Whistleblowing channel management: who runs it and what responsibilities it carries
Having a whistleblowing channel is not just about installing a mailbox and forgetting about it. Ley 2/2023 (Spain’s whistleblower protection act) requires someone to genuinely run it: receive reports, handle them diligently, respect the deadlines and protect the whistleblower. And managing it badly is penalised just as heavily as not having one at all. In this guide we explain who should manage the whistleblowing channel, what requirements that person must meet and what responsibilities they take on day to day.
Who should manage the whistleblowing channel?
When it comes to handling reports within a company, the first thing to be clear about is who will be responsible for the process. Under Ley 2/2023, the person in charge of the channel must be appointed by the entity’s administrative or governing body and, once named, notified to the Autoridad Independiente de Protección del Informante (the Independent Whistleblower Protection Authority, or AAI).
This role is technically known as the Information System Officer (or whistleblowing channel officer). It may be a natural person or a collegiate body, and the appointment must be formalised in writing. An informal designation is not enough: if you are inspected, you will need to prove who holds the role and since when.
Requirements for the person managing the whistleblowing channel
The person responsible for handling reports must meet a series of requirements to guarantee the transparency and integrity of the entire process. These are the essential ones:
Independence
The officer must operate in an independent and autonomous manner in relation to the rest of the entity’s bodies. This is crucial to ensure that reports are handled impartially and free from outside influence.
Capability and competence
They must have the capability and competence required to run the internal information system and the reporting channels, in both technical and organisational terms.
Legal knowledge
The officer must be familiar with the regulations on whistleblower protection and the handling of reports. This ensures that every action complies with Ley 2/2023 and the RGPD (the EU General Data Protection Regulation).
Integrity
Upright, ethical conduct is a fundamental pillar. The officer must ensure the confidentiality and proper handling of the information received in order to maintain the workforce’s trust in the channel.
Independence of the role
If the officer holds a management position, they must carry out their duties independently of the administrative body. This avoids conflicts of interest and guarantees objectivity in the handling of every case.
Responsibilities of running the whistleblowing channel
Running the channel entails a series of responsibilities that ensure its effectiveness and its compliance with the law. These are the main ones:
Approving the procedure
The officer must make sure that the reporting management procedure has been approved by the entity’s administrative or governing body and that it is kept up to date.
Diligent handling
The officer must respond diligently when processing reports and ensure that the internal information system meets all legal requirements at all times.
Identifying the channels
It is the officer’s responsibility to identify the internal channels associated with reports and to guarantee that information on how to report is clear and accessible to employees, former employees, suppliers and contractors.
Acknowledgement of receipt
The officer must send an acknowledgement of receipt to the whistleblower within seven calendar days of receiving the report. This is one of the most frequently missed deadlines, and one of the easiest to demonstrate in an inspection.
Response deadline
A maximum deadline for responding to investigative actions must be set, which as a general rule should not exceed three months (extendable to six in particularly complex cases).
Communication with the whistleblower
The officer must maintain communication with the whistleblower and request additional information from them where necessary. This aids the investigation and ensures that all relevant information is gathered, while always preserving the whistleblower’s identity.
Confidentiality and data protection
All information must be handled confidentially and in line with the RGPD. Access to the case file data must be limited to those strictly necessary to investigate the matter.
How a report is handled, step by step
Once a report comes in, the process has two phases and deadlines that the law sets out expressly.
Investigation phase
The whistleblower files the report setting out the facts and, where applicable, those responsible, attaching any evidence that backs up the account. The report must be able to be filed individually and, if the person prefers, anonymously: Law 2/2023 requires that route to exist.
The report is admitted if the facts can be investigated within the material scope of the law. If a first review finds no reportable facts, it is declared inadmissible and either filed or referred to the relevant department.
The deadlines are not advisory: acknowledgement of receipt within a maximum of 7 calendar days, and a reply to the whistleblower on the actions taken within a maximum of 3 months from that acknowledgement, or from the expiry of the 7-day period if none was sent.
Once admitted, the investigation rests on an objective analysis of the documentation, gathering evidence and assessing it. The investigating team opens a case file holding all the relevant data. The investigation is confidential and complies with the GDPR and the LOPDGDD, and any team members affected by the report are excluded from it to avoid conflicts of interest.
Resolution phase
Once the investigation closes, the evidence is assessed and the report is resolved one way or the other, with a findings report recording the actions taken. That audit trail is what lets you show the AAI that the system worked as it should.
Running it in-house or outsourcing it
The law requires you to have the channel, but not to run it yourself. That part is your call:
- In-house. You appoint someone inside the company. It gives full control, but you have to train that person, guarantee their independence and carry the risk if a report is mishandled.
- Outsourced. A specialist provider supplies the encrypted portal, the reviewed internal policy and the audit trail of the case file. It is what most companies of 50 to 250 employees choose, because getting the investigation wrong is expensive.
Do not confuse this with the external channel of the Independent Whistleblower Protection Authority, which is a different thing: a public route anyone can use directly, whether or not the company has a channel. Running yours properly is precisely what reduces the chance that someone goes to the AAI first.
Managing the whistleblowing channel with LapsoWork
This is where LapsoWork comes in, the HR software that integrates the whistleblowing channel smoothly and efficiently. With its whistleblower module, employees can report incidents and concerns easily and securely, either anonymously or identified, and the officer has an intuitive interface to handle them in accordance with the law.
From the reports tab, the officer can manage every communication received: change its status, review all the case file information and hold a conversation with the whistleblower through a private chat that is recorded within the application, respecting anonymity whenever it is requested.
The officer also has a section within each report where they can upload private documentation that the whistleblower cannot access, and filter reports to quickly locate the one they need. The entire case file is tracked and available should the AAI request it.
As part of a complete HR suite, you have the whistleblowing channel integrated alongside the document manager software, time tracking and holiday management, without duplicating tools or data. And if any question arises, you have technical support so a professional can help you whenever you need it.
Conclusion
Running the whistleblowing channel well is just as important as having one: formally appointing an independent officer, respecting the 7-day deadline for the acknowledgement of receipt and the 3-month deadline to resolve the case, and guaranteeing confidentiality at every step. Meeting these points protects you from penalties and, above all, shows your workforce that reports are taken seriously.
If you want to see how a case is handled from start to finish, discover our whistleblowing channel or contract it and try it out with your own cases.