Whistleblowing in the private sector: the how matters
Some of the most well-known scandals, from LuxLeaks to the Panama Papers or Cambridge Analytica, surfaced because whistleblowers brought them to the attention of the authorities or the media. On 16 April 2019, the European Parliament adopted a new EU Directive on the protection of whistleblowers, aimed at both the public and the private sector. What action have private-sector companies taken to enhance reporting on suspected misconduct? And to what extent is such reporting needed and used? Moritz Homann is Managing Director Corporate Compliance at EQS Group AG, a company providing regulatory technology for corporate compliance with national and international disclosure obligations. Below, he presents some of the key findings of a recent study on internal whistleblowing in several European countries.
By Moritz Homann, EQS Group AG
Whistleblowing Report 2019 identifies frequent violations
Legal regulations or internal guidelines were violated at almost every second company in Europe’s core economies in 2018. This is just one of the findings of the Whistleblowing Report 2019 undertaken by the University of Applied Sciences HTW Chur, in cooperation with the EQS Group, which examines the state of internal whistleblowing in Germany, France, Switzerland and the UK. It also shows that while many organisations in the private sector have already implemented reporting channels, there is often room for improvement.
Whistleblowers help companies identify internal misconduct, minimise risk, and avoid fines and sanctions. Despite this, only ten EU Member States have passed laws to protect whistleblowers to date. The others now have until 2021 to transpose the new EU Directive on the protection of whistleblowers into national law. From an organisational perspective, many in these jurisdictions are being proactive and taking action ahead of the legal requirement to do so.
The Whistleblowing Report 2019 is based on almost 1 400 interviews with companies in Germany, France, the UK and Switzerland. Across all countries and company sizes surveyed, almost 60% of companies have implemented a whistleblowing channel through which employees and other stakeholders can report suspected misconduct. Across the jurisdictions, large companies, as well as banks and insurance companies, are more likely to have a whistleblowing system in place.
Damage prevention and promoting an ethical image are the main motivations
As for why these companies have proactively implemented whistleblowing systems, there are several reasons (see Figure 1). In addition to avoiding financial loss and promoting the company as being ethical and honest, one of the most important motives is that companies are convinced of the benefits and effectiveness of whistleblowing channels. These reasons also resonate with the third of other companies surveyed who currently do not have a whistleblowing system, because they are planning to implement one. The remaining companies, most of which are Small Medium Enterprises, do not yet deem it an important topic as it is not yet required by law.
Implementing internal reporting channels: talk to your stakeholders
Implementing a whistleblowing system affects the whole company. In our experience, it is important to include relevant stakeholders at an early stage. For example, the company’s management will ensure the right ‘tone from the top’. Ideally, they will openly support the reporting channel, explain its purpose and the benefits of having it in place for the company’s integrity and long-term health. In addition to management, other stakeholders include the labour union (where relevant) or employee representatives to make sure the channel(s) is/are designed according to their requirements, and the Data Protection Officer, to make sure personal data is handled in compliance with the General Data Protection Regulation. For internal communications, the communications department and/or Human Resources will also be important stakeholders.
Communication and clear responsibilities
This latter point is an important one. From our experience implementing internal whistleblowing channels within numerous organisations, one key topic often lacks prominence on the agenda: communication. Clearly, internal reporting channels can only be fully effective if all potential reporters are aware of the channel, how to use it and what to report, and are reminded on a regular basis. The study shows that the most common channels through which the whistleblowing system is communicated to employees and other stakeholders are line management, top management, the intranet and the Code of Conduct. The majority of organisations also have a separate policy or guidelines relating to whistleblowing, to which employees can refer.
Having clear responsibilities for case managers ensures that cases are dealt with quickly and efficiently, ensuring that reporters know their concerns are being taken seriously. The study reveals that the most common departments responsible for report handling are: compliance, management, human resources, legal or the Board of Directors. The relevant department depends largely on the company size: large, international corporations usually have a compliance department, whereas smaller companies will often rely on a shared function like legal or even the management team.
The more reporting channels, the more reports
The Whistleblowing Report 2019 shows that companies provide employees with an average of three whistleblowing channels. Companies with specialized reporting channels like a web-based reporting system receive more reports. In addition, the majority of companies make the reporting channels available to employees and at least one other stakeholder group (see Figure 2). The statistical analysis shows that the more stakeholder groups are allowed to report information, the higher the potential financial loss revealed by the reporting channels — thereby making the channels much more effective.
Only a fifth of organisations open their channels to the broader public. We would always recommend making the reporting channels as widely accessible as possible, e.g. public on the corporate website. In our connected economies, valid reports on misconduct can come from a plethora of sources. Excluding potential sources of information means that risk is not being identified.
The results also show the importance of providing anonymous whistleblowing channels, e.g. via a specialised web-based system. For companies that provide the option of reporting anonymously, 58% of initial reports are anonymous. This clearly shows that barriers still exist to people coming forward if anonymity is not guaranteed. Specialised web-based reporting systems enable dialogue between the company and the whistleblower, even if the individual decides to remain anonymous. In fact, experience shows that once whistleblowers have gained the necessary trust during this communication, they sometimes provide their identity so that they can better support the investigation.
Every second report points to misconduct
Providing an anonymous channel sometimes makes companies nervous that it will be open to abusive reports — the data shows that this is not the case. In general, more than 50% of incoming reports point to illegal or unethical behaviour in the organisation. By contrast, less than 10% can be categorised as ‘abusive’. The other reports normally point to other problems within the organisation which are important but not compliance-related.
When we look at aggregate figures, companies receive an average of 52 reports per year; this is across all company sizes and jurisdictions. Clearly, the number of incoming reports largely depends on the size of the company, the industry and the level of business activities abroad.
Talk about the outcomes
We are often asked what companies should do once a report is investigated and closed. Our advice is to let employees know what happened and what the consequences were — anonymously of course. The study shows that more than half of organisations do this already. This helps employees to better understand the types of issues that are relevant, and what the consequences are — more concrete than abstract examples in training sessions. Only a third of the companies also communicate back to the whistleblower about the consequences and around 10% communicate cases publicly. Our view is: the more transparency the better, as it creates trust.
Whistleblower reports identify financial misconduct
‘If you think compliance is expensive, try non-compliance’, goes one of the most famous sayings in the field. This is also reflected in the study. Of the companies who had cases of misconduct in 2018, 16% faced financial losses of more than €100 000. For another 26%, the financial losses ranged between €10 000 and €100 000. Fortunately, reporting channels helped uncover these damages before they ran into the millions and resulted in reputational damage. All companies with reporting channels in place confirmed that these channels had helped them identify at least part of the loss, and more than a third of the German and French companies identified over 60% of the total loss thanks to the whistleblowing system.
The results show: whistleblowing helps companies to identify and remedy misconduct with associated financial loss. For this reason, many companies have already set up whistleblowing systems without being under any legal obligation to do so. While only a minority of companies already offer specialised reporting channels, it is clear from the statistics that providing such channels increases the number of reports and therefore the ability to identify and manage risk. Furthermore, companies that have not yet set up any reporting channels would do well to address this at an early stage in the context of the EU Directive.
This article was first published on the 2/2019 issue of the ECA Journal. The contents of the interviews and the articles are the sole responsibility of the interviewees and authors and do not necessarily reflect the opinion of the European Court of Auditors.
