5.3.3 Whistleblowing

A whistleblowing mechanism is the structured, formal system that a company puts in place to allow employees, customers, suppliers, contractors and other stakeholders to report misconduct, illegal activities or unethical behaviour safely.

Whistleblowing addresses matters that affect the public interest or the integrity of the company. To distinguish whistleblowing from personal employment grievances, a whistleblowing framework applies to actions that threaten the company’s integrity or the public interest, such as:

• Fraud, corruption, bribery or money laundering.
• Financial malpractice or deliberate breach of accounting controls.
• Breaches of environmental, health and safety regulations.
• Cover-ups or destruction of evidence related to any of the above.

The core goals of a whistleblowing mechanism are:

• Early detection. To act as an early-warning system that uncovers fraud, bribery and compliance breaches before they grow into corporate crises.
• Psychological safety. To create a "speak-up" culture where employees feel safe to voice concerns without fear of workplace bullying, demotion, or dismissal.
• Stakeholder trust. To build mutual trust by giving external stakeholders a transparent mechanism for identifying systemic risks, preventing ethical breaches and safeguarding the interests of investors, partners and the community.
• Accountability. To bypass traditional hierarchies so that misconduct at the executive or management level cannot be concealed.

The strategic benefits for the company are:

• Financial protection. Research consistently shows that occupational fraud is most frequently detected through tips. Early detection greatly reduces financial losses and helps to avoid regulatory fines.
• Reputational safeguarding. Handling issues internally and correcting them proactively reduces the risk of damaging leaks to the media or regulators.
• Improved culture. An active, trusted whistleblowing system signals to employees that management values integrity, boosting morale, trust and talent retention.
• Competitive advantage. Institutional investors increasingly treat robust environmental, social and governance (ESG) frameworks, including whistleblowing mechanisms, as a criterion in allocating capital.

The role of the Board and Management

The roles and responsibilities of the Board in whistleblowing:

1. Setting the tone at the top. The Board should publicly champion the whistleblowing system, making it clear that raising concerns is an act of loyalty to the company.
2. Whistleblowing policy. The Board approves and regularly reviews a whistleblowing policy establishing a formal infrastructure: secure reporting channels (hotlines, web platforms), independent investigators (where appropriate, external service providers) and strict non-retaliation rules.
3. Ensuring independent reporting lines. The Board (typically through its audit committee) should ensure that the whistleblowing process is functionally independent of executive management, to prevent conflicts of interest.
4. Direct escalation route. The policy should provide fast-track reporting for high-risk cases: a report concerning senior management goes directly to the Chair of the Board or the audit committee, so that the subjects of an investigation can never oversee it.
5. System monitoring and key indicators. The Board (with the help of its audit committee) regularly reviews anonymised metrics on the reporting system (number of reports, categories of misconduct, investigation closure rates). A complete absence of reports should be challenged by the Board as a possible sign of a culture of fear.
6. Protecting the whistleblower. The Board safeguards the speak-up culture by holding management responsible for the well-being of those who report, and verifies that protection measures are effective and that any retaliation is met with immediate corrective action.

The roles and responsibilities of management in whistleblowing:

1. Establishing accessible channels. Management provides secure, accessible and easy-to-use channels (such as external 24/7 hotlines or encrypted web platforms) that allow anonymous or strictly confidential reporting.
2. Drafting and enforcing procedures. Management creates clear, transparent written procedures detailing how reports are received, how investigations are conducted and how feedback is given to the reporter.
3. Appointing competent case handlers. Management designates and empowers impartial, trained individuals or functions (such as compliance) to handle incoming reports objectively. It is recommended to appoint an independent third-party provider to host the intake hotline or digital platform; this significantly increases employee trust and ensures that reporting data cannot be traced by the internal IT department and that reports are investigated independently.
4. Awareness and training. Management is responsible for continuously training staff on how to use the system and for educating managers on how to react appropriately when an employee raises a concern.
5. Taking corrective action. When an investigation confirms wrongdoing, management takes appropriate disciplinary action and updates internal controls to prevent recurrence.
6. Reporting to the Board and its audit committee. Management provides regular anonymised reports that allow the Board to fulfil its oversight duty.

The core conditions for whistleblowing to succeed are:

• Confidentiality and anonymity. The identity of the whistleblower must remain strictly confidential and be shared only on a need-to-know basis with those conducting the investigation. Anonymous reporting must be fully supported.
• Impartiality. Every report must be assessed objectively by a trained professional who has no personal or professional conflict of interest with the subject of the report.
• Timely feedback. The system must acknowledge receipt of reports promptly and provide the reporter with status updates within a reasonable, predefined timeframe.
• Actionable outcomes. Whistleblowing must yield tangible results; management must follow through with concrete disciplinary actions when wrongdoing is proven.
• Transparency. The whistleblowing policy and the reporting channel or form should be freely available on the company’s external website (reachable from its home page). This demonstrates transparency to all stakeholders and ensures that external parties and former employees can easily access the channels.
• Tone in the middle. While the Board sets the tone at the top, management must ensure that middle managers and supervisors support the policy, translating ethical values into daily operational behaviour so that employees feel safe raising issues at departmental level.

Compliance with EU rules

When establishing or improving a whistleblowing framework, companies must ensure that it complies with the EU Whistleblowing Directive, as transposed in Estonia, Latvia and Lithuania, and with the GDPR, so that reports are handled lawfully and personal data are protected. The Directive requires companies with 50 or more employees to establish internal reporting channels and procedures.¹