Setting up a whistleblowing channel: what most companies miss

Most companies that set up a whistleblowing channel get the visible part right: there's a form or an email address, and it's published somewhere. The gaps are usually in everything around it. Who reads what comes in, who else can see it, who is allowed to use it, and what has to happen by day 7 and by month 3. Nobody notices those gaps until a real report arrives, and by then they're part of the problem.

Below are the ten that come up most often. For each one: what usually happens, why it falls short, and what to do instead. The legal references are to the EU Whistleblowing Directive (Directive (EU) 2019/1937). UK companies aren't bound by it, but it's still the most complete description of a channel that works (see UK vs EU: what's actually required where). At the end there's a check you can run against your own channel, with how to check each point.

1. Nobody specific owns it

What usually happens: reports land in a shared inbox, or with "HR" in general, and everyone assumes someone else is dealing with them.

Why it falls short: the Directive requires a designated, impartial person or department to follow up on reports (Art. 9(1)(c)). An inbox isn't a person. A report that sits unread for a fortnight because three people each thought another had picked it up has already missed the first deadline.

What to do: name the person before you publish the channel anywhere. Better still, name a small group of two or three, so leave and sickness don't leave reports unattended. See designating who handles reports.

2. Nobody has checked who else can see reports

What usually happens: the list of handlers is short, but reports still reach other people. An IT admin can open every mailbox. The notification email contains the full report. The form tool keeps submissions in a workspace half the company can log into.

Why it falls short: Article 9(1)(a) requires the channel to be designed and run securely, so that staff who aren't authorised can't get to reports. Article 16 protects the reporter's identity from anyone beyond the people handling the report. That has to be true of the system itself, not just of everyone with access being careful.

What to do: follow a test report from submission to storage, and list everyone who could reach it at each step, including admins, backups and email notifications. See is an email inbox a compliant whistleblowing channel? and can you use Google Forms as a whistleblowing channel?.

3. Only written reports are accepted

What usually happens: a web form or an email address is the whole channel.

Why it falls short: the Directive itself lets a channel take reports in writing, orally, or both (Article 9(2)), so a written-only channel isn't automatically non-compliant. But national law often requires more. The Netherlands requires an oral route by phone or voice message, and Italy's regulator expects both written and oral reporting. Germany accepts a written-only channel but still requires a meeting in person if the reporter asks for one. And in practice, some people won't write a concern down at all. Voice brings its own problem too: a recording can identify someone even when their name isn't on the report.

What to do: add a voice option, decide how recordings will be protected, and say in your policy how to ask for a meeting and who will hold it. See voice reports and anonymisation, explained simply.

4. Only employees know it exists

What usually happens: the link lives on the intranet or in the staff handbook.

Why it falls short: the Directive's protection reaches well beyond the payroll: contractors and the self-employed, suppliers' staff, volunteers and trainees, shareholders and non-executive directors, job applicants and former employees (Art. 4). Whether each group can use your internal channel depends partly on national law (Art. 8(2)), but all of them can report straight to a regulator. If they can't find your channel, they'll report outside the company instead.

What to do: publish the channel somewhere people outside the company can reach it, such as your website, and decide explicitly which groups it's open to. See who is protected under the Directive.

5. The deadlines depend on someone remembering them

What usually happens: acknowledgement and feedback dates go into someone's calendar, or nowhere.

Why it falls short: the Directive sets two deadlines. Receipt must be acknowledged within 7 days (Art. 9(1)(b)). Feedback must follow within a reasonable time, and no later than 3 months after acknowledgement (Art. 9(1)(f)). Feedback also has a specific meaning: telling the reporter what action has been or will be taken, and why (Art. 5(13)). "We're looking into it" doesn't count.

What to do: make acknowledgement automatic, have the system track the 3-month date and warn you before it arrives, and plan feedback that says what's actually happening. See the 7-day/3-month feedback clock, explained.

6. Anonymous reporters can't be reached again

What usually happens: the channel takes an anonymous report, but nothing goes back the other way. A web form has no reply function, and an anonymous email account is often abandoned after one message.

Why it falls short: the Directive's deadlines assume a conversation. Receipt is acknowledged within 7 days (Art. 9(1)(b)), follow-up is diligent (Art. 9(1)(d)), which usually means asking the reporter something, and feedback follows within 3 months (Art. 9(1)(f)). Those obligations apply to anonymous reports you accept just as they do to identified ones. A channel that can only reach a reporter through their contact details makes them choose between staying anonymous and hearing back, and many will choose not to report.

What to do: give every reporter a way back into their case that doesn't depend on contact details, such as a case reference they use to read messages and reply. If your channel can't do that, say so plainly where people report, and offer an optional contact route. See anonymous vs identified reporting.

7. Reporters aren't told how to report to the authorities

What usually happens: the policy explains how to report internally and stops there.

Why it falls short: Article 9(1)(g) requires clear, easily accessible information about reporting externally to the competent authorities. Companies often leave it out because it feels like pointing people elsewhere. But it's a required part of the procedure, and a reporter who trusts your channel will usually use it first anyway.

What to do: name the relevant authorities for each country you operate in, and put that information in your policy and next to the channel. See internal, external and public reporting routes, explained.

8. There's no plan for a report about the handler

What usually happens: every report goes to the same person, including a report about that person, their manager or their own team.

Why it falls short: Article 9(1)(c) requires the person following up to be impartial. Nobody is impartial about a report on themselves, however good their intentions.

What to do: name an alternative contact in your policy, such as a director, the chair of the board or an external adviser, and tell reporters to go straight there if their concern involves the handler. Decide this now. If you only work it out once such a report arrives, the handler has already seen it.

9. Staff representatives weren't consulted (EU)

What usually happens: management chooses the channel and launches it without involving anyone else.

Why it falls short: Article 8(1) says internal channels are set up after consulting, and where national law requires it agreeing with, employee representatives. In Germany, the works council has co-determination rights over how the channel works. In France, the CSE must be consulted before the procedure is finalised. Other member states have their own versions. Skipping this can leave the channel open to challenge even if everything else is right.

What to do: check what your country's law requires before launch, and allow time for it. See Germany's HinSchG and France's Sapin II for two examples.

10. There's no rule for how long records are kept

What usually happens: reports and case files are kept indefinitely, or deleted whenever someone tidies up.

Why it falls short: Article 18 requires a record of every report, kept no longer than is necessary and proportionate. Article 17 applies data protection law on top: personal data that isn't needed shouldn't be kept. Keeping everything forever and deleting too early are both failures. You also need a way to stop deletion when a case is heading to court.

What to do: set retention periods based on how a case ends, delete automatically when they run out, and have a way to put a hold on a case. See choosing a retention policy.

Check your own channel

For each question, the second line is how to find out. If you can't answer one, treat it as a "no".

1. Can you name the person who will read the next report, and who covers for them?

   Ask who opened the last report, and who would have if they'd been on leave.

2. Have you listed everyone who can technically see a report?

   Send a test report and follow it: the inbox or form, notifications, spreadsheets, admins who can reset passwords or search mail, backups.

3. Can someone report by voice, and ask for a meeting in person?

   Read your policy as a reporter who won't write anything down. Is there a number to call, and a named person who holds meetings?

4. Can a contractor, supplier or former employee find the channel?

   Search your public website for it while signed out.

5. Are the 7-day and 3-month deadlines tracked, with a warning before either is missed?

   For your last report, find the date it was acknowledged and the date feedback is due.

6. Can you reach an anonymous reporter again?

   Submit a test report without giving contact details, then try to send it a question.

7. Does your policy say how to report to the authorities?

   Check it names the authority for each country you operate in.

8. Does your policy say where a report about the handler should go?

   Check the alternative contact is named, and reachable without going through the handler.

9. Have staff representatives been consulted, where your country requires it?

   Find the minutes or the agreement.

10. Do you have retention periods for closed cases, and a way to put one on hold?

    Find the oldest closed report you still hold, and the rule that says why.

Any "no" is a gap to close before the next report arrives, not after.

Using an email address or a form? Most of these gaps start there. Run the channel-specific checks in is an email inbox a compliant whistleblowing channel? or can you use Google Forms as a whistleblowing channel?, each with a fix for every gap you find.

When to do this

If you're in the EU with 50 or more workers, a channel is already a legal requirement (see the 50-employee threshold, explained). Below that, or in the UK, there's no fixed date. The time to be ready is before the first serious report, because a channel pieced together after a concern has already surfaced informally tends to have most of the gaps above.

How Provoxis closes these gaps

Three of these are decisions only you can make: who handles reports (1), where a report about the handler goes (8) and who you consult (9). Provoxis closes the rest:

Every action on a case is logged automatically, and reports are stored in the EU (or the UK, for UK customers), encrypted at rest and in transit. Setup is self-serve with a guided checklist, pricing is a fixed monthly fee (see pricing), and there's a 30-day free trial.

Legal basis

All references are to Directive (EU) 2019/1937.

• Art. 4: who the Directive protects, including people outside the employer's own workforce.
• Art. 5(13): what "feedback" means.
• Art. 6(2): whether anonymous reports must be accepted is left to member states.
• Art. 8(1): setting up internal channels after consulting social partners, where national law provides for it.
• Art. 8(2): who internal channels must, and may, be open to.
• Art. 9(1)(a)–(g): secure design, 7-day acknowledgement, an impartial designated person or department, diligent follow-up, feedback within 3 months, and information on external reporting.
• Art. 9(2): reporting in writing, orally, or both; oral reporting by phone or voice message, and a physical meeting on request.
• Art. 16: confidentiality of the reporter's identity.
• Art. 17 and 18: processing personal data, and keeping records of reports.