Whistleblowing in the company: A competitive advantage
According to a study by the FH Graubünden, one in three companies had to deal with gross violations of their own code of conduct in 2020 - with consequential losses amounting to millions.
This finding highlights a widespread permanent problem for the efficiency of processes in companies. The EU has finally reacted and issued a directive on whistleblower protection with the Directive 2019/1937.
This so-called EU Whistleblower Directive should be transposed into German law with a Whistleblower Protection Act by December 17, 2021 at the latest. Whistleblowing has thus also reached Germany: the Whistleblower Protection Act obliges all companies with more than 250 employees (as well as municipalities with more than 10,000 inhabitants) to introduce a whistleblower protection system.
This has taken a long time, as whistleblowing is met with skepticism in Germany not only because of the experiences with state whistleblowers in two dictatorships of the 20th century. The obligation of employees to be loyal to their employer, which is codified in employment law, is also likely to be a factor.
In contrast, the positive role of whistleblowing in uncovering misconduct is beyond question. Yes, the spectacular revelations of the 2000s and 2010s about war crimes, governmental internet surveillance or tax evasion should prove that it is essential for a functioning economy and society.
All too often, the discussion about whistleblower protection systems only focuses on the costs of the investment, which are certainly considerable. However, these are offset by undeniable competitive advantages - provided that the Whistleblower Protection Act is implemented quickly and correctly.
For this reason, the following 8 steps will outline how to successfully implement the EU Whistleblowing Directive and, in parallel, highlight the competitive advantages of implementation.
1. Establish a corporate culture of integrity
Even before you initiate the implementation of the whistleblowing system, you should act proactively and establish or promote a culture of integrity in your company.
It is important that you not only focus on meeting minimum standards, but also work on a truly exemplary corporate culture that outlaws misconduct and violations. Only then will you have the chance to establish an environment in which whistleblowing is a positive thing.
Promoting a culture of integrity therefore means at least
- that all internal and external whistleblowers can make anonymous reports, even if this is not required by the EU Directive, and
- that the management exemplifies the ethical corporate culture and thus conveys that unethical or illegal behavior has no place in the company.
A corporate culture in which integrity is central is only a preparation for the establishment of the actual whistleblower protection system,
but it already represents a clear competitive advantage: Firstly, it is less likely that misconduct will occur to the detriment of the company, and secondly, employees feel valued when they are taken seriously in their efforts to implement guidelines for ethical behavior.
2. Promote an understanding of compliance in your company
Even in the initial implementation phases of the whistleblower whistleblowing system, you should now promote an understanding of compliance at all levels of your company.
This point is related to the point just mentioned, namely building a culture of integrity in your company. This is because a culture of integrity will either prepare such an understanding or already encompass it to some extent.
However, it is not the same thing: while the first point is more about a mindset and certain dispositions, by understanding compliance I mean an understanding of the structures and processes themselves.
After all, it is always to be expected that certain prejudices or reservations about a whistleblower protection system will exist: Doesn't this legitimize the blackening of colleagues? And won't it turn denunciations into a tool for normal workplace conflicts?
Therefore, the project must be explained in detail to all those involved in setting up a whistleblower protection system - in particular the management, all branch managers, department heads, the works council and, finally, the compliance officer. Otherwise, the broad support required to implement the system in practice may not be forthcoming.
It must be made clear that all sides benefit from the introduction. The focus will therefore be on two aspects:
- protecting the company from financial, image or reputational damage and
- protecting the whistleblower from reprisals or criminal prosecution.
As always, professional communication that reaches all stakeholders, your own employees as well as suppliers and customers, is ultimately crucial. It therefore makes sense to plan an introductory campaign in advance that covers all channels and explains the benefits of a whistleblowing system in a simple and understandable way.
3. Ensure transparent communication with all stakeholders
Next, you should ensure that you communicate as transparently as possible with all stakeholders, ideally by being open with reports, at least internally.
This in turn should increase the general acceptance of a whistleblowing system. After all, stakeholders are more likely to trust you if it is clear what ultimately becomes of reports and tips.
Of course: Whether you also inform the public must be decided on a case-by-case basis, as this can be advantageous, but does not have to be.
In any case, you can create trust through transparent communication by
- demonstrating that you take whistleblowing seriously,
- avoid giving the impression of trying to cover up misconduct, and
- show that whistleblowing works.
And this is another competitive advantage of the whistleblower protection system: you are more likely to do business with a trustworthy company than with one that you distrust.
4. Communicate the effectiveness of the system
One component of transparent communication with your stakeholders is important enough to emphasize separately: communicating the effectiveness of your whistleblower system, both internally and externally.
To do this, prepare an annual compliance report in which you report on the number and type of reports and the amount of damage, as well as any personnel consequences within the company or at a business partner or supplier.
It is important to communicate the effectiveness of your whistleblower system, both internally and externally.
Although such a compliance report strengthens your company's credibility, it primarily serves as a deterrent: If employees or suppliers who flirt with misconduct have to fear discovery, this can dissuade them from their plans and thus reduce the risk of internal misconduct within the company.
This is another competitive advantage that companies can gain from implementing the EU Whistleblower Directive: A whistleblower protection system acts as a deterrent and thus prevents misconduct.
5. Remedy misconduct quickly and consistently
Every time misconduct is registered, you should immediately set about remedying the misconduct consistently.
Because reporting alone is of course not enough. Each case must be separately examined, evaluated and dealt with accordingly.
The use of an external and therefore neutral consultant is a good way to do this. They can not only examine the tip-off and recommend appropriate countermeasures if necessary, but also identify the structures and processes that facilitated or caused the misconduct.
If you use an external consultant, you can also prevent cover-up attempts that employees involved may feel compelled to make in the face of impending consequences.
If the whistleblower sees that there are no consequences to their report, it is likely that they will turn to the authorities or the public. In this case, you would not only have lost control of the communication, but would also have to fear reputational damage and, in the worst case, fines.
The fact that you can keep your outward presentation under better control with an internal whistleblower system is another competitive advantage that you can gain from implementing the law to protect whistleblowers.
6. Optimize your compliance management system
Those who introduce a whistleblower protection system will optimize their existing compliance management system (CMS) for two reasons.
One reason is the need to subject the existing processes to a thorough analysis during implementation. This is because the requirements that the processes of a whistleblowing system must fulfill according to the Whistleblower Protection Act are quite extensive.
According to the EU Whistleblower Directive, these include
- the existence of clear and easily accessible information on the procedure for external reports,
- the prohibition of or refraining from reprisals against whistleblowers,
- the conscientious investigation of every report received,
- nominate an impartial person or department as responsible for follow-up,
- keep a record of each report,
- confirmation of receipt of a report within one week,
- feedback to the whistleblower within three months,
- protecting the confidentiality of the whistleblower's identity and
- protecting the confidentiality of the identity of third parties.
The analyses required to set up the whistleblower protection system thus provide conclusions about the actual status of the processes. And identify opportunities for optimization.
In addition, every report of grievances represents a test of the system. If it turns out that certain processes are working more badly than right, they provide targeted information for quality management and an opportunity to optimize processes.
The fact that the establishment and use of a whistleblower protection system contributes to the optimization of the CMS is therefore a further competitive advantage that can be gained from the implementation of the EU directive.
7. Have your compliance management system accredited
If you are further developing your compliance management system in connection with the implementation of the EU Directive or the Whistleblower Protection Act, you should take the opportunity to have your CMS accredited.
Until April 2021, the standard ISO 19600:2014 was decisive for the implementation and use of CMS solutions. This has now been replaced by the standard ISO 37301:2021, which offers the opportunity to have your CMS accredited by the German Accreditation Body (DAkkS).
Third-party accreditation naturally increases confidence in your company by demonstrating the management's willingness to protect whistleblowers and the quality of the implemented whistleblower protection system.
And that is a further competitive advantage.
8. Set up an external reporting office
The EU Directive or the Whistleblower Protection Act allows for different forms of implementation, but an essential tool is the establishment of an external reporting office.
Because it is not located within the company itself, such a reporting office minimizes the risk of being exposed for the whistleblower to a far greater extent than other options such as a telephone hotline or an email account. And this in turn makes it easier to report violations such as harassment in the workplace or fraudulent acts such as fraud, bribery or industrial espionage.
An external reporting office can therefore significantly increase the effectiveness of your whistleblower protection system. This is also supported by the preference for this instrument: 60 percent of companies with a whistleblower protection system work with an external reporting office.
In any case, you should plan to set up an external reporting office: it will be worth it.
