feel free to raise concerns and that employers handle these properly. It would also help if the Whistleblowing Authority would get oversight and sanctioning authority. Wim agrees that the authorities should get more teeth to get a higher percentage of companies to comply with the guidelines.  

Lucianne took a moment to stress the role of the leadership. Do they really mean what they are saying when they promise not to retaliate? According to Wim the system should not stiffen the discussion. Leaders should promote psychological safety and discussability. Geert added that it would help if management shows some appreciation for whistleblowers from time to time. 

Please send an email to info@deintegriteitscoordinator.nl if you would like to watch the recording of the webinar.