Whistleblowing channel procedure: a step-by-step guide for companies

The whistleblowing channel is now a reality that most Spanish companies have to deal with. Larger organisations put one in place some time ago, but many SMEs are still working out exactly how theirs should operate. And here is the crucial point: having a reporting inbox is not enough. What the law requires is a clear, documented and communicated procedure that governs what happens from the moment a report arrives until it is resolved. In this guide we walk you through that procedure step by step.

What is the whistleblowing channel procedure?

The whistleblowing channel procedure is the cornerstone that defines how internal reports are managed correctly within companies and public bodies, in line with the standards set by the Directiva Europea 2019/1937 (the EU Whistleblowing Directive) and its transposition into Spanish law through the Ley 2/2023, de 20 de febrero, which regulates the protection of persons who report regulatory breaches and the fight against corruption.

The legislation sets out a number of minimum requirements, but each company can adapt the procedure to its own particular circumstances: headcount, sector, compliance structure and the type of risks involved. What matters is that this procedure covers the entire life cycle of a report, from the moment it is raised to the moment it is resolved.

Bear in mind that the obligation to have an internal channel and an associated procedure applies to private-sector companies with 50 or more employees, as well as to other obliged parties regardless of their size (for example, entities within the scope of anti-money-laundering prevention, or political parties). If you are still unsure who exactly is covered, take a look at our article on the mandatory whistleblowing channel for companies.

The procedure is structured around two main phases: investigation and resolution.

Investigation phase

Submitting the report

Everything starts when the whistleblower submits their report through the channel, setting out the facts they wish to report and, where relevant, the person or people responsible. It is advisable for them to attach any document or evidence that supports their account.

Once received, the report is accepted for processing if the facts fall within the material scope of the law and can be investigated. If, after an initial review, no reportable facts are identified, the report is declared inadmissible and is either closed or referred to the relevant department within the company.

One non-negotiable principle: the report must be able to be submitted individually and, if the whistleblower prefers, anonymously. Ley 2/2023 requires companies to guarantee channels that allow anonymous reporting and to protect the whistleblower’s identity in all cases.

As for deadlines, the system must send an acknowledgement of receipt within a maximum of 7 calendar days of receiving the report, and the response to the whistleblower regarding the action taken must not exceed 3 months from that acknowledgement (or from the expiry of the 7-day period if no acknowledgement was sent).

The investigation process

Once the report has been accepted, the investigation is based on the objective analysis of the available documentation, the gathering of evidence and its assessment. The investigating team must open a case file for the report that records all the relevant information; this file provides the roadmap for conducting the investigation properly.

The investigation must be carried out confidentially and in full compliance with data protection legislation (RGPD and LOPDGDD) at all times. Any members of the team who are implicated in the report must be excluded from the investigation to avoid conflicts of interest. The investigating body gathers all the information objectively, taking action that is appropriate and proportionate to the facts.

Resolution phase

Once the investigation is complete and all the evidence has been gathered, that evidence is analysed in order to close the case. From there, the report can be resolved in one of two ways.

Report upheld

The reported facts are found to be true, and the actions supporting that decision are set out. In this case:

• The relevant disciplinary framework is applied in accordance with employment law and any other applicable legislation.
• If the conduct could constitute a criminal offence, any potential criminal liability is referred to the competent authority.
• Both the whistleblower and the person named in the report are informed of the decision.

Report not upheld

If, after investigating the facts, it is determined that no breach has occurred, the compliance body (Compliance Committee) informs both parties of the outcome and provides the reasons behind it.

Findings report

At the end of the procedure, a findings report must be drawn up setting out the relevant information and the results of the investigation. The key elements it should include are:

• Technical details of the case file.
• The facts that gave rise to the report and the people involved.
• The purpose, aim and actions carried out during the investigation.
• The conclusion and the resolution adopted.
• Proposed sanctions, if any.
• Any limitations encountered during the investigation.

This report does more than close the case: it is the documentary proof that the company has acted diligently, a decisive element should the outcome later be challenged.

Why is it important to communicate the procedure?

Proper implementation requires effective communication of the whistleblowing channel. Failing to publicise it can lead to penalties and, above all, renders the system ineffective: if employees do not know how it works, they will not use it.

You need to draw up a detailed set of rules containing all the necessary information: the complete procedure, describing each stage from the moment a report is received through to its final resolution, the facts that can be reported, and the rights of both the whistleblower and the person named in the report.

That document must be accessible to the entire workforce, whether through the company website, the intranet or other internal communication channels. It is a good idea to inform employees —preferably by email— about the disciplinary measures that may result from an outcome and the consequences of making false or bad-faith reports.

How are conflicts of interest handled?

When any of the people involved in the investigation is implicated in the report, they must be completely excluded from the procedure, both from the investigation stage and from the resolution stage, in order to safeguard the objectivity of the process.

The people excluded are required to keep the report confidential and are prohibited from accessing sensitive information, including the whistleblower’s identity or the details of the investigation.

The transparency and effectiveness of the whistleblowing channel depend largely on clear communication and the proactive management of conflicts of interest. Proper implementation fosters an environment built on ethics and transparency within the organisation.

A solution that streamlines the whole process

This entire procedure can be greatly simplified with the right whistleblowing channel software. A good system lets you speed up and automate the various stages of the process, from receiving reports through to drafting the findings report, and makes it easier to manage and track each case while guaranteeing confidentiality and the protection of the whistleblower’s data.

At LapsoWork we offer an intuitive, easy-to-use whistleblowing channel with deadline management, full case-file traceability and access control, integrated with the rest of our people-management tools. That way you comply with Ley 2/2023 with full assurance and without spending hours on manual admin.