What your reporting procedure needs to cover

A channel isn't the same as a procedure

Setting up a submission form and calling it done is a common shortcut, and an incomplete one. Art. 9(1) of the Directive doesn't just require somewhere for reports to land — it says "the procedures for internal reporting and follow-up... shall include the following," and then lists seven distinct elements. A company can have a technically working channel and still be missing several of them, because most of the seven are about what happens around the channel, not the submission form itself.

The seven things Article 9(1) requires your procedure to cover

• (a) A secure, confidential channel. Designed and operated so a reporter's identity is protected and non-authorised staff can't access it.
• (b) Acknowledgement within 7 days. A receipt confirming the report arrived — see acknowledging a report the right way for what good acknowledgement actually looks like beyond the bare minimum.
• (c) A designated, impartial handler. A named person or department responsible for following up — see designating who handles reports for how to actually choose one.
• (d) Diligent follow-up by that designated person or department — not just receipt, ongoing engagement with the case.
• (e) Diligent follow-up on anonymous reports too, where national law requires it — see anonymous vs identified reporting, explained for what that actually depends on.
• (f) Feedback within 3 months. A substantive outcome and reasoning, not just an update — see writing Art. 5(13)-compliant feedback for the bar this actually has to clear.
• (g) Clear information about reporting externally, too. Reporters need to know they can go to a competent authority — and in some circumstances, the public — not just that your own internal channel exists.

Six of the seven get real, dedicated treatment elsewhere in this knowledge base — this article is about the shape of the procedure that ties them together into one coherent document, not a duplicate explanation of each.

Point (g) is the one companies most often forget

A written procedure that only describes the company's own internal channel, and never mentions that a reporter is free to go straight to a regulator instead, is missing a legally required element, not just being modest. A reporter is never obligated to try the internal route first — see internal vs external vs public reporting, explained for the full picture of when each route applies — and a procedure that reads as though the internal channel is the only option available isn't actually informing anyone of their real rights. This is also the element most likely to get cut when a procedure document gets trimmed for length, precisely because it doesn't describe anything the company itself operates.

Make it genuinely accessible, not just technically published

A procedure sitting in a policy folder nobody opens doesn't function in practice, even if it technically satisfies every element above on paper. Put it somewhere every worker can actually find it — an intranet page, a physical noticeboard, an onboarding pack — and mention it again during onboarding rather than relying on a single company-wide announcement the day it launches. The measure of a good procedure document isn't whether it exists; it's whether someone with something to report would actually know where to find it.

How Provoxis fits into this

Provoxis generates a downloadable compliance policy that already covers each of the seven elements above as a starting document — so a company isn't drafting this from a blank page. What Provoxis can't do for you is publish it: getting that document somewhere your workforce will actually see it, and keeping the designated-handler section accurate as staff change, stays the company's own job. A ready-made document doesn't put itself on the intranet.

Legal basis

• Art. 9(1), Directive (EU) 2019/1937 — the full list of what internal reporting procedures must include, points (a) through (g).