Sample procedure for reporting irregularities and whistleblower protection
One of the obligations and challenges of entities implementing the provisions on whistleblower protection in their organization is the development and adoption of internal procedures for receiving and following up on reports.
The DIRECTIVE (EU) 2019/1937 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 23 October 2019 on the protection of persons who report breaches of Union law (Whistleblower Directive) provides that reporting persons should be encouraged to first use internal reporting channels and report to their employer, if such channels are available to them and can reasonably be expected to work. As a consequence, legal entities in the private and public sector should establish appropriate internal procedures for receiving and following up on reports.
According to Article 9 of the Whistleblower Directive, The procedures for internal reporting and for follow-up as referred to in Article 8 shall include the following:
- channels for receiving the reports which are designed, established and operated in a secure manner that ensures that the confidentiality of the identity of the reporting person and any third party mentioned in the report is protected, and prevents access thereto by non-authorised staff members;
- acknowledgment of receipt of the report to the reporting person within seven days of that receipt;
- the designation of an impartial person or department competent for following-up on the reports which may be the same person or department as the one that receives the reports and which will maintain communication with the reporting person and, where necessary, ask for further information from and provide feedback to that reporting person;
- diligent follow-up by the designated person or department referred to in point (c);
- diligent follow-up, where provided for in national law, as regards anonymous reporting;
- a reasonable timeframe to provide feedback, not exceeding three months from the acknowledgment of receipt or, if no acknowledgement was sent to the reporting person, three months from the expiry of the seven-day period after the report was made;
- provision of clear and easily accessible information regarding the procedures for reporting externally to competent authorities pursuant to Article 10 and, where relevant, to institutions, bodies, offices or agencies of the Union.
The draft law on the protection of persons who report violations of the law, require employers covered by this law to establish internal reporting rules, which define the procedure for reporting violations of the law and taking follow-up actions. The proposed provisions assume that the regulations will be an act of the internal law of the employer, and therefore its content should be agreed with the employees' representatives, in accordance with the applicable regulations.
As part of the partnership between WeMoral and the law firm SPG Legal Sawicki i Wspólnicy (spglegal.pl) we have developed a draft regulations for whistleblowers, which is available for free download.