New standards on employers: a new era for corporate whistleblowing?
17 March 2022
By Ida Nowers Law and Policy Coordinator at WIN
The International Chamber of Commerce – the ICC - the largest business representative organisation in the world - has published new guidelines on whistleblower protection.
ICC 2022 is a revision of the 2008 guidelines which have been updated to take account of the rapidly evolving standards on whistleblower protection and significant legal reforms around the globe – including the ‘groundbreaking’ European Directive (2019/1937) which includes obligations to establish confidential reporting systems in the private sector and provides for ‘effective and dissuasive’ penalties against those who retaliate or suppress whistleblowing.
Read more: ICC 2022 Guideline on Whistleblowing
The ICC Guidelines aim to help enterprises establish and implement internal whistleblowing arrangements. Whilst not binding, the ICC Guidelines may prove another useful lever to persuade corporations to take their responsibilities seriously, reinforcing the ISO 37002 Guidelines on Whistleblowing Management Systems which offer comprehensive guidance on designing and implementing a whistleblowing management system.
Read more: ISO 37002: Guidelines on Whistleblowing Management Systems
ICC 2022 Guidelines highlights:
Wide scope of what reports should be protected – Both the ICC 2022 Guidelines and the ISO 37002 adopt a commendably broad ‘material scope’ and recommend employers receive and handle reports about any ‘wrongdoing’ – whether actual or potential, including ‘reasonable suspicions.’
Wrongdoing is defined as any ‘action(s) or omissions(s) or concealment of an act or commission that can cause harm’ - including breaches of internal conduct, ethics or other integrity policies.*
Zero tolerance of whistleblowing retaliation – The Guidelines also adopt a broad, non-exhaustive, definition of what retaliation can look like and recommend a ‘zero-tolerance’ approach to victimisation’ which is essential to the effective operation of institutional whistleblowing arrangements.
The Guidelines also recommend extending protection from retaliation to persons who assist whistleblowers.
Not restricting protection to designated channels – The Guidelines provide that where a report is not received through the designated channel, but instead is also reported to or received by other internal personnel, for example as part of normal day-to-day business line management, the strict confidentiality standards also apply to the handling of that disclosure.**
The rights of the whistleblower to report externally to authorities must be made clear and transparent. This is important in countries particularly where there is not legal protection of direct external reporting to competent authorities.
Focus on following up – Echoing the EU Directive, the ICC 2022 Guidelines recommends acknowledgement of receipt (within seven days) and provision of feedback (withing three months) to the whistleblower - again, a critical principle of any whistleblowing policy to instill trust and confidence in the institutions governance.
Extending protection to third parties – Again, complementing the EU Directive, extending protection is encouraged to persons (including owned legal entities) connected to the whistleblower - such as relatives - as well as in certain circumstances ‘facilitators’ of the report or subsequent investigation (such as witnesses or colleagues.)
Consider anonymous reporting – The ICC Guidelines leaves it up to organisations whether whistleblowers are able to report anonymously, which may be dependent on the laws of the countries in which the whistleblowing management system will operate, as well as the organisation’s corporate governance.
Other ICC 2022 Guideline provisions:
- Designated impartial persons to receive and handle reports
- Development of capacity for facilitating confidential reporting with trust and confidence
- Periodic review of the effectiveness of the arrangements
- Communication of positive outcomes of concerns raised
- Specialised management training
2021 – a landmark year for the development of institutional standards
In addition to the launch of the ISO 37002, last year the Organisation for Economic Co-operation and Development (OECD) published its revised 2021 Recommendation on Anti-Bribery.
The Recommendation was updated to reflect the evolution and advances in the field of anti-corruption and includes updated Good Practice Guidance on Internal Controls. The annexed guidance also encourages improved institutional safeguards which aim to ensure that whistleblowers do not suffer retaliation in the private sector.
Read more: The 2021 OECD Recommendation on Anti-Bribery
The ‘business case’ for whistleblower protection
These new instruments acknowledge the risk of harm in not addressing reports of wrongdoing, as well as the negative impact it may have on shareholder value. Communicating the benefits of implementing a robust whistleblowing system has been a challenge in a context in which leaders feel the disclosure of business information presents an unacceptable risk. Accumulating evidence that whistleblowing is in fact ‘good for business’ has been useful to support advocacy for strengthened institutional standards, which are an essential mechanism underpinning any legal framework, with employers positioned as potential gatekeepers of public interest information.
Firstly, a global study from the Association of Certified Fraud Examiners found that a whopping 43% of all cases of occupational fraud were uncovered through tips-offs. A stark comparison with just 15% uncovered through internal audit and 12% from management review.***
Secondly, a growing body of research confirms that any costs incurred when establishing a whistleblowing system are outweighed by protection of reputation and other financial savings, not least notable reductions in litigation and settlement costs.
Finally, and reflecting the standards above, Principles for Responsible Investment (PRI) last year published a Report placing institutional whistleblowing protection within the environmental, social and governance (ESG) framework. The Report provides guidance on how investors can assess and engage with companies and use their influence to improve outcomes around corporate whistleblowing practices, providing a framework of focus areas and best practice examples.
Read more: PRI Report: What and how to engage with your investee companies
Interestingly, shortly after the publication of the PRI Report on whistleblowing, shareholders at Alphabet began pushing for Google to review its whistleblower policies.
Read more: Institutional Investors Are Pressuring Boards to Focus on whistleblower Protections. Could that spur a change at Google.
The role of civil society
Several members of WIN work with employers to improve whistleblower protections in the workplace. Oživení in the Czech Republic, Integrity at Work in Ireland and Protect in the UK, who have also developed a Whistleblowing Benchmark Tool for organisations to assess the effectiveness of whistleblowing arrangements.
Unions are also increasingly engaged on the topic. Eurocadres – the European confederation of professional and managerial staff have published a number of tools and guides on internal whistleblowing channels available in several languages.
WIN contributed to the development of the ISO 37002 through participating in the working group established to produce the guidelines and canvassed our membership who work with whistleblowers and with employers on whistleblowing to suggest amendments during the drafting process. Many of the recommendations of experts across the network, as well as Transparency International and other civil society voices, were accepted and significantly improved the final version available today.
WIN is pleased to see the emerging international best practice consensus on whistleblowing protection being reflected in an increasing number of standards on employers. Whilst these guidelines may be not binding, they add to a growing body of persuasive levers to encourage employers, in particular the corporate sector, to take their responsibilities vis á vis whistleblowers seriously. However, whilst there is some cause for cautious optimism, it is critical that these recommendations do not allow or encourage a ‘tick-box’ approach which could backfire, undermine speak up culture, and thus inadvertently suppress or disincentivize public interest disclosures.
Effective whistleblower protection at the national and institutional level are essential to the right to freedom of expression, the public’s right to know, as well as necessary for ensuring democratic accountability.
ANALYSIS NOTES
* Wide scope of what reports should be protected - The agreed broad scope of these instruments, which have been developed in agreement with employer associations and businesses, must be noted by policy makers across Europe - who are currently contending with the mandatory transposition of the EU Directive on whistleblowing.
In particular, the business lobby and conservative politicians who have been pushing for a minimal verbatim implementation of the Directive resulting in a hybrid system of protection (which would promote the disclosure of breaches of Union law over national law and do not protect reports of unethical or harmful conduct which is not technically illegal) should consider the conflict of their approach with this growing body of additional standards with which employers may also need to comply.
Experts have long highlighted the risks of a hybrid or vertical system which would undermine legal certainty for whistleblowers deciding whether or not to speak up, and create operational difficulties for those nominated to triage and investigate reports.
** Not restricting protection to designated channels - Policy makers must take note of this approach which is also reflected in the ISO 37002. Empirical studies repeatedly show that the vast majority of wrongdoing is reported internally to the employer and that most staff will rightly report any risks of harm come across the workplace to their supervisors or line management.
Restricting protection to reporting through designated channels, seen as a possible approach by some law makers currently transposing the EU Directive, not only undermines the role of line management but will also create institutional bottle-necks which undermine the administration of justice and impede speak-up culture.
*** The ‘business case’ for whistleblower protection - Valuable research and academic studies providing empirical evidence on workplace whistleblower protections has been conducted in recent years.
The largest ever academic study undertaken - Clean as a whistle: a five step guide to better whistleblowing policy and practice by Griffith University - demonstrates the power of academic engagement in supporting public policy reforms. The research report provides best practices principles for whistleblowing procedures, and importantly, effective welfare management of employees at risk of victimisation. In the context of ground-breaking national whistleblowing legislation passing in Australia, the study outlined key actions to advance policy reforms both in government and the private sector backed up with impressive qualitative data and analysis, which are relevant to the strengthening of whistleblowing protection around the world.