Content updated on May 11 2026
Many organisations believe that once they have written a code of ethics and conduct and made it accessible on their intranet, the job is done. This could not be further from the truth.
A whistleblowing policy is only as strong as the investigation process behind it. When a report comes in, whether it relates to fraud, harassment, corruption, or a safety concern — how an organisation responds matters just as much as the report itself. A poorly handled investigation can destroy the trust you have worked to build, discourage future reporting, and expose the organisation to serious legal and reputational risk.
Setting Up the Right Reporting Channels
Before a report can be made, employees need clear, accessible ways to come forward. Best practice is to offer multiple channels so that each person can use the one they feel most comfortable with:
- An anonymous digital reporting platform: the most effective channel for sensitive disclosures, as it removes the fear of retaliation and creates a documented record from the outset.
- A dedicated email address managed by a neutral party.
- A phone line, particularly useful for employees with limited digital access.
Face-to-face reporting is not recommended as a primary channel: it offers no anonymity, no audit trail, and puts both parties in a difficult position. It is equally important to ensure that all employees know these channels exist. Regular internal communications, onboarding materials, and visible displays all help maintain awareness. A reporting system no one knows about is a reporting system that will not be used.
Having a Clear Investigation Workflow
Once a report is received, a structured workflow is essential. Without one, investigations risk being inconsistent, incomplete, or legally indefensible. Your workflow should cover at minimum:
- Acknowledgement and triage
Under the EU Whistleblower Protection Directive, organisations are required to acknowledge receipt of a report within 7 days and provide feedback to the reporter within 3 months. A prompt acknowledgement reassures the whistleblower that their report has been taken seriously.
- Assigning the right investigator
The investigator must be independent from the subject of the report. In all cases, the investigator should be trained, ideally in trauma-informed practices, which help ensure that interviews do not re-traumatise the reporter or compromise the quality of information.
- Setting a timeframe
Define clear deadlines for each stage. Moving quickly limits ongoing harm, protects innocent parties sooner, and demonstrates that misconduct is taken seriously.
Collecting Evidence
Objectivity is the foundation of any credible investigation. Gather evidence from multiple sources, not just the initial report, and document everything throughout the process.
- Collect testimony from the reporter, but also gather independent evidence: documents, access logs, and communications.
- Avoid assumptions. Let the evidence lead the investigation, not the other way around.
- Maintain a clear audit trail of every step taken. This is critical both for internal accountability and in the event of external scrutiny.
Conducting Interviews
In most investigations, you will need to speak with the reporter, the subject, and any witnesses.
A few principles to keep in mind:
- Create a safe environment. Explain the purpose clearly and reassure participants about confidentiality.
- Stay neutral. Even if testimony is surprising, the investigator's role is to gather information, not to judge.
- Apply trauma-informed practices. Adapting your approach to participants who may be distressed leads to better outcomes for everyone.
- Document carefully. Take detailed notes or, where permitted, record interviews with consent.
Treating Every Report Seriously
Building a speak-up culture takes time. It can be undermined very quickly if employees feel their reports are dismissed. Even if a report turns out to be unfounded, the investigation process itself sends a message.
Following your workflow thoroughly signals that the organisation takes integrity seriously and that coming forward carries no risk of being ignored.
Concluding the Investigation
When the investigation is complete, several steps remain:
- Final report: Prepare a structured final report documenting the workflow followed, the evidence gathered, and the conclusion. Include any recommendations to prevent recurrence.
- Communicating the outcome: Inform the reporter that the investigation has concluded. Transparency at this stage reinforces trust and encourages future reporting.
- Non-retaliation follow-up: Check in with the reporter after the investigation closes. Monitoring for changes in treatment or working conditions protects the whistleblower and the organisation's legal standing.
Conclusion
Running an internal investigation effectively is not just a matter of following a checklist, it requires the right process, the right tools, and a genuine commitment to taking reports seriously at every stage.
Whispli is designed to support organisations throughout the entire investigation lifecycle: from receiving reports through secure, anonymous channels, to managing cases with structured workflows, documenting evidence, and tracking resolution times. Built-in analytics tools give compliance teams the visibility they need to identify patterns, measure performance, and continuously improve their programme.
If your current investigation process relies on spreadsheets or emails, it may be time to review how your organisation handles the moment that matters most.
%201.avif)
%201%20(2).avif)
%201%20(1).avif)
