Query

Please provide an overview of solutions to common challenges when establishing whistleblowing mechanisms within an organisation, including evidence to support these.

Background

Information provided by whistleblowers is one of the most common ways in which fraud, corruption and other wrongdoings are identified (UNODC 2015). Often, these individuals are reporting misconduct that has taken place within their own workplace, in both the public and private sector. And while whistleblowers can make these reports through an external channel, such as to an oversight authority or to the media, studies suggest that they typically will report through an internal system within their organisation first (Bachner and Mansbach 2010). Organisations can have reporting or complaint systems to address personnel and workplace grievances alongside internal whistleblowing mechanisms (Terracol 2022, 15). There will be some overlap in the scope; for example, harassment and discrimination can be reported through both a complain system and an internal whistleblowing channel (Terracol 2022, 15).

An organisation’s internal whistleblowing system should invite reports of any suspected wrongdoing committed in, by, or for the organisation on any act or omission that is unlawful, abusive or could cause harm (Terracol 2022, 14). These acts or omissions are, but not limited to, corruption in all its forms, criminal offences, breaches of legal obligation, dangers to public and occupational health and safety, among others (Terracol 2022, 14). The whistleblowing channels can take many forms and can include a helpline, email address, web platform, physical letter box or face-to-face to a designated reporting person.

In recent years there has been an increasing recognition on the importance of having effective internal whistleblower mechanisms in place. As such, several international and national legislations require organisations to provide these to their workers. Most recently, the 2019 European Union (EU) whistleblower directive required that all 27 EU member states implement provisions for whistleblower protection into national law by December 2021 (EU 2019). The directive obliges all public and private legal entities of 50 staff or more to establish internal whistleblowing channels and whistleblower protection policies (EU 2019). This directive has been an important step in recognising the need to facilitate internal reports and provide specific protections to whistleblowers.

Having an effective internal whistleblowing system in place not only benefits employees (who are one category of potential whistleblowers) but the organisation itself. Studies show that the internal whistleblower report volume is inversely associated with the number and amount of government fines and lawsuits filed against a private organisation (Stubben and Welch 2020). Internal systems also provide benefits in the form of increasing an organisational culture of trust, transparency, and accountability (Terracol 2022). Finally, using an internal channel also means that issues are brought up directly with those who are in the position to address them (Stubben and Welch 2020).

However, organisations that look to establish or implement an effective internal whistleblowing system may face challenges and obstacles. Researchers, senior management, whistleblowers, and others cite several common challenges to internal whistleblowing, which are explored in this paper, including:

• difficulties in incentivising potential whistleblowers
• inaccessible and/or too few internal whistleblowing channels
• ineffective management of the case
• retaliation against the whistleblower
• and breaches of whistleblower confidentiality or anonymity

With the number of organisations implementing internal whistleblower mechanisms growing, so are the range of solutions offered to the above challenges. This paper also explores several of these, with a particular focus on emerging trends and technologies in the field, such as incentivising employees to come forward, digital solutions and protections for whistleblowers.

Features of an effective internal whistleblowing mechanism

As disclosures often implicate or contain sensitive information about others, those using a whistleblowing mechanism can become vulnerable to retaliatory actions. Organisations should therefore ensure there are safe and effective internal whistleblowing reporting channels with robust protection that all potential whistleblowers feel confident and safe to use (Terracol 2022, 6).

There are a number of best practice principles when implementing internal an whistleblowing mechanism that are recommended to both public and private organisations. These include ensuring the independence of responsible offices (or officers) for the investigation and protection of cases, transparency to all staff of processes in internal policies, the provision of a variety of reporting channels, and robust support and protection for whistleblowers (Terracol 2022).

As an example, from the literature, the overall effectiveness of an internal whistleblowing mechanism is assessed by Brown and Lawrence (2017) as having a combination of strong organisational processes (of whistleblower reporting and protection policies) alongside successful outcomes (higher number of reports and protective measures for whistleblowers).

To ensure that internal whistleblower mechanisms meet their purposes, organisations should regularly review their mechanisms and the effectiveness of the implementation (OECD 2016). The following key performance indicators (KPIs) are taken from the literature on how organisations can determine if their internal system is working correctly.

As a means of self-assessment, organisations can measure the strength of their system through staff surveys. Worth (2013) identified collecting data on the following KPIs on the whistleblower policy (Worth 2013, 90):

• the number of whistleblower cases received
• the outcomes of the cases (i.e., if the case was dismissed, accepted, investigated and validated)
• compensation given to internal whistleblowers
• amount of recovered funds as a result of information from whistleblowers
• internal awareness of whistleblower mechanisms
• the time it takes to process cases

The above KPIs assess the operational side of an internal whistleblowing mechanism and the policy itself. Brown and Lawrence (2017) provide additional KPIs, which evaluate the enabling environment and organisational understanding of the processes, which include:

• Does your organisation provide staff with advice on their rights and responsibilities if they raise wrongdoing concerns?
• How are staff make aware of your organisation’s processes for responding to wrongdoing concerns?
• Which staff in your organisation receive specialised training in relation to receiving and managing wrongdoing concerns, including training about staff support?
• What types of support are available for staff who raise wrongdoing concerns in your organisation?

For the full list of KPIs provided see page 4 of the full report.

Both sets of KPIs are useful when measuring effectiveness. However, these are suggestions provided from the above authors and, in the case of Brown and Lawrence (2017), used in their own research to evaluate other organisations’ internal mechanisms. Therefore, these KPIs serve as an illustration of what the literature recommends for measuring the effectiveness of internal whistleblowing mechanisms.

Common challenges and solutions

The following sections discuss each of the most widely reported barriers to an effective and successful internal whistleblowing mechanism. These challenges face both senior management during the set up and implementation of the mechanism and staff who may want to report a concern. Solutions provided by the relevant literature and research to these barriers are then presented. And, while each of these solutions individually can help to ensure the success of an internal whistleblowing system, they cannot be implemented in isolation.

Incentivising potential whistleblowers

Internal whistleblowing mechanisms are more likely to fail when staff are de-incentivised to report, particularly when there is a negative ethical culture in the organisation culture (Kaptein 2011). Studies on the intentions of whistleblowers support the “ethical model”, whereby whistleblowing is a decision-making process based on ethical decisions (Chen 2019; Trevino 2006). These ethical decisions, as clarified by researchers, are not explained by reference to rational self-interest and are instead explained by reference to moral ideals and emotional commitments (Trevino 2006, 957).

Therefore, individuals are likely to come forward if they view whistleblowing as an “ideal moral choice” (Chen 2019). For example, a study into South Korea’s central government found that a positive attitude to whistleblowing and colleague and organisational support of it were the first and second strongest predictors of internal whistleblowing (Chang, Shin and Wilding 2017, 21-22).

As such, organisational loyalty, and a negative view of whistleblowing among staff are the most cited barriers to an effective internal whistleblowing system (Kluvers and Pillay 2011). In this situation, whistleblowers are viewed as betraying the organisation, management and their fellow colleagues with their report. It is then not uncommon for them to be portrayed as “snitches”, which deters potential whistleblowers who view reporting as an unethical, disloyal choice (Nicholls et al. 2021).

Commitment from leadership

A top-down commitment to whistleblowing and the promotion of its importance by senior staff is effective for countering negative perceptions of whistleblowers as “snitches”. Public support from management ensures that staff are confident in reporting their concerns internally.

This shift in attitude changes negative staff opinions on whistleblowers to one of a “moral champion” who is standing up for what is right (Senekal and Uys 2014). As an example, they support the Institute of Chartered Accountants in England and Wales remark on the rationale for whistleblowing arrangements in their organisation, that “the whistleblower should be seen essentially as a witness, not a complainant” (Senekal and Uys 2014).

The literature suggests that, to facilitate this change in staff opinion and organisational culture, leadership should present a clear “tone from the top” and communicate consistently to all staff on the value of speaking up about wrongdoing (Senekal and Uys 2014, 36; Kaptein 2008; Warren et al. 2014). They should do so through engaging with such issues through all communication media at their disposal (Senekal and Uys 2014).

Additionally, to show top-level commitment to the internal whistleblowing system to staff, management should conduct regular campaigns on whistleblowing and its value to the organisation. These campaigns should address cultural aversions and other issues preventing whistleblowers coming forward, demonstrate a commitment to integrity and educate employees on whistleblower policies and channels (One Trust 2022). One example of this is the Financial Conduct Authority’s (FCA) 2021 campaign “In confidence, with confidence” (FCA 2021). The FCA published materials on its website for firms to share with employees, including a digital toolkit and video explaining the importance of whistleblowing (FCA 2021). At the time of publishing this paper, this is an example and results have not yet been published.

Internal training

Training can be conducted periodically within an organisation to remind staff of their rights and the value of internal whistleblowing. Research recommends that this training should provide models of positive and negative behaviour; provide guidance on rules, codes and methods and opportunities for the practical application of internal whistleblowing processes; and raise awareness of around ethical issues to employees (Meyer-Sahling et al. 2022, 4).

Internal trainings provide “common knowledge” within an organisation, which is a prerequisite for ensuring effective coordination and ensures that everyone is familiar with the standards (Thomas et al. 2014). However, the main value of training is to familiarise staff with organisational rules and policies, and this must also be implemented in conjunction with robust policies and other practices that are recommended (Jenkins 2022).

The use of positive language during this training and in meetings can further improve staff perceptions of whistleblowing and improve the ethics in organisational culture. Language that comes across as positive and constructive tends to reduce conflict, improve communication and reduce defensiveness of others (Bacal no date). Examples of this practice in whistleblowing training is to use the terms “speaking up”, “protection of the organisation and peers”, “safeguarding values” and “integrity”, which all carry different connotations from “blowing the whistle”, “reporting” and “non-compliance”.

The 2013 Courage When It Counts campaign, launched by the Advice Centre for Whistleblowers in the Netherlands, focused on re-centring cultural opinion on whistleblowing through language and imagery (OECD 2016, 99). By using positive language and photographs of individuals who had the courage to speak out, the aim was to provide a visual representation of whistleblowers as vulnerable heroes (OECD 2016, 99).

Engagement of trade unions and works councils

Trade unions and works councils have an important role in transforming a negative perception of whistleblowers towards one that supports whistleblowers (Abazi 2020, 655). Studies show that trade union representatives are generally advocates of an “open culture” and “healthy working environment” and therefore have a role in the whistleblowing process, as either the whistleblower or the recipient of the report (Ødegård, Trygstad and Svarstad no date, 31) (Abazi no date).

Trade unions exist to defend employees’ rights on the basis of labour law, and, as such, senior management can consult with them when establishing the internal whistleblowing channels (Abazi 2020, 655). Unions also typically have extensive knowledge of negotiating a variety of workplace grievances and therefore would know when a whistleblowing procedure should be used (Lewis and Vandekerckhove 2015, 14-15). And, while the whistleblowing policy is ultimately the responsibility of those in charge of implementing it, they should ensure they maintain consistent communication for feedback and input from trade unions (Lewis and Vandekerckhove 2015).

To help transform the organisational culture to one that welcomes whistleblowing, trade unions can also raise awareness to the right to whistleblowing (Abazi no date). Having public approval of the internal whistleblowing mechanism from the trade union can ensure better buy-in from staff and provide it with more credibility. And, as social partners, trade unions and works councils can be consulted on the agreement of the establishment of internal whistleblowing channels (Abazi no date). They can be involved with the investigation and/or support of the whistleblower cases if the reporting individual requests it (Abazi no date). Trade unions can also take over the reporting of wrongdoing from the individual, particularly as a collective issue from the union is more likely to be addressed (Abazi no date).

Awards for whistleblowers

Studies show that positive social recognition is a significant incentive for individuals (Vaughn 2014). As such, public awards (if given in circumstances where the whistleblower is known to be safe) can incentivise potential reporting staff and support them after their disclosure to support their reputation and standing (Vaughn 2014). There are several whistleblower advocacy groups that provide awards and recognition to whistleblowers, including:

• The Sam Adams Award
• The Paul H. Douglas Award for Ethics in Government
• The Ridenhour Prizes

Similar award mechanisms could be adopted internally within an organisation. These should support the whistleblower’s actions as a strong ethical choice in the form of a Speak Up Award that “commends the individual(s) for upholding the organisation’s missions, values, or interests” (Terracol 2022, 37). Not only do these awards present whistleblowing as a strong ethical choice to other staff members, they can also provide reassurance of the value and importance of reporting a wrongdoing (Vaughn 2014).

However, it should be noted that some studies into financial and non-financial awards for employees conclude that the impact of financial rewards (such as salary, bonuses and allowances) are larger than those of non-financial rewards (Yousaf et al. 2014). Yousaf et al. (2014) surveyed staff in a private company and found that staff while staff do appreciate the use of recognition, non-financial awards remain the strongest drivers of motivation (Yousaf et a. 2014).

Financial rewards for whistleblowers

A financial reward system can both incentivise potential whistleblowers and ensure that whistleblowers are financially compensated for any losses because of their disclosure. Financial rewards for whistleblowing are traditionally a government function which has, for example, seen significant success in the United States where, between 1986 and 2020, US$7.8 billion was awarded to whistleblowers (Beutter 2023).

A similar financial reward mechanism can be offered within an organisation alongside non-financial rewards (such as additional vacation days) to whistleblowers (Kastiel 2014). If companies offer their own internal financial incentives, provided in a clear written policy, it should encourage employees to blow the whistle internally first rather than externally for the government provided bounty (Kastiel 2014).

There are debates among experts on whether financial incentives for whistleblowers are appropriate or not. Those against argue that financial incentives may lead to opportunistic disclosures and change whistleblowing from an ethical act to one motivated by money (Integrity Line 2022). There are also concerns that it may lead to the entrapment of other colleagues to reap the financial benefits and result in a wider culture of distrust among employees (Maslen 2018).

Conversely, other recent empirical evidence supports the effectiveness of financial rewards. Nyreröd and Spagnolo (2019) analyse the evidence on their use and conclude that, in terms of the amount of additional information generated, deterrence effects and administrative costs, reward programmes (if competently and properly administered) are effective in increasing detection and deterrence of corporate fraud (Nyreröd and Spagnolo 2019).

However, monetary rewards will be insufficient if there are no additional internal policies that also protect the whistleblower from loss of employment and other reprisals (Beutter 2023). For example, the whistleblower reward programme in Kenya has been proven to be largely ineffective due to weak whistleblower protection, meaning the risks outweigh any financial recovery (Beutter 2023).

Inaccessible and/or too few whistleblowing channels

Another commonly cited barrier to a successful internal whistleblower mechanism is a lack of different channels or ineffective channels for employees to report through. A whistleblowing channel is the means through which the reporting person communicates with the responsible authority, in the case of internal whistleblowing channels, typically the whistleblower officer or office. These can be through various media and go to different members of staff in some cases, depending on the content of the information and the decision of the whistleblower.

Lewis (2007) points out that the establishment of multiple visible whistleblowing channels is one of the strongest drivers for staff to report. Another study by Lee et al. (2013) finds that organisations that clearly support whistleblowing through the establishment of effective whistleblowing reporting channels is positively related to employees’ intention to blow the whistle.

Often organisations only provide one platform for whistleblowing, and this may not always be considered reliable by staff. Additionally, a lack of trust and reliability of these whistleblowing channels can cause individuals to not report, as exemplified in research into organisations in Albania and North Macedonia, which shows that individuals do not trust the official whistleblowing channels and therefore are reluctant to report misconduct (Meijers 2019, 22). To address this, it is suggested that local and regional administrations should work to take local actions and initiatives to increase the possibilities for safe reporting (Meijers 2019, 22).

Variety of whistleblowing channels

To ensure the internal reporting channels are adequate and address the needs of all staff, a wide variety of platforms should be available. Studies suggest that a variety and range of platforms results in the success of whistleblower mechanisms (Vanderkerckhove et al. 2016).

Evidence also suggests that staff in different positions will raise their concerns in different ways, stressing that the diversity in platforms is important. For example, an assessment of a UK local government showed that those in administrative positions are more likely than others to raise their concerns with higher management (Meijers 2019. 8). This implies that different staff will prefer different channels, meaning that a wide number and range of different solutions should be provided to staff to ensure they reach all potential whistleblowers.

Importantly, a study into the whistleblower arrangements of several organisations showed that a shift in preference by staff for different types of channels occurs over time (Vanderkerckhove et al. 2016). An initial staff preference for answering integrity related questions through a web interface shifted over time to directly raising a face-to-face concern as trust was developed within the organisation (Vanderkerckhove et al. 2016).

A wide variety of channels should therefore include channels for reporting in writing, online – such as email or web based platforms – or offline options such as post or physical “reporting boxes” (Terracol 2022). Oral reporting channels should include remote options such as telephone and physical meetings (Terracol 2022). Channels can also be gender-sensitive and include inclusive language and specific anti-retaliatory measures aimed to protect women (Chene 2020).

Finally, whistleblowing channels should also widen the scope of people they apply to. They should be available not to just current employees but to previous employees, volunteers, contractors, subcontractors and suppliers, as well as individuals who disclose breaches during a recruitment process (Abazi 2020).

Accessible whistleblowing channels

Ensuring whistleblowing channels are accessible to all staff is equally as important as increasing the quantity of whistleblowing channels. While a wide range of different types and formats of whistleblowing channels can help to facilitate this accessibility, organisations should also pay particular attention to their staff’s demographics, cultural background and work environment, and how to make reporting more open with these factors in mind.

One way of improving accessibility is to integrate advice and information on the content of the organisational whistleblower policy within the whistleblowing channels. Many company whistleblower reporting channels only serve to allow whistleblowing and do not include any additional information or support to the employee (Kastiel 2014). To strengthen these channels, the hotline should also serve as a helpline, which may help de-stigmatise its use, while also providing information on the company’s code of ethics (Kastiel 2014). To guarantee independence and impartiality, these channels could also be separated, even while clearly signposted in the same policy.

The interfaces of the whistleblowing channels should also be adapted to the specificities, culture and work environment as well as the external social contexts (UNODC 2021). For example, a recommendation from research into whistleblower protection in the health care sector suggests that, for health care personnel in hospitals, a whistleblowing channel through a smartphone application or by text should be provided, given that they work in complex environments with time pressure and little time alone (UNODC 2021).

Another study that interviewed employees in four different companies noted respondents’ preference for whistleblower “speak up” apps over other channels:

An example of this is the World Bank’s Integrity App. This can be used to report misconduct by any of their global staff in World Bank financed projects (World Bank 2012). It gives reporting staff instant access to project information and a guided process to report concerns of corruption, as well as protecting the anonymity of complainants (World Bank 2012). It is always accessible to staff from their mobile phones and acts as a helpline with additional information for users. However, this accessibility relies on all staff having the relevant and secure technology that cannot be compromised. These factors should be additional considerations when providing digital platforms for reporting.

Ineffective management of the case

Concern from employees that the investigation into the case will be mismanaged once a report of wrongdoing (or subsequent retaliation against them) has been made is another deterrent. The research demonstrates the importance of having a robust and consistent response system in place, as a lack of responsiveness from responsible whistleblower office(rs) creates the perception among staff that whistleblowing is “futile and risky” (Vanderkerckhove et al. 2016, 16).

One study conducted by the UK whistleblowing charity, Protect, showed that employees that reported internally to their employer may report an issue twice but will rarely report a third time if no action is taken (Meijers 2019). This additionally emphasises the importance of transparent case management, that the whistleblower needs to be updated on their case and its outcomes where appropriate, to know it is being recognised and dealt with.

Independence of investigating officers and/or office

Depending on the size of an organisation, either an independent whistleblowing officer (if a smaller organisation) or a whistleblowing office sitting within the compliance department (if a larger one) is a necessary component of an internal whistleblowing mechanism and helps ensure sound management of the case (UNODC 2021). These bodies are responsible for investigating the report, and handling the case, while others will be responsible for the welfare of the whistleblower and any future investigations into claims of retaliation because of their disclosure.

The whistleblowing office should be impartial and be responsible for providing information on the whistleblowing policy (ISO 2021). Other duties include receiving reports, following up on reports, maintaining communication with whistleblowers, designing, and reviewing the internal whistleblowing channel, as well as reporting to the head of the organisation and the board of directors on the implementation of the internal whistleblowing channel (ISO 2021).

The investigating officer’s independence means they are free from any conflict of interest that arises from the case. To ensure this, sufficient independence should be guaranteed through the organisational and governance structure, depending on the size of the organisation and level of available resources (Terracol 2022, 19). This can be assured through having direct access to the board or body that oversees the internal whistleblowing channel, and reporting directly to the head of the organisation (Terracol 2022, 19). Investigating individuals should also be deemed trustworthy by others, so organisations should base their designation on criteria that include inclusion and diversity (Terracol 2022, 20).

For example, independence of investigating offices was one of the main recommendations made by the Joint Inspection Unit when assessing the UN’s internal reporting and protection of whistleblowers system (Achamkulangare and Bartsiotas 2016). Other reviews of it similarly recommended the removal of executive heads from any decision-making on protection, having an independent judicial review of any decisions and allowing the finances of the responsible body to be independent (Feinstein 2020). While not all organisations have the size or capacity to have an entirely independent office for whistleblower protection and investigation, similar measures can still be applied through reporting lines, governance structures and budgetary allocations to responsible staff members.

Communication and feedback to the whistleblower

Organisational policies should clearly set out the procedures for communicating and feeding back to the whistleblower on the status of their case. Firstly, the policy should mandate the timeframe for responding to the whistleblower. The EU Whistleblower Directive recommends a seven day limit for acknowledging receipt, and three months for a follow up (EU 2019).

However, this is too long for certain types of violations, such as those relating to public health or environmental issues (Hunt-Matthes and Motarjemi 2020). For example, in food or pharmaceutical companies, the acknowledgement of receipt and concrete measures are taken within 24 hours (Hunt-Matthes and Motarjemi 2020). Some of the literature suggests using this tighter timeframe for urgent concerns.

The acknowledgement of receipt should also give the whistleblower a chance to clarify their report, the timeline of next steps, the whistleblower’s responsibility and sharing the organisation’s whistleblowing and whistleblower protection policy (Terracol 2022, 27).

Consistent communication with the whistleblower should also be assured in the organisational whistleblower policy. This should include the findings and outcome of the follow-up on their report, and which allegations were investigated, and which were not and why (Terracol 2022, 28). However, due to legal reasons and privacy and data protection regulation, not all information can always be disclosed to the whistleblower (Vanderkerckhove et al. 2016, 19). Therefore, it is important for responsible staff to manage the whistleblower’s expectations and ensure they understand the regulatory limitations which may limit the detail in responses (Vanderkerckhove et al. 2016, 19).

Dividing the responsibilities can also ensure clear communication and feedback to the whistleblower. Findings through company assessments by Vandekerckhove et al. (2016) show that there should be a divide between the investigating officer (whistleblowing officer) and those who are responsible for ensuring the welfare of the whistleblower, such as the human resources (HR) department. The investigating officer and HR department should have clearly defined protocols set out in the whistleblowing policy on how to liaise with one another on the matter (Vandekerckhove et al. 2016).

Case management software

A robust and consistent internal response system is integral to an effective whistleblower mechanism (Vanderkerckhove et al. 2016). This can be supported by case management software that safely stores case details and provides reports to the relevant staff.

Designing a “back office” is recommended to record concerns and to then use this data to strengthen risk management and response processes (Vanderkerckhove et al. 2016). This can include making these responses visible where appropriate, while another solution is to explore whether the employee who raised the concern can be included in the development of the solution (Vanderkerckhove et al. 2016).

Online database software can be used for data collection and analysis of cases. This is particularly useful when it comes to disaggregating data to understand the specific risks facing an organisation (Jenkins 2020). Data on whistleblower reports can also be used to increase trust in stakeholders (Vanderkerckhove et al. 2016).

Many external companies also now provide tailored digital platforms to manage reports. These include assisting with the implementation of internal helplines and case management solutions, offering anonymity for whistleblowers and investigation protocols.

Retaliation against the whistleblower

Fear of reprisals or other negative reactions from colleagues and management is a common deterrence for staff not to report wrongdoing internally (Fox, Lonne and McDonald 2004; Preston-Shoot 2011). A study from the Bradley University for Cybersecurity reported that nearly two-thirds of whistleblowers surveyed had experienced some form of retaliation (NWC no date). An independent inquiry into an UK health service trust also learned that the bullying of staff by senior managers and a culture of fear was one of the main barriers for whistleblowers (Patrick 2012). Through silencing a whistleblower with retaliation, and no subsequent sanctions being enforced on the retaliator, wrongdoings such as illegal or unethical practices can become normalised (Tiitinen 2018, 8).

Retaliation within the workplace often results in a financial loss (as well as loss of status and reputation) for whistleblowers if they are fired, demoted or miss out on promotion because of their report. As many studies on whistleblower intention show, economic rationality is part of the decision-making process of those who intend to report (Chi, Wei and Zhang 2019). Therefore, having a protection system in place to safeguard against financial and other losses would further encourage staff to come forward (Chi, Wei and Zhang 2019).

Other forms of retaliation commonly reported by whistleblowers include (but are not limited to) disciplining, intimidation or harassment, threats, ostracising, falsely accusing the employee of poor performance, blacklisting or threatening to report the employee to the police or immigration authorities (OSHA no date). Even so, studies show that the provision of organisational support to whistleblowers to protect them from retaliation is often the weakest area of support for whistleblowers (Brown, Olsen, Roberts, 2011)).

Whistleblower protection within the workplace

Having a strong protection policy for whistleblowers acts as a deterrent against wrongdoing and increases the rate of detection of wrongdoing (OECD 2016, 18). These protections should be assessed by responsible staff via risk assessments and implemented proactively for the individual as soon as the initial report from the whistleblower has been made. They should be designed to prevent physical or psychological harm, damage to the person’s reputation, financial loss or any pain or suffering (Terracol 2022, 34).

Examples of protective and restorative measures include: measures to instill a good work environment, reinstatement of the person either to the position they occupied before detrimental conduct or to a similar position with equal salary, status, duties and working conditions, fair access to any promotion and training that may have been withheld, restoration of duties, if possible, recognition of lost time and impact on performance, apologies for failure and restoration of a cancelled contract (Terracol 2022, 37).

Other conflicts of interest should be removed during investigations, which include offering the whistleblower to be moved to a different department or assigned a different supervisor if their current supervisor is named in the complaint (Bartsiotas and Achamkulangare 2016). This should be an offer to the whistleblower, rather than mandatory, to ensure it does not expose their identity or cause detriment to their career.

It is also important that there is a reversed burden of proof during investigations in the internal whistleblower protection policy (Abazi 2020). For example, as best practice, the EU Whistleblower Directive mandates that, if a whistleblower has faced retaliation, then they should not have the additional burden of demonstrating the causation between the whistleblowing and the retaliation in proceedings before court, instead this burden is on the employer (Abazi 2020). Organisations should adopt a similar mechanism for internal investigations.

Ongoing monitoring of the welfare of whistleblowers after they have ceased to receive active management support is also important as retaliation can occur even long after the report is made (Brown, Roberts and Olsen 2011, 95-96).

Responsible staff should also ensure there are public commitments to these protections to help reassure potential whistleblowers. An example of this is practice is the Civil Service Commission in the UK, which includes a statement in all its public manuals that disclosures are protected in simple terms. It states that:

Whistleblower protection outside of the workplace

The internal whistleblowing policy and helpline should also point towards professional services to support anyone who has suffered retaliation, whether it is inside or outside the workplace. Organisations should make external counselling services available to whistleblowers, as well as other appropriate professional services such as legal support and independent career counselling support (Brown, Olsen and Roberts 2011).

The whistleblowing helpline (and/or the whistleblowing office/officer) should be aware of, and promote, additional support available to staff. For example, in the most extreme cases, whistleblowers may face physical threats and violence (UN 2015, 58). An understanding of the protection mechanisms available to whistleblowers faced with physical threats is therefore important for those implementing the whistleblowing system.

For example, in a limited number of countries, national whistleblower protection legislation provides for physical protection including physical relocation and protection under police care. In South Korea, the whistleblower protection law states that a whistleblower and their family can the ask the anti-corruption commission to ensure protective measures for their personal safety (Republic of Korea 2011, 8). The commission may then request the police force to provide these protective measures (Republic of Korea 2011, 8).

Other forms of protection that may be available to whistleblowers are witness protection programmes and protection mechanisms for human rights defenders. For further information, see our helpdesk paper on the range of physical protections that may be offered to whistleblowers.

Breaches of whistleblower confidentiality or anonymity

The risk of retaliation against whistleblowers is significantly higher if their identity is made public, thus increasing deterrents for staff to report. The best way for a whistleblower to prevent retaliation is to remain anonymous when making a report, as this will make it harder for employers or colleagues to retaliate (NWC no date).

Organisations can provide options for whistleblowers’ reports to remain either confidential or anonymous as a protective measure. In a confidential whistleblowing system, only the recipient of the disclosure is aware of the whistleblower’s identity and must seek the whistleblower’s consent to disclose their identity (Jenkins 2020, 3). In an anonymous system, no one in the process knows the identity of the whistleblower (Jenkins 2020, 3).

There have been high-profile cases of whistleblower identities being leaked or threatened with leaking. One recent example is the former US president Donald Trump who, when he was in power, demanded the identity of a whistleblower from a US intelligence agency be made public and called for the individual to face retribution for their disclosure (Figueroa Hernandez 2019). The identity of the whistleblower has so far remained anonymous, but if the calls for exposure had been successful, the individual would have been at great risk of further retaliation beyond that of calling for identifying the individual.

Digital solutions for anonymity

Digital channels are regarded as a “game-changer” in the field of whistleblowing as they can support communication with the whistleblower and provide truly anonymous communication (Berendt and Schiffner 2021, 2). Anonymity through digital platforms provides an incentive for the whistleblower to come forward and ensures “accountability, fairness, and data protection” (Berendt and Schiffner 2021).

Digital whistleblowing systems based on the Tor internet browser do not log the user’s IP address and time of entry, and instead send encrypted versions of the message through a network of computers which make it impossible for any stations or outside attackers to read what the message contains (Berendt and Schiffner 2021, 5). Modern whistleblowing support systems provide anonymous reporters with case credentials to later prove they made the report (Berendt and Schiffner 2021, 10). An externally provided hotline is considered an extension of the company’s internal channels as it transmits information back to the relevant authority in the company (Vanderkerckhove et al. 2016).

There is a large number of open-source software designed to enable anonymous and secure reporting for whistleblowers, with two of these being GlobaLeaks and SecureDrop. GlobaLeaks is accessible on both Tor and HTTPS, making it accessible to organisations for whom configuring the Tor browser may present an additional hurdle (Open Technology Fund 2019). It allows whistleblowers to choose who should receive their disclosure and encrypts the whistleblower’s disclosure using the chosen recipient’s key, meaning the whistleblower has control over who reads their data (Uddholm 2016). GlobaLeaks’ recent introduction of the “multitenancy feature” enables the creation of a single platform providing organisations with their own bespoke anti-corruption whistleblowing channel (Open Technology Fund 2019).

Di Salvo (2021) surveyed journalists about the platform SecureDrop and found that individuals demonstrate both confidence and a conscious concern for the security regarding the software (Di Salvo 2021). The results of the survey also suggest that organisations using and providing information on SecureDrop acts as a “trust signifier” (Di Salvo 2021). In those surveyed, there was a high level of enthusiasm for digital solutions for making anonymous and secure reports (Di Salvo 2021).

Moreover, while open-source software can provide organisations with a secure platform for whistleblowers to report anonymously and confidentially, internal hotlines can also provide guidance for them on how individuals can protect their identity. For example, the National Whistleblower Center provides a leaflet on cybersecurity for whistleblowers which includes tips on which device to report on and the use of public Wi-Fi (NWC 2019). Organisations should be proactive in providing such advice to staff and other relevant stakeholders on their whistleblower helpline.

However, there are limitations to protecting the identity of the whistleblower that not even recent digital technologies can circumvent. The very content of a message may lead to re-identification (Berendt and Schiffner 2021), particularly in smaller organisations. If only certain employees have access to the information that forms the core of the wrongdoing, then one of them must be at the root of the report (Berendt and Schiffner 2021,7). Additionally, if the case goes to court, then the whistleblower’s identity may be exposed. The EU Whistleblower Directive states that there should be exemptions for confidentiality in the case of criminal proceedings to safeguard the integrity of investigations and the rights of defence for persons concerned (EU 2019, 22).