It is recommended to conduct an early risk assessment that can reveal whether employees are aware of matters of concern within the organization. Such an assessment can indicate the risk of various types of matters of concern occurring. The results from the risk assessment can serve as a basis for developing the organization's ethical guidelines. Together with other norms and regulations, these ethical guidelines will form a basis for the organization's whistleblowing procedures.
When a report is received, a few trusted case handlers should be designated to investigate the whistleblowing case within the organization. The case handlers could, for example, be from the HR department, the safety representative, or members of the board. If the case handling is done through the digital portal at MyVoice.com, different individuals in the organization can be assigned different roles in the whistleblowing case.
At Mittvarsel.no, different roles are opened: responsible case handler, administrator, read-only user. Administrators have full access to all cases in the whistleblowing portal. Case handlers only have access to the cases they are assigned by the administrator or those that are directly sent. Read-only users are assigned cases where they have access to view but not to communicate or participate in the case handling.
The responsible case handler must then gather information about the case, by interviewing the parties involved. It may be advantageous to interview the whistleblower before the reported individual is called in for an interview. Other parties who are aware of the case or have objections can also be interviewed to map out the situation as thoroughly as possible.
Neither the whistleblower nor other employees in the organization should have access to the case handling. However, the person being reported has the right to present their version of the case. Therefore, they are entitled to see the content of the report so that they can defend themselves. It must be emphasized, however, that the right to access does not apply to documents prepared for internal case preparation.
In some cases, the case handler may choose to reject the case, thus opting not to initiate the case handling process. This is primarily relevant if the case does not concern a matter of concern.
A matter of concern is a situation that is in violation of the law, with written ethical guidelines in the company, or with ethical norms that have broad support in society. This may include conditions that pose a danger to life or health, a risk to the climate or environment, corruption or other financial crime, abuse of power, an unsafe work environment, or breaches of personal data security.
On the other hand, expressions that only concern the worker's own employment relationship are normally not considered matters of concern in the context of whistleblowing. Examples of the worker's own circumstances that are not covered by the whistleblowing rules include personnel conflicts, professional or political expressions, and general dissatisfaction with the workplace.
In other cases, a whistleblowing case may be rejected due to a lack of information.
As mentioned, the employer has a duty of activity, which includes the duty to gather information in the handling of whistleblowing cases. In some cases, however, anonymous submitters may forget their password or regret the whistleblowing process after the report is received. With anonymous whistleblowers, the case handler will not be able to call for meetings or further investigate the case without active participation from the whistleblower through the portal. If the case handler requests further information and there is a long period without any feedback from the anonymous submitter, there may be grounds to reject the case due to a lack of information.
After the case has been investigated, the case handler should conclude whether or not there is a matter of concern.
If a matter of concern is uncovered, measures should be taken to ensure that the condition ceases. The reported individual must then be informed about the consequences the measures will entail, according to the organization's ethical guidelines or whistleblowing procedures.
Once the case is concluded, the involved parties should receive feedback on the outcome of the case.
After the case is closed, the organization should evaluate the whistleblowing process. Was the organization sufficiently prepared to handle this case? Was this something we were aware could happen when we worked on risk assessment? To prevent similar cases in the future, the company can use the experience to update ethical guidelines and whistleblowing procedures.