Whistleblowing procedure implementation and management

The Law of 28 November 2022 requires every private-sector legal entity with at least fifty employees to set up channels and procedures for internal reporting, established after consultation with the social partners. For an entity covered by the anti-money laundering provisions or by the rules on financial services, products and markets, no threshold applies.

The channel allows both written and oral reporting, and on the reporting person’s request, a physical meeting within a reasonable time. Your company acknowledges receipt within seven days and gives feedback within at most three months afterwards. It appoints an independent report manager and keeps a register of every report received, for the full duration of the reporting person’s employment relationship.

If your company has fewer than 250 employees, the channel need not accept anonymous reports, and you may share the resources for receiving and investigating reports with another entity in the group. We factor that choice into the design of your procedure.

Alongside the internal channel, an external reporting channel exists with the federal Ombudsmen, who act as the federal coordinator for external reports in the private sector. A reporting person may report externally straight away, without first having to use the internal channel. A procedure that inspires trust keeps a report within the company instead, where the problem can be resolved faster and more discreetly than through an external body.

A well-functioning procedure does more than comply with the law. It helps detect irregularities early in the broadest sense, from integrity breaches to internal corporate fraud, and so protects your organisation’s reputation.

Together with an external partner, we offer an affordable and simple solution that not only helps you meet the legal obligations, but also actually helps detect irregularities early and, where needed, investigate and address them. The channel may be managed by a third party, but your company remains the controller for the personal data processed; we take that into account when we set up the channel for you or take over its management.

To relieve you, we receive and manage the incoming reports ourselves if you wish, confidentially and within the statutory deadlines, and have them investigated further where needed through our private investigation guidance.

Beyond the technical and legal implementation, we handle communication to your staff, so they know the channel, understand how it works and trust that a report stays confidential. A procedure nobody knows or trusts protects nobody in practice, however correctly it is set up in law.

We work closely with you so your employees feel safe reporting a suspicion. If you already have a channel and only want it checked, our whistleblowing procedure audit is the right service, not this implementation.

Company directors find on the company directors page the eight other assignments we carry out for them, including our anti-fraud audit and drafting a fraud and integrity policy.

From fifty employees, an average fixed each year on 1 January across the four quarters of the preceding calendar year. For an entity covered by the anti-money laundering provisions or by the rules on financial services, products and markets, no threshold applies: it always needs a channel.

The company acknowledges receipt of a report within seven days, and gives feedback within at most three months of that acknowledgement. Without an acknowledgement, that three-month period runs from the expiry of the seven-day period. It also keeps a register of every report received.

Yes, we receive and manage the reports confidentially on your company’s behalf if you wish, and have them investigated further where needed. That keeps the handling independent of the internal hierarchy, which lowers the threshold for a reporting person and strengthens the statutory confidentiality of their identity.

Not if your company has fewer than 250 employees. The channel need not accept anonymous reports, and you may share the resources for receiving and investigating reports with another entity in the group. We factor that choice into the design of your procedure.