Whistleblower protection is integral to fostering transparency, promoting integrity, and detecting misconduct. Past cases demonstrate that corruption, fraud, and wrongdoing, as well as health and safety violations, are much more likely to occur in organisations that are closed and secretive. In many cases, employees will be aware of the wrongdoing, but feel unable to say anything for fear of reprisals, concern about acting against the organisation’s culture, or lack of confidence that the matter will be taken seriously. The negative implications of this are far-reaching for both organisations and society as a whole. Effective whistleblower protection supports employees in “blowing the whistle” on corruption, fraud or wrongdoing. However, one of the questions that arises is how should a whistleblower report be evaluated?
Almost all whistleblowing reports are evaluated quickly due to the urgency of the matter. However, if an evaluation is completed without taking fundamental steps or necessary planning, it may result in an improper investigation and eventually the inability to resolve the issue, or even the undertaking of an unnecessary investigation.
EVALUATION OF WHISTLEBLOWER REPORTS
The majority of whistleblowers are employees and are generally more cooperative in comparison to outsiders. However, some matters reported by employees may become a labour law issue if no conclusion can be reached. Even if the information reported by the employee has no standing, it may provide evidence of potential corruption that could lead to an investigation or highlight compliance measures that should be taken by the company.
Therefore, the evaluation should be dealt with quickly and take into account not only the objectivity of the information provided, but also the whistleblower – and particularly whether the matter concerns a personal grievance or groundless allegation.
The whistleblower should be given sufficient information about the steps that are taken if the report is not made anonymously. A considerable number of anonymous whistleblowers are anxious to receive feedback, frequently corresponding through temporary emails.
Such correspondence could enable the examiner to obtain more information about the extent of the incident, as well as the evidence that should be collected. Where the company will not take action against reported incidents, the whistleblowers may consider reporting the allegation to outside sources; this could make it almost impossible to investigate and control the incident.
The classification of the incident is key to determining whether it should be investigated by the company. In some cases, it may be necessary to report the incident to other competent authorities directly, such as a parent company or judicial authorities (eg, the police or the prosecution office). This may be done for the purposes of collecting evidence, but it may be necessary if the incident constitutes a crime (eg, fraud, theft or breach of trust). In this case, those responsible for evaluating the incident must inform the legal authorities, as it is an offence not to do so in many jurisdictions.
The competent authorities should be notified within a reasonable time after completion of the evaluation or the follow-up investigation, when it became evident that a crime had been committed. However, it is important to consider whether the relevant offence resulted in damages. In some cases, offences which have already been committed and have consequences that cannot be remedied need not be reported to the authorities, and instead may be dealt with internally.
The evaluation of incidents involving only employees or third parties was altered by improvements in auditing and inspection systems making the distinction between the terms increasingly difficult. Now, considerable internal abuse cannot be conducted without the involvement of third parties (eg, customers or service providers).
During evaluation, it is necessary to determine the risk impact and effect of the incident on the company, and whether and how far it will affect other employees or business partners (eg, suppliers or customers); the incident may lead to serious consequences for the company, beyond any cash losses already incurred or those likely to be incurred in future (eg, reduced market share, large financial losses and business losses). Similarly, reputational risk and loss of confidence from customers and business partners should be taken into consideration.
Evaluations must be conducted by a team rather than an individual. The team may span different areas of expertise and its members should be determined on a case-by-case basis. For example, members could include:
- a compliance manager;
- an internal audit manager,
- legal consultants;
- a financial director;
- a management representative;
- a human resources manager;
- an IT manager; or
- audit committee or ethics committee members (or equivalent).
Those who have had a hostile relationship or any conflict of interest with the whistleblower should take no part in the evaluation process.
In major abuse allegations especially, it is essential to include internal or external attorneys in legal analysis and evaluation. In practice, external attorneys are also hired and most evaluation meetings are held at law offices in order to maximise the benefits of attorney-client privileges.
Whether the reported incident can be verified by an objective investigation and whether it may be possible to collect concrete evidence during a further in-depth investigation must also be considered. Therefore, the availability of the following evidence should be taken into consideration during evaluation:
- telephone records;
- computers; and
- other communications.
An investigation should not be conducted where an incident cannot be verified under further investigation or there is no available evidence.
Other evaluation criteria vary across different businesses and sectors. However, a common criterion is the reliability of the whistleblower. Although all employees should be treated equally under labour law, in practice, the reliability of the employee who reported the incident is taken into consideration.
Examination of the criteria and issues during the initial evaluation should be assessed quickly and the decision as to whether to conduct an investigation should be made as soon as possible. As time passes, concerns about confidentiality may arise; the whistleblower may lose confidence in the company or assume that the company will not take action. This could mean that what should have been a simple internal investigation may be reported to judicial authorities or the press, resulting in the loss of reputation or business unnecessarily.
Therefore, in addition to the policies intended for establishing the company's ethics culture and awareness on anti-corruption, it is vital to adopt a policy on the evaluation and treatment of future whistleblowers, inform employees accordingly and train decision makers in the company.