With the entry into force of Law 361/2022 on the protection of whistleblowers in the public interest, private companies have been preoccupied with identifying and implementing internal reporting channels that ensure compliance with legal provisions and meet specific company needs. We know that an effective whistleblowing system starts with finding these appropriate reporting channels, but the challenges do not stop there. Particular attention needs to be paid to the management of whistleblowing reports so as to ensure both effective communication with the whistleblower and effective resolution of whistleblowing through appropriate follow-up action.

As Law 361/2022 on the protection of whistleblowers in the public interest does not provide much guidance on how to deal with whistleblowing reports, we hope that the practical tips below will be a good start for anyone responsible for the proper management of whistleblowing reports:

• Appointment of a responsible person

According to Law 361/2022 on the protection of whistleblowers in the public interest, private companies with at least 50 employees are obliged to designate/appoint a person or a department for receiving, registering and managing whistleblowing reports. Private companies may also opt for a designated third party, i.e. a specialised provider, to ensure compliance with these legal provisions.

When opting for the internal designation of an individual or department, we believe that the next step is to provide specialised training for such persons. Additional training should cover both the specific obligations set out in Law 361/2022 on the protection of whistleblowers in the public interest with regard to the person designated and practical advice on the handling of integrity warnings. Given the role of the designated person, as well as the practical difficulties he or she may face, we believe that proper training is essential for any effective whistleblowing system.

• Verification of reported information

Once an integrity warning has been registered, such must be thoroughly checked. The main questions to ask at this stage are: who is the whistleblower, to the extent that the whistleblower is not anonymous, and what is the relationship between the whistleblower and the company? What is the purpose of the warning, i.e. what is the direct or indirect message that the whistleblower is trying to convey? What are the potential violations of the law that the whistleblower is considering? What additional information do I need to clarify the situation exposed by the warning?

• Carrying out additional checks

As integrity warnings often contain incomplete information or insufficient evidence, the person designated to handle integrity warnings should seek the necessary clarification directly from the whistleblower, where possible, or carry out additional checks on their own. The purpose of these verifications is to place the situation described by the whistleblower in a certain context and to obtain all relevant information about this context. For example, if the whistleblower raises certain issues related to the relationship with a particular supplier, the additional checks should clarify the context of the relationship with this supplier, by indicating the main parameters: duration and nature of the relationship, its overall impact in the context of the company’s supply chain, the person responsible for managing the relationship with the supplier, etc.

• Identifying potential violations of the law

After verifying the information received and carrying out additional checks, the person designated to handle integrity warnings must translate the issue exposed in the warning into legal language: what is allowed and what is not allowed, i.e. what constitutes a breach of the law and what does not. This is probably the most difficult task for the designated person, especially if he or she has no specialist legal training.

To confirm or refute a violation of the law, the designated person may use the company’s existing best practice guidelines, i.e. company-approved working procedures and internal regulations or directives. These should provide the designated person with valuable clues as to which practices are permitted by the company and which are prohibited. In all cases, the use of legal counsel or specialist lawyers is recommended, as they can reinforce the designee’s conclusions where needed, or provide additional help where things are unclear.

The designated person must identify potential violations of the law regardless of the language or form of expression used by the whistleblower, and even if that expression does not explicitly indicate a potential violation of the law. The designated person’s analysis is similar in this respect to the initial medical history taken by a general practitioner – he or she will know how to interpret the information provided by the patient and make a diagnosis, regardless of the patient and the way he or she communicates. 

• Proposal for follow-up measures

Once the designated person has determined the implications of a warning, such may either be closed, in cases provided for by Law 361/2022 on the protection of whistleblowers in the public interest, or further processed, if specific measures are required.

Follow-up action must address the issue raised through the whistleblowing report in order to eliminate any irregularities found. Clearly, they will have to be determined on a case-by-case basis, following the nature of the warning and its implications. They may consist of initiating a disciplinary investigation if the conditions are met, terminating a business relationship if there is evidence of malpractice, etc.

In certain situations, the follow-up measures may prove to be extremely complex and difficult to implement – in such cases, the use of specialised consultants and providers may be indispensable.

But one thing is clear: the nature and quality of the action taken in response to a whistleblowing depends on both the relationship with the whistleblower and the company’s level of compliance. In all cases, follow-up action must follow company policy, established best practice and applicable law.