Looking to install a whistleblower solution? Here is where to start

If you are looking to set up a whistleblower hotline (otherwise known as a compliance hotline) for your organisation, there are some key things to think about. If you are new to the initiative, or new to using these systems as part of a broader whistleblower reporting solution, this quick overview will give you some simple guidance and steps for success.

1. The software is only one element of your whistleblower solution

A whistleblower solution is not just installing some software – that is only one piece of the puzzle. You will need clear buy-in from both your governing body and management, and resources to build a ‘programme’. As well as software, that programme will include policies, procedures, rules, controls, awareness, communication and training. You will also need to have a set of objectives and measure against them to determine the success of the programme.

Of course, you will actually need to have the systems and process in place to receive and handle reports when they happen (and they will happen). This means knowing how to conduct investigations, and having the resources that might be needed to conduct each investigation. You might need to leverage outside teams to help you.

2. The good news: there are guidelines to guide you through the process, step by step

The International Organization for Standardization (ISO) formally enact International Standard ISO 37002 – Whistleblowing Management Systems – Guidelines (ISO Whistleblower Guidelines) and are available to purchase from the ISO stores in each country.

The ISO Whistleblower Guidelines are the first comprehensive guide for companies operating whistleblower management systems. If your programme meets the ISO Whistleblower Guidelines in all respects you have a leading-edge system that meets the best international standards and you should feel very comfortable that it is fit for purpose.

The ISO Whistleblower Guidelines are a perfect document to help you map out the programme that you need to build, and it is our strong advice at ETHIC Intelligence to follow these guidelines precisely when building your programme. They can be used for any sized company, and for private, public, non-profit or even government organisations.

The ISO Whistleblower Guidelines provide advice to organisations for establishing, implementing, maintaining and improving a whistleblowing management system, with the following outcomes:

  • encouraging and facilitating reporting of wrongdoing
  • supporting and protecting whistleblowers and other interested parties
  • ensuring reports of wrongdoing are dealt with in a proper and timely manner
  • improving organisational culture and governance
  • reducing the risks of wrongdoing.

The ISO Whistleblower Guidelines assist organisations to create whistleblowing management systems based on the principles of trust, impartiality and protection. They are adaptable, and their use will vary with the size, nature, complexity and jurisdiction of the organisation’s activities.

3. Be ready to handle triage and investigations

Giving people a voice through a whistleblower system may mean that there is a raft of reports submitted in the early days. Some of these reports might be ‘testing’ the system, and some might be pent-up demand from people that had not already submitted issues through less formal means. Do not be surprised if there are an influx of reports in those early months.

From a resourcing perspective, you can outsource the investigations into these matters. Firms like, our sister company Speeki, can help with basic triage, and there are also firms that can help with the actual investigations. There is a pool of talent that you can use here, which is especially useful if you are a small team and do not have capacity internally.

4. Developing a programme is not a one-off initiative – it needs to be developed, reviewed and improved regularly

From reviewing the ISO Whistleblower Guidelines, you will see that there is quite a bit of work involved in maintaining a programme. While much of this maintenance can be somewhat automated, there are still manual actions. Think of your whistleblower programme like a workplace safety programme: you do not just put it in place and then walk away. You have to watch it, improve it, observe the improvements, plug gaps when you identify issues, and rebuild. That may not be a full-time job in most companies, but overseeing and improving the programme will require some resources. There are options to have this managed by outside consultants, but it is best to be done inside the organisation.

5. Get help from an expert if you need experience or capacity to properly implement the programme

If all of this sounds a bit too hard, then engage some outside help. There are outside agencies, firms and investigators that can help build and/or operate the programme.

How to learn more

The ISO Whistleblower Guidelines are available from ISO stores in each country. Check the ISO website for further details.

ETHIC Intelligence is offering courses on the ISO Whistleblower Guidelines, including how to implement them in your programme. We will also be offering solutions for companies to test their programmes against the ISO Whistleblower Guidelines and support annual check-ups and validation. For further details, please contact us here.