<\/p>\n
In this webinar, Sawaryn & Partners discusses how to design a whistleblowing system that works in a technology or services company, from who is covered and operational readiness to the rules for assessing reports made in good faith.<\/p>\n
The webinar focuses on three areas that generate the most mistakes in organizations moving from startup to scale-up. Below are concrete rules and recommendations you can put in place right away.<\/p>\n
Most companies design their internal reporting rules only with employees in mind. In a typical technology company, however, half the team works on B2B contracts, civil-law contracts, or as subcontractors on IT projects.<\/p>\n
The Whistleblower Protection Act is not limited to employment relationships. A B2B collaborator, a subcontractor handling an integration, an intern, or even a client may be a whistleblower.<\/p>\n
\u201cIn practice, a whistleblower can be any of us: an employee at any level, a client, a supplier, or even an external observer.\u201d
\nPresenter, webinar \u201cA Guide to Whistleblowers\u201d<\/p><\/blockquote>\nA practical scenario: a subcontractor notices that one of your employees is copying client data to an external server. The subcontractor wants to report it, but your procedure does not cover them. There is no channel and no guarantee of confidentiality. The result? They either stay silent, go to the regulator, or go to the media.<\/p>\n
What to check:<\/strong><\/p>\n
\n
- Does your internal reporting policy cover people working with you under civil-law and B2B contracts?<\/li>\n
- Do your subcontractor agreements refer to your reporting channel and set out confidentiality rules?<\/li>\n
- Can external partners, such as integrators, suppliers, and freelancers, access the reporting channel?<\/li>\n<\/ul>\n
If you run a software house, SaaS platform, or marketplace, this gap affects you directly. An employment law firm that understands IT collaboration models can help design a procedure covering your entire actual team.<\/p>\n
Operational readiness: from a policy to a working process<\/h3>\n
Monday, 9:00 a.m. A whistleblower report arrives in the inbox. The clock starts ticking. The Act gives you 7 days to acknowledge receipt. But from a business perspective, the first hours determine whether the situation is contained or escalates.<\/p>\n
A problem we see regularly: the documentation exists, but nobody has tested it in practice. No appointed person to receive reports. No escalation path. No rules for assessing credibility.<\/p>\n
What should happen immediately after a report is received:<\/strong><\/p>\n
\n
- The person appointed to handle reports acknowledges receipt and secures the report.<\/li>\n
- An initial assessment determines whether the report concerns a breach of law or an internal conflict. This determines the next steps.<\/li>\n
- A decision is made on escalation: does the matter require the board\u2019s immediate involvement, or can it be handled by compliance or HR?<\/li>\n
- Evidence is secured if the report concerns, for example, a data leak or an IP infringement.<\/li>\n<\/ul>\n
Prepare a one-page A4 checklist with specific questions, escalation thresholds, and contact details for decision-makers. That is the difference between a controlled response and chaos.<\/p>\n
Additional checks to carry out this week:<\/strong><\/p>\n
\n
- Ask three randomly selected team members whether they know where and how to submit a report.<\/li>\n
- Check that the appointed person actually performs this role and has the tools to do it.<\/li>\n
- Make sure there is a register of reports and actions taken, even if no report has been received yet.<\/li>\n<\/ul>\n
A policy on a shared drive, in a folder called \u201cCompliance 2024,\u201d last opened when it was implemented, does not protect the board. On the contrary, it shows that the company knew about the duty and ignored it.<\/p>\n
Good faith and protection against retaliation<\/h3>\n
The CEO of a SaaS company receives a report from a developer: \u201cThe team lead forces the team to work weekends and threatens to terminate them.\u201d The board\u2019s first reaction is: \u201cThis is revenge for the last annual review.\u201d<\/p>\n
The problem is that the reporter\u2019s motive is not the only criterion. The law protects a whistleblower who acted in good faith, meaning they had reasonable grounds to believe the information was true, even if there was a personal conflict in the background.<\/p>\n
\u201cA whistleblower\u2019s actions are motivated by concern for the common good, not personal gain or a desire for revenge.\u201d
\nPresenter, webinar \u201cA Guide to Whistleblowers\u201d<\/p><\/blockquote>\nYou cannot reject a report just because you \u201csee an ulterior motive.\u201d You have to investigate it. To distinguish a genuine breach from instrumental use of the procedure, you need two things:<\/p>\n
\n
- A definition of good faith<\/strong> in your internal procedure. Not a vague one, but one with examples of conduct that does and does not meet this condition.<\/li>\n
- Clear sanctions<\/strong> for knowingly filing false reports. Without them, your team does not know where protection ends and abuse begins.<\/li>\n<\/ul>\n
Whistleblower protection is not limited to a ban on dismissal. It also includes:<\/p>\n
\n
- No exclusion from promotion.<\/li>\n
- No unjustified changes to working conditions.<\/li>\n
- No transfer or removal from duties.<\/li>\n
- No unequal treatment resulting from the report.<\/li>\n<\/ul>\n
Changing a project, removing repository access, or excluding someone from daily stand-ups after a report are retaliatory actions under the Act. The company is responsible, not the direct manager.<\/p>\n
That is why training managers protects the organization against risks created by everyday operational decisions. A manager must know what they absolutely must not do to someone who has made a report.<\/p>\n
\nHow to put these takeaways into practice<\/h2>\n
Below is an action plan, ordered from the most urgent steps to system-level measures. If your company has more than 50 people, including B2B contractors and subcontractors, every point applies to you.<\/p>\n
Step 1: Audit who your procedure covers<\/h3>\n
Check who is covered by your procedure. If it refers only to \u201cemployees,\u201d extend it to B2B collaborators, subcontractors, interns, and suppliers. Update agreements with contractors to refer to the reporting channel and confidentiality rules.<\/p>\n
Step 2: Appoint a responsible person and describe the escalation path<\/h3>\n
Do not assign this simply to \u201cHR.\u201d Name a specific person with authority to receive reports and initiate an internal audit. Define when a matter remains at the operational level and when it goes to the board. Write this on a one-page A4 checklist.<\/p>\n
Step 3: Decide whether to accept anonymous reports<\/h3>\n
If you allow anonymous reports, you need IT tools that enable two-way communication with the whistleblower without revealing their identity. Otherwise, you cannot ask follow-up questions or conduct an investigation.<\/p>\n
Step 4: Put a definition of good faith and sanctions in the procedure<\/h3>\n
Use examples of conduct, not a generic reference to the Act. Your team must know what is protected and what amounts to abuse of the system.<\/p>\n
Step 5: Train managers<\/h3>\n
Managers make daily operational decisions, such as changing a project, access to tools, and performance reviews, that may be classified as retaliation. Training is not a formality. It protects the company from claims.<\/p>\n
Step 6: Test the process<\/h3>\n
Submit a test report and see what happens. How long does it take to acknowledge receipt? Who decides whether to escalate? Is evidence secured? A test will show where the procedure diverges from practice.<\/p>\n
Step 7: Integrate procedures<\/h3>\n
If you operate in a regulated industry, such as fintech, e-commerce, or SaaS involving personal data, check that your whistleblowing, GDPR, and AML procedures do not create three parallel, disconnected systems. A single report may concern both a personal-data breach and suspected misconduct. Instead of another policy, build one incident-response process with branches: one shared channel, one coordinating person, and clear criteria for classification.<\/p>\n
\nSummary: the whistleblowing system as part of a company\u2019s legal support<\/h2>\n
A whistleblowing procedure is not a box to tick. It is a tool that restores the flow of information to management about real problems in the organization. In a company of 20 people, everyone knows what is happening. At 120, management is the last to find out unless there is a working early-warning system.<\/p>\n
For fast-growing technology and services companies that combine different forms of collaboration, including employment contracts, B2B, and other contracts, and operate in a regulated environment, a whistleblowing system calls for an approach that brings employment law, data protection, and company legal support together in one coherent process.<\/p>\n
If you have a procedure that nobody has tested in practice, or your policy covers only half of your actual team, it is worth putting things in order before a real report arrives.<\/p>\n