Whistleblowing Directive reopens the debate on whether to outsource reporting channels

The Council of Ministers approved earlier this year (4 March 2022) the preliminary draft law on the protection of persons who report breaches of EU law and anti-corruption regulations, which transposes EU Directive 2019/1937 known as the Whistleblowing Directive. 

This European regulation requires private companies with 50 or more employees to provide their staff and third parties with an ethics or reporting channel, the management of which may be outsourced. 

In Spain, since the introduction of article 31 bis of the Criminal Code by means of LO 1/2015 of 30 March, the scope and regulation of compliance programmes have experienced exponential growth. The culture of compliance is progressively taking root in the business world and, consequently, so is its expansion and development.

Reporting channels

One of the key elements of a compliance programme is the existence of an ethical or reporting channel for internal breaches or illicit activities of the company that makes it feasible to report possible risks to the organisation's compliance body.

Against this background, the Whistleblowing Directive aims to ensure the protection of whistleblowers, avoid conflicts of interest, safeguard the integrity of the investigation and the assessment of potential risks, and prevent breaches of the compliance programme.

Although the Whistleblowing Directive has been binding in Spain since December 2021, the law transposing it is not expected to come into force until the last quarter of 2022. Companies will have to consider whether to outsource their ethics channel to other companies or to manage it in-house. 

Faced with this dilemma, doubts may arise as to whether it is better to opt for one option or the other. What are the advantages and disadvantages of outsourcing, or not, the management of an organisation's ethics or reporting channel?

Information anonymity and confidentiality 

In order to guarantee the effectiveness of the ethics channel, it is essential to guarantee the confidentiality of the information and ensure the protection of whistleblowers, so they are not discouraged from reporting for fear of retaliation or having to face other consequences that may arise from a breach of confidentiality. In this regard, it is important to make sure that the identity of the whistleblower is kept confidential and that the report and the investigation, even its mere existence, is not known to anyone other than those in charge of managing the channel and the investigation.

Despite the existence of the duty of confidentiality inherent to the position of the person in charge of managing the channel, it is more likely that information leaks happen in internal channels when those in charge and those under investigation share a workplace, which could jeopardise the entire investigation. On the other hand, in an external channel, leaks are less likely to occur because the persons in charge are in a different location. In addition, the use of servers outside the organisation, a priori, makes it more difficult for anyone to have illegitimate access ensuring safe reporting and investigation.

Immediacy and knowledge 

The reporting channel must be immediate and it needs to be ensured that it will have the expected effect and not discourage whistleblowers because they feel like the organisation's employees are not handling the report efficiently. In this sense, an internal channel, unlike an external channel, can provide a quicker and more effective response since the person in charge of managing the channel and the reporting person are closer.

An in-depth knowledge of the organisation, its staff and its idiosyncrasies may be very useful when dealing with the reporting process and the investigation. To have a good knowledge of the organisation may be useful when dealing with the investigation, and having personal contact and empathy with the subjects of the investigation can lead to a greater degree of trust that may make them feel more comfortable and encourage their collaboration on the investigation.

Independence and objectivity 

If knowing the people can be useful, it can also lead to a loss of objectivity and impartiality, which may result in a potential conflict of interest that could jeopardise the validity and effectiveness of the channel itself.

In an internal ethics channel, there may be a substantially higher risk that, due to personal or professional relationships, the objectivity and independence of the persons in charge of managing the channel are compromised. In addition, if the report is about the conduct of one of those in charge, a conflict of interest could arise.

Conflict of interest 

If the reporting channel is outsourced, the likelihood of a conflict of interest is logically considerably reduced. It is sufficient to point out the possibility that those responsible for managing the internal reporting channel may be involved, even indirectly, in the matters reported.

Osborne Clarke comment 

Each organisation will need to assess which type of channel provides the best guarantees in terms of good performance and accountability in order to ensure the highest levels of confidentiality and independence. In our opinion, the management of a reporting channel and the resulting investigations should be led by the organization's compliance body, which can act with immediacy and with sufficient knowledge of the entity, but with external support (i.e. lawyers, auditors, etc.) to ensure the independence and objectivity of the process.