Whistleblowers: The In-house Perspective
This is an Insight article, written by a selected partner as part of GIR's co-published content. Read more on Insight
21.1 Initial considerations
Most whistleblowing policies provide several channels for staff to raise concerns. These often include the staff member’s line manager (or a more senior manager), human resources, audit, legal, compliance or dedicated ethics, or integrity, departments.
The desired culture of any corporate must be that staff feel entirely comfortable raising concerns with their immediate line manager, who in turn will escalate the issue to the appropriate department. Should whistleblowers prefer not to go to their line manager, they should feel able to approach someone in the organisation they trust. The culture corporates should aspire to must be one where employees may raise concerns with the full confidence they will be treated with respect, will be taken seriously and will suffer no retaliation in any form.
From an in-house perspective, it is always an initial concern that an employee has not had sufficient confidence in the organisation to raise the matter via internal personnel in the normal course of business. Resorting to the whistleblowing channels sends a message itself, and more so if the employee has chosen to remain anonymous. Monitoring and analysing whistleblowing cases can provide a measure of the organisation’s culture and confidence levels for raising concerns. While much depends on the nature of the concern, the tone from the top and creating a culture that speaking up is the right thing to do are imperative. Many organisations now include questions in employee opinion surveys to try to gauge the level of confidence staff have in raising their concerns. Some other initial considerations are pointed out below.
- Culture: Creating a culture in which staff have confidence to raise concerns internally is becoming increasingly important as some regulatory authorities now mandate regulated firms to include regulatory whistleblowing hotline numbers and email addresses in corporate whistleblowing policies, for example at UK branches of overseas banks.2 Additionally, proposals to extend the scope of whistleblower awards, for example the US Securities and Exchange Commission’s proposal to allow awards based on information from a whistleblower that leads to deferred prosecution agreements and non-prosecution agreements entered into by the US Department of Justice,3 if adopted, raises the possibility of direct reporting to regulators bypassing internal reporting channels.
- Anonymity: Anonymous whistleblowers can deny the investigator the opportunity to open a constructive dialogue to seek further information, put matters into context and limit feedback. A key challenge for the investigator is why the whistleblower wished to remain anonymous. It can be helpful to simply ask the question if there is a communication channel, such as webmail, open with the whistleblower.
- The nature of the allegation and motive for reporting: While investigators should always keep an open mind, the motive of the whistleblower often becomes apparent as the facts are established. If a dialogue with the whistleblower exists, they can be asked their motive for reporting.
- Duration: How long the alleged conduct has been taking place is material. Aged issues can present problems such as records retention periods. In addition, because of staff turnover, accessibility to ex-employees can be a problem.
- Existing knowledge from another source: Investigators should check corporate records, such as audit, risk, legal and compliance, to check if the alleged activity is known and was previously or is currently the subject of investigation.
- Need for external counsel: Investigators should lean towards caution during the initial review of a whistleblower allegation and take legal advice at an early stage. Assessment of the legal risks by an internal or external lawyer will prevent problems arising later if the investigation uncovers serious wrongdoing.
- The welfare of the whistleblower and duty of care: Investigators should keep in mind the welfare of the whistleblower. For most it will not have been an easy decision to speak up. Stay mindful of health and performance impacts – and the legal risk of these to the organisation.
- Protecting the whistleblower from retaliation: In the event that a whistleblower is identified, immediate steps may need to be considered to prevent retaliation. These could include moving the whistleblower to another part of the organisation, or transferring to an alternative line manager. Much depends on the nature of the case.
21.2 Identifying legitimate whistleblower claims
Given the wide range of concerns raised by whistleblowers, distinguishing between legitimate and non-legitimate allegations should be dictated by the facts gathered during the investigation. In some cases, a prompt review of the matters alleged by a subject-matter expert can quickly point to whether something is ‘off-target’ or requires further investigation. During the normal course of document examination, email reviews, staff interviews and data analysis generally the allegations can be substantiated or disproved. While some allegations will always be inconclusive, more frequently in human resources cases, generally a determination can be reached on the facts. Whistleblowing cases that contain multiple allegations require a detailed breakdown of each allegation as some parts may prove substantive while others will be off-target. Whistleblowing allegations are never suited to a one-size-fits-all approach and much depends on the nature of each case.
On receipt of a whistleblowing allegation, first steps should include checks to ascertain if the matters raised are known or the subject of an ongoing or previous investigation.
Generally, allegations can be split into three categories:
- material allegations that expose the corporate to regulatory action, civil claims or criminal investigation. These require experienced legal advice and depending on the jurisdiction investigation by external counsel to preserve privilege and advise the corporate accordingly;
- allegations of wrongdoing, including internal fraud and breaches of the code of conduct or policies and procedures. These generally can be investigated by internal corporate investigators, or external forensic firms with internal or external legal advice and oversight if required; and
- behavioural allegations such as bullying, harassment, inappropriate relationships, etc., which can generally be investigated by human resources or independent line management. Allegations of a sexual nature may require specialist investigative expertise. The nature of these allegations should be reviewed to consider who is best suited to undertake the investigation. The #MeToo movement has seen an increase in sexual allegations that may require specialist investigative, legal and victim care management.
21.3 Employee approaches to whistleblowers
A key component of any corporate whistleblowing policy must include a zero-tolerance approach to any retaliation against a whistleblower. Retaliation or perceived retaliation against a whistleblower raises cultural and legal risk, and undermines the effectiveness of a whistleblowing programme. Frequently during whistleblowing investigations, especially ones involving allegations of wrongdoing by senior management, interviewees speculate as to who the whistleblower might be. Ideally, in the absence of a legal obligation to do so (e.g., in litigation or in some jurisdictions) it is preferable that there is no such disclosure.
Speculation among staff should be discouraged, as it can increase the risk of retaliation.
Retaliation against whistleblowers can take many forms; examples include silence, isolation, inappropriate remarks, threats and work sabotage. In the event that a staff member or number of staff members are acting inappropriately towards a whistleblower, action will need to be taken.
Good investigation process separates the collection of facts and evidence gathering from decision-making to determine outcomes. This is particularly important when an investigator is putting forward information concerning retaliation against a whistleblower. As a general rule the investigator should not be involved in the sanctions or enforcement actions against retaliators – it is a separate legal and HR issue.
If the whistleblower’s identity is known, dialogue should take place about the treatment the whistleblower is receiving and whether he or she has disclosed to anyone that they have raised the matter. Special care is required if the retaliation is by a line manager. The whistleblower should be given an opportunity to express his or her expectations and view as to what could be done. Investigators should be mindful that the organisation will generally have a duty of care and the whistleblower could take action against the organisation in the future.
Frequently whistleblowers experiencing retaliation or those believing they are being treated differently suffer health problems, such as stress leading to time off work. In these circumstances, referrals via human resources to confidential staff welfare support schemes should be considered. In determining the action to be taken against staff involved in retaliation against a whistleblower, the investigator should consult with human resources, legal, compliance and business management functions for the next steps, which could include disciplinary action up to and including dismissal.
Appropriate action taken against those who retaliate against whistleblowers can send a strong message to reinforce the culture of the organisation.
21.4 Distinctive aspects of investigations involving whistleblowers
Corporates with in-house investigation departments generally have investigation procedures in place that also apply to whistleblowing cases. The substantive difference is how the matter was raised. Investigators should proceed with the protection of the whistleblower as a top priority. Thought should be given to lines of enquiry or staff interviews that could identify the whistleblower. The general rule to note is that it is the matter under investigation that is the issue, not how the matter came to the organisation’s attention.
Investigators should check if local law requires disclosure that the matter was raised as the result of a whistleblower. It is generally not a requirement in law to disclose to those facing allegations that the matter under investigation was raised by a whistleblower.
A good example of an exception is France, where it is generally required that accused persons be informed of whistleblowing allegations made against them so they may respond to them. They also have protection against malicious allegations. In this respect investigators should be mindful that, in the rare cases of malicious allegations, the alleged party, or the employer, may consider legal action against an identifiable whistleblower.
Equally, as with many investigations, consideration must be given to the collection and recording of personal data. Legal advice should be taken on data protection obligations, as again, in some jurisdictions such as France, an accused person may be informed of the accusation and have a right of challenge when his or her personal data is recorded during a whistleblowing investigation.
With the protection of the whistleblower and disclosure obligations at the top of the investigator’s priority list, it is important the internal investigation proceeds as with any other investigation to establish the facts. Establishing a dialogue with the whistleblower, if possible, allows for further information, context and feedback to take place. It can be that allegations are raised in good faith but are off-target owing to facts unknown to the whistleblower.
In the event the allegation, or allegations, are substantiated and lead to regulatory enforcement action, litigation by way of civil claims or criminal investigation, or all three, it may be that the identity of the whistleblower, if known, must be disclosed. Investigators should be mindful not to give whistleblowers definitive commitments of non-disclosure, even if authorities have whistleblower protections in place. In serious cases, this aspect requires early legal advice when the allegation is first received and assessed, as the legal risks will require consideration.
Everyone involved in the whistleblowing investigation and management process should remain aware that whistleblowers are free to speak to whomever they wish and this can include law enforcement, external regulators and taking their own external legal advice. Specialist legal advice should be taken in respect of employees who have raised concerns where the employer is considering reaching a settlement involving a non-disclosure agreement. Some jurisdictions consider these counterproductive to the aims of whistleblowing programmes. In the United Kingdom, the All Party Parliamentary Group on Whistleblowing4 has called for legislation to ban the use of non-disclosure agreements for whistleblowers.
21.5 The covid-19 pandemic and whistleblowing
The pandemic has seen a significant increase in whistleblowing cases reported in the public and private health sector. In addition to health, since March 2020, regulators have been receiving an increased number of fraud and financial misstatement whistleblowing reports. This trend is likely to continue as the economic downturn takes hold. Whistleblowing reports traditionally rise in times of economic stress, and this pandemic has brought new challenges. The imposition of public health protection measures across the world has seen unprecedented numbers of employees working remotely from home. From an in-house perspective this has resulted in whistleblowing investigations being conducted remotely because of enforced travel bans and respect for social distancing. Organisations should ensure all whistleblowing channels are working effectively. In-house procedures should remain unchanged and protection protocols reinforced to ensure employees working remotely and potentially feeling isolated from colleagues are confident that organisations continue to take whistleblowing seriously and they are protected from retaliation. From a practical perspective, in-house investigators, lawyers and external counsel have become well versed in remote interviewing and investigating using audio and videoconferencing. Equally, many employees have now adapted to video meetings and conferences. While these technologies were widely used by many organisations the pandemic has brought about a new normal in remote working, which is expected to continue. Whistleblowing professionals will equally need to adapt. Ensuring confidentially can be maintained with an audio or video meeting with a whistleblower will require investigation procedures to be amended to cover security. If they are to be recorded, appropriate legal advice on privilege and consent should be obtained. Aside from the challenges of working remotely, such as building a rapport and maintaining regular contact with the whistleblower for feedback and welfare, the whistleblowing investigation process should proceed as normal.
21.6 The European Union Whistleblower Directive
Directive (EU) 2019/1937 5 requires Member States to implement legislation (by 17 December 2021) to protect whistleblowers who report violations of EU law. Member States will decide if their transposition of the directive covers breaches of national law as well as EU law, and they may extend national legislation to encompass a broader scope or stricter standards. The directive should be viewed as providing the minimum standards. Practitioners conducting investigations in member states in organisations with 50 or more workers should check the local legislation for regulation on protecting the confidentiality of whistleblowers and the investigation.6 The requirements to promptly acknowledge receipt of reports and provide timely feedback should also be clearly understood. As the directive seeks to increase protection for whistleblowers, those responsible for investigating whistleblower reports should be wary of lines of enquiry that could identify whistleblowers and leave them open to retaliation. The directive includes no obligation to respond to or investigate reports from anonymous sources; however, generally in-house practitioners are encouraged to look at the nature of the allegation rather than how it was communicated. Following up with whistleblowers who make anonymous reports without compromising anonymity is easily achieved.
21.7 International Standards Organisation whistleblowing management systems
In July 2021, the International Standards Organisation (ISO) published ISO 37002, Whistleblowing management systems – Guidelines.7 The standards provide guidance for managing the whistleblowing process end to end. Many in-house whistleblowing management practitioners will find the standards useful guidance. For organisations in regulated sectors, compliance with the standards will assist meeting regulatory expectations. From the in-house investigations’ perspective, the guidance points to specific standards for managing whistleblowing investigations that will be useful.
The guidelines define a whistleblowing investigation as a systemic, independent and documented process for establishing facts and evaluating them objectively to determine if wrongdoing has occurred, is occurring or is likely to occur, and its extent. An investigation can be an internal investigation conducted by the organisation or by an external party on its behalf. It can be a combined investigation.
The guidance outlines principles for the management of whistleblowing investigations which include, but are not limited to, the following:
- Investigations should be adequately resourced.
- Clear terms of reference and scope should be defined and documented.
- The investigation process should be robust enough to withstand administrative, operational and legal review. An audit trail should be maintained relating investigation activities back to approved plans. The investigation should consider any subject of a report as being presumed innocent.
- The investigation should not directly or indirectly interfere with a judicial investigation. It should cooperate where appropriate or required.
- The investigation should secure and protect evidence.
- The personal data should be managed in line with data privacy and protection, law and regulation.
- The investigation should protect any information that could identify any subject of a report.
- All investigations should be able to scale and adapt as the circumstances can change as the investigation progresses.
- Communication should be clear and unambiguous, balancing the interests of organisations and whistleblowers.
- Organisations should communicate regularly, including material progress, in the form of feedback to the whistleblower.
On the protection of whistleblowers, the guidance recommends conducting investigations in a manner that preserves confidentiality to the extent possible and appropriate to ensure the subjects are not exposed to reputational harm, with information shared on a strictly need-to-know basis.
In-house whistleblowing investigation practitioners will welcome the ISO whistleblowing guidelines as a useful addition to the growing library of best practice resources available on this topic.
1 Steve Young is the CEO of the Association of Corporate Investigators and head of fraud and investigations at Banque Lombard Odier & Co Ltd.
2 See https://www.fca.org.uk/publication/policy/ps17-07.pdf.
3 See https://www.sec.gov/news/press-release/2018-120.
5 Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law, available at https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32019L1937.
6 Following its departure from the European Union, the United Kingdom is not required to implement the Whistleblower Directive. Despite Protect, the whistleblowing charity, urging the UK government to bring the new provisions into domestic law, there are no proposals to do so.