Before the fourth edition of the Compliance Day (September 2020), we conducted a qualitative questionnaire survey on whistleblowing systems in organizations. Here we present the most important findings of the survey, set against the general background of the ongoing legislative work on whistleblower protection in Poland. 

• Accepting and qualification of whistleblower reports

A whistleblowing procedure has been implemented in 84% of Compliance Day participant organizations. In 14% of them, the procedure only accepts certain types of reported irregularities, with mobbing, discrimination and sexual harassment being predominant. 
A broad range of diverse communications channels are used to report irregularities. Email is the most popular one (81% of the responses). Face-to-face conversations and letters are also popular (74% and 64%, respectively). Helplines to report irregularities are less common. Only 45% of the respondents chose this channel. 

Our survey shows that there are multiple systems to report irregularities. The responses included a form available on the company’s website (approx. 8%), and an external Internet platform (approx. 6%). 
Anonymous reports are accepted by 85% of the organizations participating in the Compliance Day. Noteworthy, the directive on the protection of persons who report breaches of the Union law does not stipulate such an obligation. The directive leaves it up to member states to decide how to regulate anonymous reports. Nevertheless, Polish draft laws in the area of whistleblowing contemplated so far have always allowed for anonymous reports.  

The directive introduces the concept of public disclosure, i.e. the making of information on breaches available in the public domain, e.g. via social media. Such cases have been on the rise, also in Poland. Therefore we asked you, if you treat so disclosed information as grounds for an internal investigation procedure. We received 81% positive answers, including 69% decisive replies. 12% of the respondents stated that a public disclosure may be a basis for an internal investigation if corroborated by other circumstances. 

The question about the recipient accepting and qualifying reports received varied answers. The compliance department (about 35%) or legal department (about 14%) were the most frequent. However, reports are also addressed to the management board, the audit office / department, HR or personnel department, or even the marketing department. Of course, there is no single effective and perfect irregularities reporting system. Nor is there a single job position serving this purpose. One also cannot forget that under the directive, the person receiving the report and taking follow-up actions must hold an independent position, i.e. should report directly to the supervisory body of the organization (supervisory board), and not the management board. 

We have also noted that the use of the ombudsman role is on the rise in Poland. These are persons appointed to provide impartial support within the organization in the resolution of employee - employer conflicts, sometimes a supplier or other partner of the organization. An ombudsman has been appointed in about 5% of the respondent organizations, and they are authorized to accept and classify irregularity reports. This trend bears witness to the growing role of employees in building an ethical work environment. It is also a reflection of the growing awareness of staff that irregularity risk in the organization needs to be managed. 

• Internal investigations 

The majority of respondents stated that a compliance officer has been appointed in their organizations and that it is usually this officer who conducts internal investigations (45% of answers). Interestingly, it is not head of the legal department, but head of the HR department (38%) that ranks second. It may be linked to the fact that head of the HR department is usually designated to deal with cases related to compliance with labor law, including mobbing, discrimination and harassment. Head of the legal department ranked third (31%). Internal investigations are also frequently conducted by audit department employees (24%) and members of the management board or supervisory board (about 16%). 

The majority of organizations allow external experts to take part in internal investigations. Most frequently, it is an external lawyer (38%), IT specialist or computer forensics investigator (31%) and occupational safety and health specialist (19%). However, the responses also included: detectives (5%), a corporate social responsibility specialist (7%) or a psychologist (5%). About 5% of the respondents do not allow any outsiders to take part in their investigation procedures. 

A predominant majority stated that internal investigations usually take up to three months (93%). Half of all investigations take less than one month, and 43% - from one to three months. Only 5% of responses indicated a time longer than three months for an investigation, and at only 2% of the respondent organizations they take less than a week. 

Almost 80% of the organizations prepare a report after the internal investigation is completed. In 14%, reports are produced only in certain cases. Among these respondents, the dominant rule is that a report is drawn up if an irregularity was found (38% of this group). 

NOTE: the majority of documents collected or produced in the course of an investigation are confidential. Minutes of interviews, investigator or IT reports, legal analyses - these are all internal, sensitive information, frequently containing trade secrets, personal data, and similar information that may have an impact on, for example, the company’s stock price. Therefore, preparation of a report and the decision who can see it always require careful planning. 

We were surprised to find that about 17% of the respondents said that they do not offer protection to whistleblowers while the internal investigation procedure is in progress. In our opinion, it shows that the existing regulations and recommendations are very general in nature and do not define any specific means and methods of whistleblower protection. We therefore wish to remind that the fundamental principle of whistleblower protection is confidentiality. Furthermore, a whistleblower should be advised of their rights and committed - in their own interest - to inform the person conducting the investigation of every attempt of retaliation against them. 

The most frequently listed whistleblower protection instruments included: confidentiality ensured by way of restricting the circle of persons having access to information about the investigation (94%), protection against layoff in connection with having made a whistleblowing report (84%), protection against deterioration of working conditions or pay terms (79%) and refraining from any claims against the whistleblower before the investigation is completed (62.5%). These actions are how the prohibition of retaliation is put into practice. However, the whistleblower protection directive also applies the concept of measures of support. We can see such measures being used in the survey responses. In 19% of the respondent organizations, a whistleblower may count on psychological assistance, and in 12.5% they can receive legal assistance if the irregularity involves a breach of the whistleblower’s rights.  

The responses regarding the possibility of legal representatives to take part in the internal investigation were split nearly equally. A slight majority of the organizations (55%) do not allow any legal representatives to take part in internal investigations. 

• Report and implementation of findings

In about 55% of the respondent companies, internal investigations have resulted in organizational changes. Usually these are trainings conducted after the investigation is closed (90.5%), amendments to the existing or implementation of new procedures (84.5%) and changes in the organizational structure (28%). In 15.5% of cases, the investigation has led to appointment of a compliance team or department. 

The majority of respondents provide training to employees in the area of whistleblowing (84.5%). Over half (51.5%) provide such training on a regular basis, most frequently once a year and usually online (about 61%) or face-to-face - by members of management (22.5%) or external trainers (about 4%). 

• Perception of whistleblowing and inherent problems 

In almost 64% of the respondent organizations, employees do not believe that an internal investigation will lead to any resolution of the case and punishing those guilty of the breach. It may be a result of the fact that in conducting such an investigation the employer frequently misses tools needed to clarify the case (which was pointed out by 27.5% of the respondents).

When asked about the biggest problems in the functioning of the whistleblowing system, the respondents indicated lack of a written procedure to be followed when a breach is reported (15.5%), protraction of the proceedings (24%), and lack of independence on the part of the person managing the case (31%). 

• Who participated in the survey?

The survey respondents comprised representatives of both small, medium-sized and large companies: 5% of companies employing up to 50 employees; 24% of companies employing from 51 to 250 employees; 10.5% of companies employing from 251 to 500 employees; 17% of companies employing from 501 to 1,000 employees, and 43.5% of companies employing more than 1,000 employees. The survey respondents represent all sectors of the economy, including manufacturing (8.5%), finance (5%), medicine/pharmaceutical (7%). 

The majority of the survey participants do not deal with many irregularities reports. Over the past two years, 72.5% recorded less than 10 whistleblower reports. Eleven to twenty reports were made at 17% of the organizations, and from 21 to 50 and 51 to 100 reports were made in 5% each, respectively. 

• Conclusions

Whistleblowing is not new for the respondent organizations. Many companies create a whistleblowing system or conduct internal investigations, because they are convinced that these actions are important and are one of the drivers of organization development. 

Poland lacks uniform standards for whistleblowing systems. This applies to the positioning of persons and organizational units in charge of receiving reports in the organizational structure or the methods of whistleblower protection. Clear standards of this protection are missing as well. 

It is quite striking that whistleblower protection is not only a legal challenge, but an organizational one as well. To ensure adequate and practically feasible solutions requires actions coordinated with other (not only legal) areas of the organization.

Find more in the PRO HR Compliance