A whistleblowing programme works best when it pulls reports inward, into a channel the company can investigate, document, and act on. But sometimes the report travels the other way: to a regulator, a prosecutor, or a journalist. Once that happens, the company has already lost the first chance to put things right. Whether the disclosure is still legal, still protected, and still recoverable depends on a small set of rules that most employers underestimate.
Why employees skip the internal door
Four reasons usually push an employee past the company channel. The organisation has not built one, or has built one that nobody trusts. The reporter has never been told it exists. Fear of retaliation takes over: a hint that complaining ends with the complainer pushed out, sidelined, or relabelled as difficult. Or there is the plain judgement that filing a report would change nothing anyway. Each is a failure of design, not a failing of the reporter. Well publicised channels, a documented response procedure, and visible examples of management acting on what they hear erase the incentive to escalate.
The factor most often missed is culture. When the unwritten rule is that the messenger gets shot, no policy paragraph keeps reports inside the building. Employees read the room long before they read the handbook.
Three tiers under the EU Directive
The European Union has codified the escalation. Directive 2019/1937, adopted in 2019, was transposed into national law across all 27 Member States by 2023. (See our deeper write-up of the EU Whistleblower Directive.) It sets three tiers in order: report internally to the employer, report externally to a designated competent authority, or, in narrow circumstances, disclose publicly. Internal first is encouraged, not mandatory. A whistleblower who walks straight past the employer to a regulator keeps the same protection.
The point of the structure is not bureaucracy. It gives the employer a fair chance to fix the problem before reputational damage spreads, while making sure the reporter can move on if that chance is ignored. Each Member State must designate competent authorities, publish their contact details, acknowledge a report within seven days, and provide feedback within three months.
What external actually means now
External is no longer a vague gesture toward the authorities. Every EU country now runs a published list of designated bodies: financial regulators, labour inspectorates, anti corruption agencies, data protection authorities. Each must accept reports through secure channels and answer on a fixed clock.
Outside the EU the financial incentives are striking. The SEC Whistleblower Program has paid more than 2 billion US dollars to 444 whistleblowers since 2011, with a single record award close to 279 million US dollars. The DOJ Corporate Whistleblower Awards Pilot Program, launched on 1 August 2024 and expanded on 12 May 2025, runs an analogous track for criminal fraud, healthcare fraud, sanctions and tariff offences, with discretionary awards of up to 30% of the first 100 million dollars forfeited. None of this existed when most employee handbooks were written. A reporter who would once have stayed silent now has a phone number, a lawyer, and a meaningful payout waiting on the other end.
Going to the press without losing protection
Walking into a newsroom is the third tier, and the narrowest. Under Article 15 of the EU Directive, a whistleblower keeps protection on a public disclosure only if internal and external reporting failed to address the breach, or if there is reasonable belief that an imminent danger to the public interest exists, or that retaliation or evidence destruction would follow an external report. The UK Public Interest Disclosure Act applies a similar test for wider disclosures, adding that the reporter must gain nothing personally and must reasonably believe the information is substantially true.
Practically: a whistleblower with a confidential reporting line, a regulator that answers the phone, and no evidence of cover up has very little legal cover for taking files straight to a journalist. The press route is built for the cases where every other door is shut.
One whistleblower, two channels
Frances Haugen left Facebook in May 2021 carrying tens of thousands of internal documents. Through her attorneys she filed at least eight complaints with the SEC that autumn, while in parallel handing the same material to the Wall Street Journal, which began publishing the Facebook Files in September. Haugen revealed her identity on 60 Minutes on 3 October 2021 and testified before the US Senate two days later. The case is the textbook example of running the external and the public tiers at once, structured by counsel: the SEC submission anchored the legal protection while the journalism shaped the political pressure.
The internal channel is the only thing that competes with the SEC's bounty, a regulator's fixed clock, or a journalist's deadline. If it exists, is widely known, and visibly leads to action, most reports stay indoors. If it does not, the report still happens, just somewhere out of reach. A working policy on responding to whistleblower reports is what keeps the conversation in the room.
