Checklist for handling of whistleblowing reports

In previous posts, we have gone through how to properly investigate whistleblowing reports and many other related topics. In this post, we therefore give you a checklist for handling whistleblowing reports. so that you can easily and smoothly ensure that you meet all the requirements by drawing a line over it.

The checklist will be at the bottom of the post. Before that, we will take a closer look at why the various points are on the checklist and why you should meet each point to ensure compliance with current legislation and the best practices available.

Protection of personal information

Protecting personal information is an important component in handling received reports, especially if the whistleblower has wished to remain anonymous but also to comply with applicable GDPR and other privacy laws. Even if you handle the majority of the reports internally, there may be situations where an external party needs to be involved. It is then especially important to protect the personal information of all parties involved.

Also read: Anonymous reporting in whistleblowing

Notifications & updates

When a new case comes in, it is good if the relevant staff who handle cases are notified immediately. This is because it allows  immediate handling or lets the staff perform any necessary measures. They should as soon as possible let the whistleblower know that the report has been received and that it will be handled.

If information on what the case process may look like is missing on the intranet or in your whistleblower policy, the whistleblower should also be informed about this now, for example how long a case takes to process, and when they can expect feedback.

Specially trained staff with routines and guidelines

In internal case management, it is important that the staff who handle cases are specially trained and have sufficient guidelines and routines to follow as there is a lot to keep in mind when handling cases. A good whistleblower policy can act as guidelines for case managers as well.

For smaller organizations, it can be problematic to have internal case management in place, partly due to the difficulty of finding sufficiently independent recipients, partly due to workload if very many cases come in and partly if very few cases come in, as it can be difficult to keep the investigative competence fresh. In these cases, it may be easier to use external case management. Visslan offers external case management by specialized lawyers who are cost-effective and professional to make it smoother for you.

Save time and energy with a good whistleblower policy

By having a good and informative whistleblower policy, you can ensure that you save a lot of time and energy in the future. This is because employees themselves can see the majority of the information about whistling before they themselves whistle. This ensures that the staff who handle whistleblowing cases do not have to answer the same questions every time someone reports.

If you are unsure of what you should include in your whistleblower policy or if you do not know how to formulate yourself, Visslan's standardized whistleblower policy may be helpful. You can then easily and smoothly build on this policy with things that are relevant or special to your particular organization.

Checklist

Whistleblower system

• Will the relevant staff handling cases be notified immediately when a new case arrives?
• Is there a whistleblower system in place for efficient and compliant case management, with the ability to delegate and invite external parties when needed in a secure manner?
• Are user logs created that can be used for follow-ups?
• Is any and all personal information stored in a secure and law-abiding manner?
• Is there support for deleting personal information in accordance with the GDPR if necessary?
• Is all data encrypted and protected against possible attacks?
• Is it possible for the whistleblower to see the status of their report?

Actions & follow-up

• Does the organization have guidelines and routines in place for handling and investigating the case?
• Inform the whistleblower that their report has been received and provide information on the circumstances of the case.
• Continue to update the whistleblower continuously during case management.
• Start an investigation and gather information to ensure that it is a whistleblower case.
• Delegate the information to an impartial group or person who carries out the investigation itself.
• Make sure to save all documentation from the investigation, for up to 2 years.
• Once the case has been handled, follow up with the whistleblower to ensure that they are well and not subjected to reprisals.
• No later than 2 years after the case has been closed, all data and documentation must be deleted.