Whistleblowing procedure audit: review your reporting channel

The Law of 28 November 2022 requires every private-sector legal entity with at least fifty employees to set up an internal reporting channel, established after consultation with the social partners. For entities covered by the anti-money laundering provisions or by the rules on financial services, products and markets, no threshold applies: even a ten-person firm must then have a channel.

The channel must allow both written and oral reports, and on the reporting person’s request, a physical meeting within a reasonable time. Your company acknowledges receipt of a report within seven days, and gives feedback within at most three months of that acknowledgement, or three months after the seven-day period expires if no acknowledgement was sent. It also appoints an independent report manager who has no conflict of interest.

Anyone who dismisses, demotes or otherwise penalises a reporting person after a report faces a reversal of the burden of proof: the law presumes the detriment is retaliation, and the employer must then show the measure was duly justified. Compensation runs between 18 and 26 weeks of pay, and a breach of the channel itself carries a level 4 sanction.

If your company has fewer than 250 employees, your channel need not accept anonymous reports, and you may share the resources for receiving and investigating reports with another entity in the group. Our audit checks whether your company makes use of that relaxation, and whether it does so in a legally defensible way.

Alongside the internal channel, an external reporting channel exists with the federal Ombudsmen, who act as the federal coordinator for external reports in the private sector. A reporting person may report externally straight away, without first having to use the internal channel. A procedure that inspires trust keeps a report within the company instead, where the problem can be resolved faster and more discreetly than through an external body.

We audit your existing reporting channel and its legal integration, much as in our anti-fraud audit of the wider internal control, and check whether the whistleblowing procedure can also apply to other forms of irregularity, such as internal fraud. You receive our findings as advice with the recommendations that are needed.

If your company does not yet keep a complete register of every report received, we include that in our recommendations: the law requires that register for the full duration of the reporting person’s employment relationship. This audit covers your existing channel; for setting up a channel from scratch, our whistleblowing procedure (implementation, tool and reporting management) is the right service.

Anyone who wants to add a broader fraud policy to the channel finds that in drafting a fraud and integrity policy. Company directors find on the company directors page the eight other assignments we carry out for them, including our criminal liability audit.

From fifty employees, an average fixed each year on 1 January across the four quarters of the preceding calendar year. That exemption does not apply to entities covered by the anti-money laundering provisions or by the rules on financial services, products and markets: they need a channel regardless of their headcount.

Within at most three months of the acknowledgement of receipt, or three months after the seven-day period expires if no acknowledgement was sent. The company therefore first acknowledges receipt of every report within seven days, then communicates the measures taken or planned within the deadline that follows.

Yes, such an audit checks not only whether the channel meets the legal minimum requirements, but also whether its scope can be widened, for example to internal fraud or other irregularities. We then provide advice with concrete recommendations, and where needed guide the extension of the channel.

A reversal of the burden of proof: the law presumes the detriment is retaliation, and the employer must then show the measure was duly justified. Compensation runs between 18 and 26 weeks of pay, and a breach of the channel itself carries a level 4 sanction.