How to investigate whistleblower reports in the best way

When your organization receives a whistleblower report, it is important that it is handled correctly. You should have a functioning system that you continuously use on these occasions to ensure that all reports are handled in the same way and in the right way, both ethically but also with the prevailing legal requirements in mind.

For those of you who do not have an established way of handling whistleblower reports, you can start from five steps. The steps consist of the following:

1. Gather all the information you need about the report.
2. Delegate the investigation to an impartial person or group.
3. Give the whistleblower information about the conditions of the case.
4. Update the whistleblower continuously around the matter.
5. Follow up the case after closing and keep in touch with the whistleblower.

Does that sound complicated? With the right routines and skills, it can actually be easier than it sounds. We break it down into smaller parts to explain the steps further.

Step 1: Gather information

When receiving a whistleblower case, it is important to determine what the case is about. By collecting information from the whistleblower, and taking part in or requesting additional information if necessary, it is easier to determine whether it is actually a whistleblower case or whether, for example, it is another personnel matter that should be taken through other avenues within the organization.

You gather information by having a dialogue with the whistleblower about the situation, and by gathering information from the department that the case is about. Once you have enough information to be able to determine that it is a whistleblower case, you can proceed to step 2.

Step 2: Who handles the investigation?

When a whistleblower presents an event, or a case, it should always be investigated by an independent person or group. In many cases, the case can be handled by a group from the HR or the legal department within the organization. The main factor in these cases is that the persons involved in the investigation should not have any involvement in the case. A dishonest person can prevent the investigation and even threaten to close it, which can also be against the law.

Be sure to delegate the investigation to a credible person or group who in turn has no connection to either the department or persons concerned. In this way, you ensure that the investigation remains neutral and fair.

Step 3: Inform the whistleblower

For the whistleblower, it is important to know how the case is handled, how long it will take and if there is anything in the process that he or she should know. Try to be clear with the whistleblower about what is happening in the investigation and assure the person that the investigation is ongoing. This is also an important signal value that you take the matter seriously.

According to the Whistleblower Act, you as an organization need to give feedback to the whistleblower with the status of the investigation and any measures within three months, as well as confirm that you have received the case within 7 days. It is thus also important to ensure that not all recipients of cases are on holiday at the same time. Try to provide the whistleblower with all the information he or she needs and be clear that confidentiality applies and that the case may take longer depending on its scope.

Step 4: Update the whistleblower

Just as we talked about in step 3, it is important that the whistleblower is updated on how the case is progressing. The whistleblower has the right to know how far the process has come and what measures have been taken. Try to keep the whistleblower updated as much as possible without violating confidentiality or GDPR. If there is a risk that the whistleblower's identity will be revealed, feedback should thus be avoided.

It should also be borne in mind that the documentation from the investigation needs to be saved for future purposes. The entire investigation should be documented in writing and available to the person or group investigating the case to look back at afterwards. However, this must then be deleted no later than 2 years after the case has been closed.

Step 5: To follow up on a case

All organizations should aim to create a culture where it feels safe for employees to address issues and conflicts. It is therefore important that you follow up with the whistleblower even after the investigation has been completed. Find out how the person feels, if everything feels okay and how they experienced the whole situation. It is also important to ensure that the whistleblower has not been exposed to threats or the like after his report - then further measures need to be taken to ensure that it does not happen again.

Many whistleblowers prefer to be anonymous. In these circumstances, it may be appropriate to send out anonymous surveys to all employees to find out how they feel about reporting problems or flagging crimes through your whistleblower channel. If not many people know about the channel, it can be good to inform more effectively about it.

In summary

There you have it: 5 steps for how you as an organization handle a whistleblower case. If you still find it complicated, or need more help with how to proceed, you can contact us for more information on how to safely handle your whistleblower reports.