Topic Guide: Whistleblowing

Recommendations vary regarding the scope of who and what kind of complaint should be covered by an internal reporting mechanism (depending on factors such as industry sector, organisation structure and size, and national context), but a comprehensive, clear and widely disseminated written policy is essential. Best practices for ensuring clarity should address the following issues: 

Here, an organisation must clearly define the scope of who may use, and receive protection from, a whistleblowing channel. Some issues to consider, such as whether to extend a whistleblowing channel to third parties or the public, are discussed below. 

Organisations should identify the types of complaints which can be raised under this specific channel, ideally with examples. Here, organisations should take care to distinguish between whistleblowing complaints (which affect customers, members of the public, or their employer) and personal grievances (regarding personal poor treatment),[1] which can be subject to a separate complaints procedure.[2] 

Roberts, Brown and Olsen note that “some workplace grievances, particularly those involving management, can become so endemic and destructive that they also become a public interest issue.”[3]

A policy should specify how to submit a complaint, whether it must be raised verbally, in written form, or via a dedicated hotline or web platform. Here, an organisation should consider issues such as accessibility, time zones and language (especially in the case of multi-national enterprises). Organisations which provide multiple avenues to report can assuage potential difficulties faced by whistleblowers which may discourage reporting, such as awkward operating hours for a hotline, or having to speak a second or third language.[4]

Related to the issue of how to raise a complaint, an organisation should specify where or to whom a complaint should be raised, such as to a line manager, appointed ethics officer, ombudsperson or hotline, and provide contact details. The procedure for when to contact relevant external bodies, such as regulators, should also be specified and contact details provided. Alternative reporting channels to direct line management should be given.[5]