{"id":1469,"date":"2026-03-03T15:56:12","date_gmt":"2026-03-03T14:56:12","guid":{"rendered":"https:\/\/wisling.com\/?p=1469"},"modified":"2026-03-19T16:41:48","modified_gmt":"2026-03-19T15:41:48","slug":"whistleblowing-in-groups-the-parent-company-must-handle-all-matters","status":"publish","type":"post","link":"https:\/\/wisling.com\/en\/2026\/03\/03\/visselblasning-i-koncerner-far-moderbolaget-hantera-alla-arenden\/","title":{"rendered":"Whistleblowing in groups - can the parent company handle all cases?"},"content":{"rendered":"
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Whistleblowing in groups - can the parent company handle all cases?<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

It is one of the most common issues in international groups:<\/p>

Can the parent company handle all whistleblowing reports for the whole group?<\/p>

The answer is:<\/p>

Yes - but not without preconditions.<\/p>

The starting point is in EU Directive (EU) 2019\/1937<\/b><\/span>.<\/span><\/p>

1. the obligation applies per legal entity<\/b><\/h2>

The Directive requires legal entities in the private sector with 50 or more employees to establish internal channels and procedures for reporting (Article 8).<\/p>

This applies per legal entity<\/b><\/span>.<\/p>

This means that:<\/p>

  • A subsidiary with 60 employees is subject to the obligation.<\/p><\/li>

  • A parent company with 10 employees is not covered simply because of the overall size of the group.<\/p><\/li><\/ul>

    The Directive does not refer to \u201dgroups\u201d as a common legal duty bearer.<\/p>

    The obligation is linked to each individual legal person.<\/p>

    2. may the group centralize the function?<\/b><\/h2>

    Yes.<\/p>

    The Directive does not prohibit the reporting function from being organized jointly within a group.<\/p>

    In practice, this can mean that:<\/p>

    • A parent company receives reports for subsidiaries.<\/p><\/li>

    • A common group platform is used.<\/p><\/li>

    • A central compliance or legal function handles cases.<\/p><\/li><\/ul>

      But this does not change the basic responsibility.<\/p>

      Each legal entity must be able to ensure that:<\/p>

      • Reporting is possible.<\/p><\/li>

      • Confidentiality requirements are met.<\/p><\/li>

      • Feedback is provided within the prescribed time.<\/p><\/li>

      • Follow-up is carried out correctly.<\/p><\/li><\/ul>

        Centralization must not undermine these requirements.<\/p>

        3. confidentiality and independence<\/b><\/h2>

        The Directive sets clear requirements:<\/p>

        • Confidentiality of the identity of the reporting person.<\/p><\/li>

        • Restricted access to data.<\/p><\/li>

        • Protection against retaliation.<\/p><\/li><\/ul>

          Group solutions raise specific issues:<\/p>

          • Who has access to the information?<\/p><\/li>

          • Can local management have access to sensitive cases?<\/p><\/li>

          • How are matters concerning the parent company's management handled?<\/p><\/li><\/ul>

            A central function can strengthen independence - but only if the structure is well thought out.<\/p>

            4. Small subsidiaries in large groups<\/b><\/h2>

            A common situation is:<\/p>

            • The group has thousands of employees.<\/p><\/li>

            • One subsidiary has 20 employees.<\/p><\/li><\/ul>

              If the subsidiary has fewer than 50 employees, it is normally not subject to the obligation to establish its own internal channel under the Directive.<\/p>

              Men:<\/p>

              If the group chooses to offer a common function, these companies can also be covered in practice.<\/p>

              It is allowed - and often wise - but it is a voluntary organizational choice rather than a direct legal requirement at EU level.<\/p>

              5. Who is responsible in case of shortcomings?<\/b><\/h2>

              This is a crucial issue.<\/p>

              Even if reception is centralized, each legal entity must be able to demonstrate that:<\/p>

              • The requirements of the Directive are met.<\/p><\/li>

              • Follow-up is done correctly.<\/p><\/li>

              • Protection against retaliation is ensured locally.<\/p><\/li><\/ul>

                A group structure does not change the legal responsibility at entity level.<\/p>

                Conclusion<\/b><\/h2>

                Is the parent company allowed to handle all whistleblowing reports?<\/p>

                Yes - it is possible to centralize the function within a group.<\/p>

                Men:<\/p>

                • The obligation to have a function applies per legal entity.<\/p><\/li>

                • Centralization must not reduce the requirements for confidentiality, feedback and follow-up.<\/p><\/li>

                • Responsibility cannot be fully \u201dmoved up\u201d to group level.<\/p><\/li><\/ul>

                  A group solution therefore requires a clear structure, clear mandates and documented responsibilities.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"

                  Whistleblowing in groups - can the parent company handle all cases? It is one of the most common questions in international groups: can the parent company handle all whistleblowing reports for the whole group? The answer is: Yes - but not without conditions. The starting point is EU Directive (EU) 2019\/1937. 1. The obligation applies per legal entity The Directive states that legal entities in the private sector with 50 or more employees shall establish internal channels and procedures for reporting (Article 8). This applies per legal entity. This means that: A subsidiary with 60 employees is subject to the obligation. A parent company with 10 employees is not covered simply because of the overall size of the group. The Directive does not speak of \u201dgroups\u201d as a single legal obligation bearer. The obligation is linked to each individual legal person. 2. May the group centralize the function? Yes, it can. The Directive does not prohibit the reporting function from being organized jointly within a group. In practice, this may mean that: a parent company receives reports for subsidiaries; a common group platform is used; a central compliance or legal function handles cases. But this does not change the basic responsibilities. Each legal entity must be able to ensure that: Reporting is possible. Confidentiality requirements are met. Feedback is provided in a timely manner. Follow-up is carried out correctly. Centralization must not undermine these requirements. 3. Confidentiality and independence The Directive clearly requires Confidentiality of the identity of the reporting person. Restricted access to data. Protection against retaliation. In the case of group solutions, specific questions arise: Who has access to the information? Can local management have access to sensitive matters? How are matters concerning the parent company's management handled? A central function can strengthen independence - but only if the structure is well thought out. 4. Small subsidiaries in large groups A common situation is: the group has thousands of employees. A subsidiary has 20 employees. If the subsidiary has less than 50 employees, it is normally not subject to the obligation to set up its own internal channel under the Directive. However, if the group chooses to offer a common function, these companies may also be covered in practice. This is allowed - and often wise - but it is a voluntary organizational choice rather than a direct legal requirement at EU level. 5. Who bears responsibility in case of failure? This is a crucial question. Even if reception is centralized, each legal entity must be able to demonstrate that: The requirements of the Directive are met. Monitoring is done correctly. Protection against retaliation is ensured locally. A group structure does not change the legal responsibility at entity level. Conclusion Can the parent company handle all whistleblowing reports? Yes - it is possible to centralize the function within a group. But: the obligation to have a function applies per legal entity. Centralization must not reduce confidentiality, feedback and follow-up requirements. Responsibilities cannot be fully \u201dmoved up\u201d to the group level. A group solution therefore requires a clear structure, clear mandates and documented responsibilities.<\/p>","protected":false},"author":1,"featured_media":1470,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"page_builder":"","footnotes":""},"categories":[1],"tags":[],"class_list":["post-1469","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/wisling.com\/en\/wp-json\/wp\/v2\/posts\/1469","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wisling.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wisling.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wisling.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/wisling.com\/en\/wp-json\/wp\/v2\/comments?post=1469"}],"version-history":[{"count":7,"href":"https:\/\/wisling.com\/en\/wp-json\/wp\/v2\/posts\/1469\/revisions"}],"predecessor-version":[{"id":1570,"href":"https:\/\/wisling.com\/en\/wp-json\/wp\/v2\/posts\/1469\/revisions\/1570"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wisling.com\/en\/wp-json\/wp\/v2\/media\/1470"}],"wp:attachment":[{"href":"https:\/\/wisling.com\/en\/wp-json\/wp\/v2\/media?parent=1469"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wisling.com\/en\/wp-json\/wp\/v2\/categories?post=1469"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wisling.com\/en\/wp-json\/wp\/v2\/tags?post=1469"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}