The new Whistleblower Protection Act is approved – here’s how to prepare for investigating reports

The Act is based on the EU Whistleblower Directive. It obligates large and medium-sized enterprises as well as public sector actors to establish an internal reporting channel through which the personnel, for example, can report suspected misconduct.

We discussed the basis and scope of application of the Act as well as establishing a reporting channel in our earlier blog.  In this blog, we will focus on how companies should process the reports.

Confidentiality and time limits for acknowledgement of receipt

An organisation must acknowledge to the whistleblower that a report has been received within three days of receiving the report. It must also inform the whistleblower of the measures the report will lead to within three months of receiving the report. When providing this information to the whistleblower, the time and manner of reporting on measures must be evaluated on a case-by-case basis. In addition to the confidentiality obligations, any detriment to the internal enquiry or investigation, among other things, must be taken into account while also keeping the rights of the reported person in mind.

The identity of the whistleblower, the reported person and any information from which their identity can be deduced must generally be kept confidential. However, this may be deviated from in the situations and in the manner referred to in the Act. Organisations must be familiar with the confidentiality and data protection obligations set forth in the Act and the deviations thereof in order to ensure that reports are processed and investigated in accordance with the confidentiality and data protection regulations.

Investigating reports requires resources and expertise

The person in charge of the investigation can spend a considerable amount of time on even a simple report: the more complex and extensive the report, the more time it takes to carry out a thorough investigation.

Organisations should allocate sufficient resources for the investigation and assess in advance the situations in which external resources should be used in order to avoid bottlenecks. Insufficient resources may lead to a delay in the investigation. In a worst-case scenario, the whistleblower might become frustrated and report the issue through a reporting channel maintained by the authorities or even disclose the information publicly, in which case the organisation no longer has the opportunity to conduct an internal enquiry first.

Resourcing consideration should also include ensuring sufficient expertise. The investigators should be well-versed in the regulatory environment with respect to the content of the report. In addition to applicable legislation, the organisation’s own internal guidelines are essential. Although the requirements set for expertise vary and are dependent on the content of any individual report, organisations should consider in advance what expertise they have internally and where they can find the expertise they lack in specific cases. The key here is to consider these matters before adopting a reporting channel. 

Plan the investigation process in advance

An effective and reliable internal investigation process requires clear rules. Organisations should analyse the investigation process by way of its main stages and draft a clear description of the process in advance, all the way from the pre-investigation stage to reporting and decision-making.

The process description should be flexible enough to adapt to investigating various issues but also sufficiently detailed and practical to be of use for the investigators. The process plan should also account for the documentation of the different stages and the investigation measures, so that in the event of a follow-up inspection, the measures taken and the grounds for the results of the investigation are clear.

The practical aspects of planning may include drafting task-specific checklists, for example.  It may not be possible to estimate the extent of an investigation at the early stages, which is why the initial practical measures are often quite similar. On the other hand, any errors made at an early stage may affect the integrity of the entire investigation and the credibility of its conclusions. It may be impossible to correct these at the later stages of the investigation if the errors concern, for example, securing the material subject to the investigation or ensuring the integrity of said material. Checklists significantly decrease the risk of crucial measures not being taken or being taken too late.