Establishing a whistleblowing channel is a self-evident part of modern corporate governance today.

But many organizations stop at the technology.

A properly constructed whistleblower function is not just about receiving reports – but about how they are handled when they become inconvenient.

The starting point is in EDirective (EU) 2019/1937, but the directive mainly regulates the minimum requirements. It is in the implementation that the risks arise.

Here's what's actually required – and where the most common weaknesses lie.

A secure and confidential reporting channel

Reporting should be possible:

• In writing

• Verbal

• Upon request through a physical meeting

The system shall ensure confidentiality and limited access.

But many people make mistakes here.

A technical platform without a clear owner and process creates a false sense of security.

The question is not just whether the report can be submitted, but what happens next.

2. Independent Recipient Function

There shall be a clearly designated function that:

• Receiving reports

• Confirm receipt

• Assesses whether the matter falls within the scope

• Initiating investigation

In small and medium-sized companies, this often falls to:

• Human Resources

• Chief Financial Officer

• VD

This is where the practical challenge arises.

What happens when the report concerns:

• The management?

• The board?

• Economy function?

An internal function can quickly end up in a conflict of interest – even if no one acts improperly.

Independence is not a formal question. It is a matter of trust.

3. Confirmation within 7 days

The reporting person shall receive confirmation of receipt.

This is easy to fulfill in theory.

In practice, it is missed when:

• Responsibility is unclear

• Things are falling through the cracks.

• No one has operational responsibility

Structure is required – not just will.

4. Objective and professional investigation

A report should be assessed objectively and proportionately.

It requires:

• Legal understanding

• Documentation Discipline

• Awareness of evidence assessment

• Ability to handle sensitive interviews

This is where the biggest risk lies.

A flawed internal investigation can:

• Worsen the situation

• Create new legal problems

• Undermine trust in the function

5. Feedback within three months

Feedback is a legal requirement – but also crucial for legitimacy.

An organization that cannot demonstrate:

• That cases are taken seriously

• That they are handled consistently

• That decisions are made in a structured way

risks that the function will be perceived as symbolic.

6. Protection against retaliation

A policy stating that retaliation is prohibited is not enough.

Organizations must be able to:

• Identify subtle retaliation

• Assess relationship

• Document decisions

• Ensure objectivity

This is particularly sensitive when the reporting concerns individuals in leadership positions.

7. Documentation and traceability

Every step of the process must be auditable.

• When the report was submitted

• Who handled it

• Which assessments were made

• What measures were taken

Inadequate documentation is one of the most common weaknesses during reviews.

Why internal management often isn't enough

An internal function can work well in some organizations.

But in practice, three problems often arise:

1. Conflicts of interest

When the report concerns management, there is a lack of true independence.

Skills shortage

Investigating complex regulatory violations requires legal and procedural experience.

3. Trust Issues

Employees and suppliers hesitate to report if they do not perceive the function as neutral.

An external, legally anchored function can therefore:

• Create real independence

• Ensure professional investigation

• Increase the willingness to report internally instead of externally

It's not about distrusting one's own organization.

It's about building a structure that holds up even when the pressure increases.

Conclusion

A properly constructed whistleblower function requires:

• Secure channel

• Independent recipient

• Structured investigation process

• Clear feedback

• Documented traceability

Technology is a component.

But it is the governance and legal craftsmanship that determine whether the function works in practice.