Why an e-mail solution is not good enough for whistleblowing

When looking to implement a whistleblowing service, it can feel tempting to use a simple, inexpensive, and fast solution such as setting up an internal e-mail address for whistleblowing reports. This could, however, be a big mistake and have serious consequences for your organisation as well as your employees. In this article, we’ll list four reasons why you should not use e-mail as your internal whistleblower reporting channel.

1. Data security and safety
2. Compliance with the whistleblower law
3. Creating a culture of trust
4. Confidentiality and anonymity

“We never receive whistleblowing cases anyway”

It is important to have a whistleblowing solution in place, even if you do not receive any reports initially, for several reasons:

1. Encouraging a culture of integrity: Having a whistleblowing solution in place shows that the organisation is committed to ethical conduct and is willing to listen to concerns raised by employees.
   
   
2. Detect wrongdoing: A whistleblowing solution can help detect wrongdoing that may not have been identified through other means. This can help to prevent damage to the organisation’s reputation or financial losses.
   
   
3. Compliance with legislation: The EU Whistleblowing Directive makes it a legal requirement for all European organisations with more than 250 employees to have internal reporting channels in place. The deadline for smaller employers is fast approaching too. Failing to implement a secure whistleblowing solution can result in legal consequences.
   
   
4. Improved risk management: A whistleblowing solution can help to identify and address potential risks within the organisation. By encouraging employees to report concerns, the organisation can proactively address potential issues before they escalate into bigger problems.

“But we have an e-mail solution for whistleblowing and it’s good enough for us”

Here are four reasons that you have to keep in mind, as to why an e-mail whistleblowing solution is not sufficient enough for whistleblower reports.

1. Data security and safety

Even though an e-mail solution for whistleblowing might be adequate from a strictly legal perspective, it’s fair to say it’s far from acceptable from a security perspective.

• E-mail is not a secure form of communication, and data in e-mails is not encrypted. Not only can e-mails be read by others, but the content in them can be changed as well.  
  
• Unauthorized parties, for example an IT department, can easily access all information. This means the integrity of the data and the confidentiality regarding the whistleblower’s identity is at risk.
  
• E-mailed documents regarding the whistleblower case are not securely stored in high-security data centers, which means GDPR compliance cannot be guaranteed.

2. Compliance with the whistleblower law and the EU Directive

It is important to keep a record of any whistleblowing activity, but this can be challenging when using e-mail, as it is easy to delete or alter messages. The EU Whistleblowing Directive also require organisations to adhere to certain time frames when handling whistleblower reports. A whistleblower system will help you to comply with the law by:

• Giving you notifications of important things, such as receiving a report or approaching deadlines for feedback to the whistleblower.
  
•  Making it easier to adhere to certain timeframes (for example, providing feedback or deletion of cases).
  
• Keeping track of all documentation regarding a whistleblower case, which makes processing the case easier and more efficient.
  
• Making it possible to export statistics.
  
• Provide safe communication with the reporting person

3. Create trust and confidence with the organisation

An e-mail solution is a poor choice for whistleblowing because it does not provide the necessary oversight to ensure that concerns are addressed. When raising a concern through e-mail, there is no guarantee that it will be seen or that appropriate action will be taken.

Gaining the trust of potential whistleblowers is vital to ensuring that relevant reports will be submitted. Employees must feel safe and be able to trust the system and how reports are managed. An outsourced whistleblower solution will:

• Increase the level of trust within the organisation
  
• Show your employees that you take whistleblowing more seriously by actually investing in a secure solution.

4. Confidentiality and anonymity

When you send an e-mail, it can be traced back to your email account, which is often linked to your name and personal information. Studies have shown that having the possibility to report misconduct confidentially or even anonymously will significantly increase the likelihood that employees will use the whistleblowing solution. An e-mail solution will:

• Make it more difficult for the whistleblower by requiring him/her to create an e-mail
  
• Always be linked to another e-mail or phone number
  
• Not make whistleblowing safer for your employees

Consider alternatives to e-mail whistleblowing solutions

Overall, using e-mail for your whistleblowing solution might feel convenient, but it’s not an ideal channel for whistleblowing due to the lack of confidentiality, insecurity of communications, limited oversight, and difficulty in documenting. It will not help you to be compliant with the whistleblower law, nor help your employees feel safe or encourage them to disclose any potential misconduct going on in your organisation.

Because of the disadvantages to e-mail based solutions, it’s worth considering implementing a digital whistleblowing system. This will provide you with safe, anonymous two-way communication with the whistleblower, help you adhere to deadlines, and make it easy to comply with legal requirements regarding data protection and data security.

A digital whistleblower system

will also instill trust amongst employees and encourage them to report irregularities without fear of retaliation. It might make them more likely to speak up internally, instead of turning to the authorities or even media.

• For more help on how to choose a whistleblower system, please read our checklist.

Would you like to discuss a safe whistleblowing solution for your organisation? Please contact us for further discussion or book a free demo of our system!