Whistleblowing is when an employee or other insider reports wrongdoing they have come across through their work to people who can act on it. The wrongdoing is usually serious and in the public interest: fraud, bribery, safety breaches, environmental harm, data misuse, or other illegal conduct. A report can go internally, to a manager, HR, compliance, or a dedicated reporting channel, or externally to a regulator. The person who reports is a whistleblower, and in many countries the law protects them from retaliation.
Internal and External Whistleblowing
- Internal whistleblowing means reporting inside the organization, through a manager, HR, compliance, an ethics line, or an anonymous reporting channel. It gives the employer the chance to fix the problem first.
- External whistleblowing means reporting to a regulator, law enforcement, or another authority outside the organization.
- Public disclosure, to the media or online, is usually protected only in narrower circumstances, such as when internal and external routes have failed or there is an imminent danger.
- People go outside most often when the internal route feels pointless or unsafe, which is why a credible internal channel matters to employers.
Why It Matters
Tips are one of the main ways organizations find out about wrongdoing, and employees are the largest source of them. That makes whistleblowing a control, not only a risk. Many jurisdictions now require employers above a certain size to run an internal reporting channel; in the European Union, the Whistleblower Directive requires private employers with 50 or more workers to have one, with fixed deadlines to acknowledge a report and to give the reporter feedback.
Making Whistleblowing Safe
- Offer a channel that works without a login, a work email, or a company device, so everyone can reach it.
- Accept anonymous reports, and have a way to ask an anonymous reporter follow-up questions.
- Acknowledge every report promptly and give the reporter feedback on what was done.
- Limit access to the people handling each type of report, and route around anyone involved.
- State a clear ban on retaliation, and act on it visibly when it happens.
CultureMonkey
Run an internal channel with the deadlines built in
CultureMonkey's Speak Up module gives employees a written reporting channel in 100+ languages and gives every report an owner, a 7-day acknowledgement deadline, and a 3-month feedback deadline, following the EU Whistleblower Directive.
See whistleblowing software →