To improve the risk management benefits of their whistleblowing framework, organizations need to win the trust of their employees. Here are four actions organizations can take to strengthen the integrity of their whistleblowing programs.
1. Nurture an integrity-first culture
Organizations need to create an environment where employees feel psychologically safe to speak up and are confident that their concerns will not only be heard but also acted upon. This is easier said than done.
The 2023 LRN Code of Conduct Report,9 published by LRN Corporation, found that globally, a “speak up” culture appears deficient in most organizations. The 2023 LRN Code of Conduct Report reviewed the codes of conduct of top publicly traded companies across Europe, North America and Asia, assessing them on metrics such as the ease of speaking up about risky topics, usability of the codes of conduct and knowledge reinforcement through learning and development initiatives. Slightly more than half (57%) of the studied codes have a strong non-retaliation policy for employees who speak up about misconduct.10 Fewer than one- in- five (17%) can explain the procedure for investigating misconduct. In Asia, Singapore’s Straits Times Index (STI) 30 had the lowest code effectiveness scores. Companies in Japan’s Nikkei (NIK) 40 were only slightly better. US Standard & Poor (S&P) 100 companies ranked among the top performers.
Creating a culture that focuses on employee engagement and raising awareness around integrity and accountability is important. According to research11 by the Einaudi Institute for Economics and Finance (EIEF), the Kellogg School of Management, and the University of Chicago Booth School of Business, the higher the measure of integrity, the better the firm’s performance. Companies with an integrity-first culture were more often chosen by students as an attractive place to work and less likely to be subject to unionization attempts.
Yet, even with robust whistleblower programs in place, cultural influences can be a significant factor when it comes to speaking up. In some countries, a culture of deference to more senior members in the workplace may contribute to individuals being fearful of reporting misconduct.
Consequently, leaders need to do more than encourage employees to speak up when they see wrongdoing — they need to actively engage them. More than making space for employees to speak, leaders need to be proactively soliciting their opinion. It’s less about broadcasting a message and more about establishing multidirectional dialogue. As such, leaders need to not only listen to their employees but also act on what they hear.
2. Increase awareness, training and communication
According to the findings of the EY Global Integrity Report 2024, more organizations have implemented whistleblowing hotlines, with the percentage of respondents who said that their organization doesn’t have one dropping to 7% from 14% two years ago. Furthermore, one-third of all respondents indicated it has become easier to report concerns, and that the solutions for whistleblowing are more advanced and offer greater anonymity.
These advancements may, at least in part, explain why board members and senior management say they feel more confident that the whistleblowing environment has improved over the last two years. Yet, when respondents in the EY Global Integrity Report 2024 were asked how often they had heard management communicate about the importance of behaving with integrity, only fewer than half of all respondents (47%) said communication was frequent. Among employees, the percentage falls to one-third (33%).
When asked how much they knew about the legal protection or policies their organization or country had in place to safeguard whistleblowers from retaliation, 44% of all respondents said they knew a great deal or a fair amount. One-quarter knew nothing about, had never heard of or didn’t know about what whistleblower protection programs were available to them. Among employees (as opposed to managers, executives or board members), these percentages were reversed: only 25% knew a great deal or a fair amount, whereas 42% knew nothing or had never heard anything about whistleblower protection mechanisms.
Awareness, training and communication are critical to strengthening and maintaining an integrity-first culture, particularly when it comes to whistleblowing. It’s associated with both faster detection of fraud and lower losses. According to the ACFE, organizations that didn’t provide fraud awareness training to their employees lost nearly two times more financially than those who did provide training.
Given that more than half (52%) of whistleblowers are rank-and-file employees (as opposed to managers, executives or board members)12, it’s imperative to give them the right awareness training and multiple channels of communication to report wrongdoing. Of those who reported wrongdoing, 40% used online forms to report their concerns, followed by email (37%) and telephone (30%).13
“Organizations should regularly communicate, potentially to the point of over-communicating, the importance of speaking up with safety and anonymity,” notes Jonathan Feig, EY Forensic & Integrity Services Partner.
At the same time, organizations also need to formulate mechanisms and clearly communicate the actions and consequences of malicious whistleblowing to deter the misuse of the whistleblowing program.
To maximize the effectiveness of whistleblowing programs, organizations should regularly track stakeholders’ awareness and confidence in these initiatives, for instance, through staff engagement surveys. The point is not only to ensure that employees feel empowered to report issues, but that they also feel that their information is appreciated and acted upon, and that the organization demonstrates a willingness to continually evolve the program in response to employees’ needs.
3. Use technology to augment traditional channels of whistleblowing communication and reporting
As critical as training and communication are in developing a robust integrity-first culture, traditional tools aren’t always effective. Employees may miss an email outlining the organization’s whistleblowing policy or forget what they have learned in a training module. Technology advancements are, therefore, being used to augment and improve communication and management of whistleblowing programs.
In Europe, for example, organizations are integrating several new technologies into their whistleblowing frameworks to improve communication, including allowing individuals to report concerns from any location or device, providing flexible reporting forms, and offering optional anonymity for whistleblowers. According to the NAVEX 2024 Whistleblowing & Incident Management Benchmark Report14: “An efficient and trusted mechanism by which employees can anonymously or confidentially make inquiries and allegations of suspected or actual misconduct without fear of retaliation is the hallmark of a well-designed compliance program.”
In addition to technology innovations to improve communications channels for whistleblowers, evolving technology is also helping organizations to monitor, store, manage and address misconduct reports. This includes external report management, online repositories to securely store and share relevant documents, audit trails, intuitive case management, anonymization and archiving for General Data Protection Regulation (GDPR) compliance, configurable access rights management, and internal chat platforms for secure exchange of messages and documents among teams and external advisors.
Artificial intelligence (AI) and generative AI (GenAI) are also making their way into whistleblowing frameworks, from individual report analysis (content and document analyses, as well as activity logging) to database analyses (natural language processing, pattern recognition and trend analysis). "GenAI significantly enhances the system's usefulness and capabilities. It can provide summaries and translations of allegations, analyze the content of documents submitted by whistleblowers, and manage the overall triage of cases. This includes classifying complaints, identifying relationships between complainants, assessing the urgency and criticality of issues, and identifying common patterns within the reports to summarize the necessary actions to be taken,” says Wojciech Niezgodziński, EY Forensic & Integrity Services Partner, Ernst & Young spółka z ograniczoną odpowiedzialnością. “It can even support automating reports and recommending next steps."
4. Embed whistleblower program into the organization’s global compliance strategy
Whistleblowing programs, which are crucial for organizations, shouldn’t be considered as siloed risk management components. The program needs to be integrated into an overall compliance and risk management strategy and operations to enable the organization to not only manage and mitigate risks, but also help employees to feel confident, heard and protected.
When employees and third-parties feel confident that their concerns will be taken seriously, it reinforces the importance of compliance across the organization, ultimately reducing the likelihood of future misconduct. Real-life examples, such as the role whistleblowers played in exposing corporate scandals like defective parts and quality short cuts at a prominent aerospace company or the falsification of medical testing devices at a health technology start-up, demonstrate how intervention can prevent future harm.
The value of a whistleblowing program far outweighs cost
Whistleblowing has gained significant attention and recognition in recent years. The introduction of whistleblower protection laws, increased awareness of the importance of reporting misconduct, and advancements in communication technology have all contributed to creating a more conducive environment for whistleblowing.
Within organizations, whistleblowing programs have become a vital element of global compliance strategy, as they provide crucial mechanisms for identifying and addressing unethical behavior, regulatory violations, or other misconduct that may put the organization at risk. By uncovering potential issues early, these programs help mitigate risks, close compliance gaps, and promote a culture of integrity, accountability and trust.
The value to be gained legally, financially and reputationally, far outweighs its cost.
