Mandatory Whistleblowing Channel for companies

Having a mandatory whistleblowing channel in companies is a recommended measure and in some cases required by legislation and regulatory compliance regulations. It provides an effective means to detect and address situations of fraud, corruption, workplace harassment or other inappropriate behaviors that may harm the organization.

Some benefits of having a whistleblowing channel in accordance with the regulations:

• Promotes a culture of transparency and ethics in the organization.
• Allows to quickly identify and correct irregularities or regulatory non-compliance.
• Provides employees with a safe and confidential means to report inappropriate conduct.
• Helps prevent reputational and legal damage to the company.

The implementation of a whistleblowing channel in a company requires:
• Establish a clear policy and communicate it to all employees.
• Provide a secure and confidential system for receiving complaints.
• Designate a person or team responsible for managing complaints.
• Adequately investigate each complaint and take appropriate action.

The European Directive establishes minimum standards for the protection of whistleblowers and promotes the implementation of effective whistleblowing channels in the Member States of the European Union. These guidelines seek to strengthen the protection of whistleblowers and ensure that their reports are treated appropriately.

Law 2/2023 provides for significant penalties for failing to comply with the obligation to implement a reporting system or for failing to adopt measures to guarantee the protection of whistleblowers:

• Natural persons: from 1,001 to 300,000 euros, depending on the infraction.
• Legal entities: from 100,000 to 1 million euros, depending on the infraction.
• In very serious sanctions, in addition to the fine, the organization will receive a public reprimand and a prohibition from obtaining aid and/or contracting with the public sector.

No. The number of employees is not the only requirement to determine the obligation to implement a whistleblowing channel. Organizations with less than 50 employees may be required to do so if they meet any of these requirements:

• If they are political parties, trade unions, business organizations and foundations created by each other, provided they receive or manage public funds.

• If they are subjects obliged by Law 10/2010 on Prevention of Money Laundering and Financing of Terrorism (LPBC), regardless of their number of employees.
  Until now, their obligation was to implement an internal whistleblowing channel, only for their workers, but with Law 2/2023 it must also be accessible to anyone related to the organization.
  Some examples of obligated subjects are:

   

  • Companies in the financial and real estate sector.
  • Companies in the luxury sector: jewelers, art and antiques, watchmakers, nautical…
  • Companies in the gambling sector.
  • Tax advisers, accountants, insurers, auditors, law firms …
  • Those that carry out operations of more than €15,000.

• Private companies with a Compliance plan, even if they have less than 50 employees. Until now, their obligation was to implement an internal whistleblowing channel, only for their workers, but with Law 2/2023 it must also be accessible to anyone related to the organization. It must be taken into account that implementing a Compliance plan is useless if it does not incorporate a secure and confidential communication channel to alert about activities that violate the code of conduct of the organization.

• In the public sector, all public administrations are obliged regardless of their number of workers, except those belonging to municipalities with less than 1,000 inhabitants.

Firstly, some employees or stakeholders may not feel comfortable using their personal email to make a complaint, so they may feel discouraged or reluctant to use this method. While it is true that they can use an email address with an alias, so that they cannot be identified, it constitutes a deterrent barrier.

Secondly, sending a complaint to a common email address means that the information in the complaint will be very vulnerable to potential security threats. Emails can be intercepted, compromised or manipulated more easily than reporting channels exclusively designed for this purpose.

Thirdly, in most companies, the systems manager has access to corporate emails, so they could read confidential information if they wanted to and violate the confidentiality of the whistleblower, even without being an external attacker

Contact forms are a more secure way to make complaints than a simple email address, since the data entered in the form can be stored properly in the administration panel of the website, for example. They also allow the possibility of being anonymous, if the fields with contact information are not mandatory. However, they have some drawbacks.

If the complaint is anonymous, the complainant cannot be informed about the outcome of the complaint, since they will not have provided any contact information. The control body will also not be able to communicate with that person and ask for more details about what happened, if necessary.

Finally, opting for a whistleblowing channel application specifically designed for this purpose is an affordable investment for the company and provides significant advantages in terms of security, confidentiality and easy management. It is not appropriate for the company to risk being sanctioned for circumventing a specific reporting system, in order to save costs.

Yes, as it meets all the requirements, even allows you to report anonymously. But this should be in a place accessible to the public so that anyone related to the company can report: customers, former employees, suppliers, etc.

Thus, in most companies it will be necessary to implement some other reporting system complementary to the physical mailbox to ensure that anyone can make reports safely and confidentially.

The Whistleblowing Channel application is a secure and confidential communication channel between the whistleblower and the channel administrator. Therefore, the management of the complaint must be carried out by a company professional or an authorized third party. The law establishes a series of deadlines and procedures to be followed for the management of a complaint:

• The responsible person must give acknowledgment of receipt of the complaints filed, at the latest, after 7 days from receipt.
• If the complaint has a basis, an internal investigation will be initiated and/or a file will be opened to the reported person, in accordance with the company’s protocols. It is not necessary to keep the complainant informed during the process, but it is necessary to inform them about the decision within a maximum period of 3 months from the issuance of the acknowledgment of receipt.
• It is essential to preserve the confidentiality of the complainant, even if this person decides to identify themselves.

The Edorteam Whistleblowing Channel is a cloud application, its implementation can be done in less than 72 hours and it is very intuitive for anyone, so it does not require training or user manuals. The person responsible for managing the channel only needs 1 hour of training to learn how to manage it.

After the launch of the channel, you must publish a link to the Whistleblowing Channel on your corporate website, so that it is accessible to everyone.