Guide to Whistleblowing

Contributing Editors

In this new age of accountability, organisations around the globe are having to navigate a patchwork of new laws designed to protect those who expose corporate misconduct. IEL’s Guide to Whistleblowing examines what constitutes a protective disclosure, the scope of regulations across 18 countries, and the steps businesses must take to ensure compliance with them.

Learn more about the response taken in specific countries or build your own report to compare approaches taken around the world.

Choose countries

 

Choose questions

Choose the questions you would like answering, or choose all for the full picture.

07. Should employers manage the reporting channel itself or can it be outsourced?

07. Should employers manage the reporting channel itself or can it be outsourced?

Flag / Icon

Australia

  • at Lander & Rogers

ASIC Regulatory Guide 270 notes that it is good practice but not mandatory that an entity has mechanisms in place for monitoring the effectiveness of its whistleblower policy.

ASIC suggests an entity could set up:

  • oversight arrangements for ensuring its board, audit or risk committee are kept informed about the effectiveness of the policy;
  • a mechanism to enable matters to be escalated to the entity's board or the audit or risk committee; and
  • periodic reporting to the board, audit or risk committee.

The guide also notes that entities may consider involving an independent whistleblowing service provider authorised to receive their internal disclosures. This is especially so for smaller entities. Using an outside service provider may encourage more disclosures since disclosers can:

  • make their disclosure anonymously, confidentially and outside business hours;
  • receive updates on the status of their disclosure while retaining anonymity; and
  • provide additional information anonymously.
Last updated on 23/08/2022

Flag / Icon

Belgium

  • at Van Olmen & Wynant

The reporting channel can be outsourced to a third party (eg, to a payroll provider, compliance experts or lawyers). However, the employer will remain legally responsible for the implementation and use of the system.

Last updated on 01/08/2022

Flag / Icon

Brazil

  • at CGM
  • at CGM
  • at CGM

There is no statutory requirement in this regard. Accordingly, employers can manage the reporting channel directly or outsource it to an external supplier.

Last updated on 29/07/2022

Flag / Icon
Croatia

Croatia

  • at Babic & Partners
  • at Babic & Partners

Under the WBP Act, the internal reporting channel is a WBP officer and their deputy, as appointed by the company. This officer and deputy are solely authorised to receive the whistleblowing reports and conduct investigations (ie, the conduct of these actions cannot be outsourced to any third person).

However, the WBP Act does not preclude companies from appointing individuals employed or hired by an external service provider as a WBP officer or deputy (noting, however, that the company may make such appointment at its own discretion only if these appointments have not been proposed by either the works council, or, if there is no works council, the union trustee, or if there is no works council or union trustee, by at least 20% of the  company’s employees).

Even if the company appoints individuals employed or hired by an external service provider, the appointed persons must keep confidential the identity of any whistleblowers and any information contained in the whistleblowing report, and will not be able to directly involve external service providers in the investigation without express consent from each whistleblower. However, the  company may engage an external service provider to indirectly assist these appointed persons (regardless of whether the individuals appointed are employed by the  company or by the external service provider, and regardless of whether the whistleblower provides express consent for disclosure of his or her identity and the content of the report), if such assistance will not lead to disclosure to that provider of the identity of the whistleblower and any information contained in the whistleblowing report.

Last updated on 29/07/2022

Flag / Icon

France

  • at Proskauer
  • at Proskauer

Employers can subcontract the management of the whistleblowing procedure to an external supplier, which will be in charge of:

  • setting up the reporting channel available;
  • receiving complaints; and
  • investigating the reported facts.

In practice and as an example, the external supplier can set up a telephone hotline or an email address for the collection of reports. These are then transmitted to the employer to decide on any action to be taken.

Last updated on 29/07/2022

Flag / Icon

Germany

  • at Oppenhoff
  • at Oppenhoff

In principle, the draft bill of the Whistleblower Protection Act intentionally does not specify which persons or organisational units are best qualified to carry out the tasks of the internal reporting office or to manage the corresponding reporting channel. However, the internal reporting office may not be subject to any conflicts of interest and it also must be independent. The EU Whistleblower-Directive mentions, for instance, the head of the compliance department or the legal or data protection officer as possible internal reporting offices.

If, in addition to the (internal) persons responsible for receiving and processing internal reports, other (external) persons have to be involved in a supporting activity, this supporting activity is legally only permissible to the extent that is necessary for the supporting activity. This applies, for example, to IT service providers that provide technical support for reporting channels.

It is also legally permissible to appoint a third party to carry out the tasks of an internal reporting office, including the reporting channel (section 14 (1) HinSchG-E). Third parties may include lawyers, external consultants, trade union representatives or employee representatives.

However, engaging a third party does not relieve the employer of the obligation to take appropriate action to remedy a possible violation. In particular, for follow-up actions to check the validity of a report, there must be cooperation between the commissioned third party and the employer.

Last updated on 29/07/2022

Flag / Icon

India

  • at Khaitan & Co
  • at Khaitan & Co

While the reporting channel may be outsourced, in respect of Covered Companies, the mechanism should be overseen by the Audit Committee or Board of Directors, as applicable.

Last updated on 29/07/2022

Flag / Icon

Japan

  • at City-Yuwa
  • at City-Yuwa
  • at City-Yuwa

The business operator may outsource the establishment of a point of contact to a third party, such as a subcontractor or parent company[1].


[1]   Id, Section 3 II (1)(i)(c), at p.7.

Last updated on 29/07/2022

Flag / Icon
Latvia

Latvia

  • at Ellex Klavins
  • at Ellex Klavins

The Whistleblowing Act allows employers to use third-party services for whistleblowing procedures. Therefore, the management of a reporting channel can be organised by outsourcing management service providers. On the other hand, such outsourcing cannot be used to implement group whistleblowing procedures (eg, to use a reporting channel established at a group level or in a related company).

Last updated on 29/07/2022

Flag / Icon
Lithuania

Lithuania

  • at Ellex Valiunas

Companies may outsource internal channel administration services to other companies providing such services or external third parties, provided that they ensure that the principles of independence, confidentiality and data protection are observed. Administrative services provided by third parties do not include the investigation of information about the breach and any subsequent decision-making.

Last updated on 29/07/2022

Flag / Icon
Luxembourg

Luxembourg

  • at Castegnaro
  • at Castegnaro

The legal entity may subcontract the monitoring of reports (articles 6 and 7 of Bill 7945).

Last updated on 29/07/2022

Flag / Icon
Nigeria

Nigeria

  • at Bloomfield LP

The reporting channel can either be internally managed or outsourced for transparency and objectivity.

Last updated on 29/07/2022

Flag / Icon

Portugal

  • at Cuatrecasas
  • at Cuatrecasas

The internal reporting channels may be operated internally or externally, and independence, impartiality, confidentiality, data protection, secrecy and the absence of conflicts of interest must be guaranteed.

Last updated on 29/07/2022

Flag / Icon

Romania

  • at STALFORT Legal. Tax. Audit.
  • at STALFORT Legal. Tax. Audit.

Both options are available for companies. At first glance, internal channels controlled by its own employees (auditors or compliance officers, in-house legal counsel or even an internal hotline) may be more effective for companies, since this ensures that potential wrongdoings are checked internally and do not compromise the image of the company. However, whistleblowers may not trust internal channels that allow easy identification of the individual whistleblower and are usually established to act in the best interest of the company (and not necessarily the whistleblower). Groups of companies must give more thought to the organisation; in many cases, outsourcing to third parties (eg, a recognized law firm) may be a better and more cost-effective solution.

Last updated on 16/08/2022

Flag / Icon

Spain

  • at Cuatrecasas
  • at Cuatrecasas
  • at Cuatrecasas

Yes, the management of internal reporting channels can be outsourced as established in section 6 of the Draft. However, a third party managing the reporting channel must provide adequate guarantees of respect for independence, confidentiality, data protection and secrecy. This third party would be considered a “data processor”, whereas the person or persons appointed by the company as “responsible for the system” will still be responsible for the reporting channel, even when it is outsourced.

Management of an internal information system by a third party should not undermine the guarantees and requirements established for this system in the Draft.

Last updated on 29/07/2022

Flag / Icon

Sweden

  • at Lindahl
  • at Lindahl
  • at Lindahl

Businesses may choose to manage reporting channels in-house or to outsource the management of reporting channels to third parties. Regardless, businesses should designate independent and impartial persons or departments (including third-party entities) to receive reports, maintain communication with whistleblowers, follow-up on reports and provide feedback to whistleblowers.

Last updated on 02/08/2022

Flag / Icon

United Kingdom

  • at Proskauer
  • at Proskauer
  • at Proskauer

The reporting channel can be outsourced. Where an employer’s whistleblowing policy or procedure authorises disclosure to a third party (eg, an external hotline), UK law will treat a disclosure to the third party the same as a disclosure to the employer.

The Department for Business Innovation and Skills guidance on whistleblowing identifies that larger UK organisations may have a designated team who can be approached to make a disclosure. The guidance recommends that smaller organisations should have at least one senior member of staff as a point of contact for whistleblowers. However, the guidance also acknowledges that there are commercial providers who can manage a whistleblowing process on behalf of the employer.

Last updated on 29/07/2022

Flag / Icon

United States

  • at Proskauer
  • at Proskauer

A reporting channel can be managed internally or outsourced.

Advantages of an internal reporting channel include:

  • better understanding of the organisation; and
  • better understanding of the context in which complaints may arise and be escalated.

Advantages of a third-party reporting channel include:

  • increased independence and transparency; and
  • broader expertise in handling whistleblower reports.
Last updated on 29/07/2022