In recent years, whistleblowing channels have become a key element in the prevention, detection and investigation of fraud and corruption in companies. It is critical, both in the private and public sectors, to have the appropriate human and technological means to counteract any type of fraud and corruption. These countermeasures include the implementation of secure alert channels, the proper examination by external experts of the communications made by whistleblowers and, if necessary, the subsequent investigation by external experts. Without all of the above tools and policies in place, whistleblower protection could be ineffective.

Remote work has created an unbeatable opportunity to test the degree of maturity of whistleblowing channels in organizations. In a remote context, such as the current one, where the "onsite" identification of irregularities in the company by professionals who perform internal audit or management functions may become weaker, whistleblowing channels must "make up" for this potential weakness. To do so, it is essential for companies to promote their use, guarantee the confidentiality and anonymity of whistleblowers, as well as provide their employees with adequate training on how to use them.

Trends in Whistleblower Reporting

According to the ACFE (Association of Certified Fraud Examiners) Report to the Nations 2022, whistleblowing channels were implemented in 54 percent of organizations in 2012, and channels rose to 70 percent by 2022. This significant increase over the last decade is a clear sign of the importance and relevance of whistleblowing channels within the different anti-fraud controls.[1]

Additionally, the ACFE report shows that 42 percent of fraud cases were detected through tips, followed by detection by internal audit with 16 percent of the cases, and third, by management review with 12 percent of the cases. As we can see, tips were by far the most common method for detecting fraud. Among the frauds detected through tips, the ACFE report points out that more than half (55 percent) were reported by company employees, 18 percent by their customers, and 16 percent were reported anonymously.

From this latest data a few items are critical to highlight:

1. It is vital for companies to make their employees aware of the importance of their whistleblowing channels because, as we can see, more than half of the communications of violations in the whistleblowing channels come from employees themselves. To this end, it is essential to provide employees with correct and adequate training on the use of whistleblowing channels and, in general, on the ethical principles and values that govern the activities of the company in question.
2. It is essential to provide employees with the necessary information (policies and procedures) on the use of whistleblowing channels.
3. It is important to enable the ability to submit anonymous reports through the reporting channels. For instance, in Spain, there is still a culture of reluctance to make reports which, among other reasons, is due to potential reprisals. Therefore, many people prefer to do so anonymously despite the fact that there is a requirement to maintain the confidentiality of the person filing the report.

An example of anonymous reporting can be found in the "DIRECTIVE (EU) 2019/1937 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 23 October 2019 on the protection of persons who report breaches of Union law" which indicated the following in Whereas 34:

Without prejudice to existing obligations to provide for anonymous reporting by virtue of Union law, it should be possible for Member States to decide whether legal entities in the private and public sector and competent authorities are required to accept and follow up on anonymous reports of breaches which fall within the scope of this Directive. However, persons who anonymously reported or who made anonymous public disclosures falling within the scope of this Directive and meet its conditions should enjoy protection under this Directive if they are subsequently identified and suffer retaliation.

and in its Article 6.3:

Persons who reported or publicly disclosed information on breaches anonymously, but who are subsequently identified and suffer retaliation, shall nonetheless qualify for the protection (...).[2]

Whistleblower Developments in Spain

In Spain, the Spanish legislator published Law 2/2023, on February 20, which regulates the protection of persons who report regulatory infringements in the fight against corruption. The Law’s article 7.3 states the following: "The internal reporting channels will even allow the submission and subsequent processing of anonymous communications." In this case, the Spanish legal system allows whistleblowers who make reports anonymously to be protected in the same way as if the report had not been made anonymously.[3]

Other articles of the new Spanish whistleblower protection law have generated some controversy in the Spanish business community. The first of these articles concerns the deadline for resolving reported complaints (9.2.d), which states the following:

The procedure shall establish the necessary provisions to ensure that the Internal Information System and the existing internal information channels comply with the requirements established in this law. In particular, the procedure shall respond to the following minimum content and principles: Determination of the maximum period for responding to the investigation actions, which may not exceed three months from the receipt of the communication or, if no acknowledgement of receipt was sent to the informant, three months from the expiration of the seven-day period after the communication was made, except in cases of special complexity that require an extension of the period, in which case, this may be extended up to a maximum of another three additional months.[4]

Conducting quality investigations into fraud, corruption, misappropriation or accounting manipulation in entities and companies of all sizes, sectors and in a multitude of jurisdictions can require highly complex work that can exceed the six month requirement under the law.

Another of the controversial articles of the Spanish law relates to the information required to be reported by the company to the Public Prosecutor's Office. Article 9.2.j. states the following:

The procedure shall establish the necessary measures to ensure that the internal information system and the existing internal information channels comply with the requirements established in this law. In particular, the procedure shall respond to the following minimum content and principles: Referral of the information to the Public Prosecutor's Office immediately when the facts could be indicatively constituting a crime. In the event that the facts affect the financial interests of the European Union, it shall be referred to the European Public Prosecutor's Office.[5]

Many companies and their counsel consider the Spanish legislator to have turned these whistleblowing channels into a "mailbox" of the Public Prosecutor's Office, so that the Public Prosecutor has the opportunity to know any potentially criminal fact that occurred within the company, which in principle could violate whistleblower’s right to remain silent and not to testify, as well as their right not to testify against themselves.

Finally, many of the communications reported through the whistleblowing channels reveal critical situations within the companies. If these reports are not handled correctly and relevant remediation actions adopted, it can lead to the failure of an organization’s codes, policies, procedures, processes and controls established to achieve an adequate ethical and compliance culture. To avoid this, companies should support the implementation of internal information systems and the preliminary examination of the information received through these channels.

Learn more