Should the whistleblowing channel be on the website or intranet?

As one of the most common questions when launching a whistleblowing program, we are often asked it. Some even set up two separate reporting channels: one on the intranet and one on the public website, because of the confusion. While there is no absolute right or wrong, we have once and for all come to a conclusion. While this has its exceptions, it is safe to say that almost all organisations can follow this rule, small as large, public as private, EU as non-EU.

It must be noted that this article is based upon the EU Whistleblower Directive (2019/1937) and not national legislations, where differences may occur.

Let’s first explore why this has caused such a heated debate and then the options and why they might be right or wrong.

Who must actually be able to report?

The root to the problem originally lies within the question of who must be able to report through the internal reporting channel. The confusion to this question arises from mixing up who is protected with who must be able to report internally. 

Who is protected? First and foremost employees, but also anyone else that is or has been working for the organisation in the past, as well as many other related groups such as suppliers are protected as whistleblowers under the law.

Who must be able to report internally? Current employees, volunteers, trainees etc. A simplified way of looking at it is anyone that is currently a “worker”. There is a possibility to widen the internal reporting channel to all who are protected under the Whistleblower Act.

In short: When speaking of who is protected, many believe that all these groups must be able to report internally. That is not the case. The protection that this new legislation offers is far broader and intends to protect against various types of retaliation and thus supporting the uncovering of “secrets” or wrongdoings just as well if the whistleblower is a current or former employee.

Those who must be able to report through the internal whistleblowing function are therefore those who are currently working in the organisation in some way, if not willingly broadened.

Camp 1: “The reporting channel needs to be available on your public website”

There are many who claim that the reporting channel needs to be available on your public website and it could be for various reasons. Overall, it depends on what they mean with “needs to”. 

Why Camp 1 is wrong

According to the EU Whistleblower Directive, it is fairly clear that this is not a requirement. The Directive even lists an intranet as a possible place to have the reporting channel.

The “broadening” of the internal reporting channel could be decided by any Member State and thus be the case in a national implementation of the Directive. However, as far as we know, no EU Member State has done this.

Why Camp 1 is right

Those who speak for this “need” may well be referring to something beyond compliance: the actual benefits of whistleblowing. Having your whistleblowing platform on your public website may actually benefit your organisation in many ways.

If one of your suppliers suspect fraud, they can report it to you directly. If an ex-employees has gained the courage to tell about a serious wrongdoing after they quit, they have the possibility to do that. If someone from the public has found a serious flaw, they might give you the chance to correct it before going to the media. Not to mention the possibilities of using your whistleblower system as an employer branding-tool and enhancer of public trust.

READ ALSO: 6 Benefits of Whistleblowing

Camp 2: “It is enough to have the reporting channel on the intranet”

Some claim that having the reporting channel on the intranet is enough, but we rarely hear arguments for why that is actually the case. Let’s dig deeper.

Why Camp 2 is right

Looking at the EU Whistleblower Directive, Camp 2 is most probably right in terms of compliance. There is no direct requirement for a whistleblower to be able to report through the public website. As mentioned, please double-check with your national legislation if they have made a different standpoint.

Why Camp 2 is wrong

In terms of compliance with the EU whistleblowing laws, it is unfortunately not this simple. The first question one as a follower of Camp 2 must ask is if those who must be able to report truly have access to the intranet. In some organisations with part-time employees, volunteers or such, that may not be the case. 

Furthermore, are externally hired consultants to be considered “workers”, and do they therefore need to have access to the internal reporting channel? This remains unclear.

The conclusion

While it is not necessarily to be regarded as a legal requirement, Visslan has come to the conclusion that the internal reporting channel should, in most cases, be made available on the public website. Here’s why:

1. Avoiding legal grey areas in e.g. national legislation
2. Less preparative work by instantly letting everyone have access to the reporting channel (if e.g. consultants, part-time employees or volunteers don’t have access to the intranet)
3. Making the solution long-term sustainable, if changes must be made due to future precedents
4. Having the chance of learning about serious wrongdoings from e.g. suppliers, previous employees or the public, before they reach the media or grow uncontrollable

The conclusion is mainly based on the fact that having the reporting channel on the public website means that the question of “who must have access?” must not even be brought up to discussion and that your organisation can receive valuable reports it wouldn’t otherwise receive from e.g. suppliers. It is still clear however that there is no direct legal requirement to have it available on the public website.

Our conclusion may not be the right one for your organisation. For example, well-known D2C brands could wrongly receive ordinary customer complaints.

We want to hear your thoughts! Whether you agree or have a different opinion, we’d love to hear from you.