Why Most Whistleblowing Programmes Underperform
The research on whistleblowing consistently identifies three primary reasons people do not report concerns through formal channels: fear of retaliation, lack of confidence that anything will be done, and lack of anonymity. Most corporate whistleblowing programmes attempt to address the last of these by offering anonymous reporting channels — but leave the first two largely unaddressed.
Fear of retaliation is real and rational in many organisational environments. Even when formal retaliation is prohibited and disciplinary consequences for retaliatory behaviour are specified in policy, the informal mechanisms of retaliation — exclusion from key assignments, negative performance reviews, social isolation, being managed out — are much harder to detect and prevent. Employees who are aware of these informal mechanisms, or who have witnessed them applied to previous reporters, will not use formal reporting channels regardless of the anonymity guarantees provided.
Lack of confidence that anything will be done reflects a justified assessment of the historical response patterns in many organisations. When concerns are reported and no visible action is taken — either because the concern was genuinely investigated and found unsubstantiated, or because the investigation was inadequate, or because the issue was suppressed — the implicit signal to the organisation is that reporting is futile. This signal spreads quickly and persistently depresses reporting rates.
The Elements of an Effective Programme
Multiple reporting channels: Different individuals have different channel preferences. Some will use an anonymous hotline; others prefer email, face-to-face reporting to a trusted individual, or a web-based portal. Effective programmes offer multiple channels, all of which are genuinely independent of line management in the area where the concern is being raised.
Genuine independence: Reports that flow to the legal department, to HR, or to the compliance function — all of which have organisational relationships with the management structure being reported on — are structurally compromised. The most credible reporting channels route directly to the audit committee, an independent board member, or an external case management provider. Independence from the subject of the report is the single most important structural characteristic of an effective programme.
Transparent investigation and feedback: Reporters who receive no feedback after making a report — because most programmes do not provide feedback for anonymity reasons — have no way to know whether their concern was taken seriously. Effective programmes establish mechanisms for providing feedback (even to anonymous reporters, through secure reply functions) on whether a concern was received, whether it was investigated, and (where possible and appropriate) what action was taken.
Active protection from retaliation: Protection from retaliation must extend beyond formal policy to active monitoring. Organisations with effective programmes track the subsequent employment outcomes of individuals known to have made reports — promotions, performance ratings, terminations — and investigate patterns that suggest informal retaliation.
A whistleblowing programme that no one uses is not a neutral feature of the governance landscape. It is evidence that the organisation has a culture in which people do not feel safe to report concerns — and that evidence should concern any board or audit committee that is relying on tips as a fraud detection mechanism.
The Internal Audit Role
Internal audit should assess the effectiveness of the whistleblowing programme as part of its governance assurance activities. This assessment should examine the structural design of the programme, the reporting rate and trend over time, the time to resolution for reported concerns, the quality of investigations, the feedback provided to reporters, and the evidence of management action on substantiated concerns. Audit committees that receive this assessment alongside the report of reported concerns have the governance information they need to judge whether the programme is working.