Processing of leads and internal investigations
The editing process
The HinSchG sets out specific procedural steps for internal reporting offices. These include, in particular, acknowledgment of receipt no later than seven days after submission, examination of the scope of application and plausibility, contact with the person making the report, follow-up questions if necessary, appropriate follow-up measures, and feedback within the statutory period. In order not to initiate an investigation indiscriminately with every lead, it has proven effective to begin the processing with a preliminary check. Based on this preliminary check, a decision is made regarding the commencement and design of the further processing. The processing concludes with the drafting of a report and further documentation. We will address these three steps below.
Step 1: Preliminary check
During the preliminary examination, the indication of validity is investigated. The most important question is whether the indication is convincing. Company context This involves determining whether the issue has occurred within the company or could have consequences for the company (e.g., third-party liability from suppliers). If no company connection exists, the review of the report can be concluded at this point. This is then followed directly by final documentation and reporting. The informant must also be informed of this decision, even if the report is not pursued further. Read more about the requirements of the EU directive in our blog post “The EU Whistleblowing Directive: a brief summary”.
If there is a connection to a company, the following questions must be answered in the next step:
- Is all the information complete and, above all, verifiable (i.e., logical)?
- Theoretically, could the incident have happened this way?
- Is the person concerned an employee of the company?
- Is this unlawful behaviour or a breach of (internal) guidelines, or is it merely a complaint or an indication of “poor” corporate governance?
If there are already indications regarding this matter or if the person concerned is already known, the preliminary examination is considerably simplified, as this indication can then be assigned to the existing „file“. If the case is not yet known, it is taken up anew.
In a final step of the preliminary examination, it must then be clarified what type of violations are present. If it concerns unlawful or abusive conduct, it must be clarified which law exactly is being violated.
The preliminary examination must be carefully and thoroughly justified and documented.
Step 2: Decision on further processing
In the next step, the focus of the investigation and the investigative strategy will be determined. When making this decision, the protection of the whistleblower's safety and the safety of the person concerned must always be taken into account. Here, as in criminal law, the principle of Presumption of innocence and Principle of fair trial. During the internal investigation, the need-to-know principle must be strictly adhered to. The internal investigation must be documented throughout. Whether and to whom a matter is internally escalated depends on responsibility, severity, possible conflicts of interest, and the established investigation rules. The confidentiality of identities and the need-to-know principle must be maintained. If the tip concerns members of the management, the report must not be automatically forwarded to them. If data analysis is necessary, the data protection officer must be involved. Furthermore, a data protection assessment must be carried out before viewing e-mails or hard drives. If necessary, the works council must be involved when interviewing employees. Employees carrying out these interviews must receive specific training.
It is recommended to define fundamental guidelines for handling tips. This will ensure that all regulations are adhered to. Nevertheless, further processing should not be a case of simply following a template, but rather decisions should always be made on a case-by-case basis.
Step 3: Finalise editing
Finally, the results of the internal investigation, including communication with company management, must be carefully documented. The investigation and any subsequent measures taken must be documented comprehensibly and confidentially. Who receives the final report and decides on further measures depends on the internal organisational structure, the specific circumstances and any potential conflicts of interest. There is no general legal requirement to present every report to the management. After the report and decision on follow-up actions have been made, both the whistleblower and, if necessary, the employee concerned are to be inform. Care must be taken to ensure that the whistleblower is only provided with information that is strictly necessary. Naturally, data protection regulations must be observed here. As it is possible that the whistleblower may exchange information with other employees, the potential impact of the feedback on the company culture must also be considered with regard to content and wording. Documentation in accordance with the HinSchG must generally be deleted three years after the conclusion of the proceedings. Longer retention is possible insofar as it is necessary and proportionate to meet legal requirements. In addition, data protection principles and any further retention obligations must be observed.
Do's and Don'ts when processing leads
„Things to consider – the most important do's
- A quick, independent and complete review of the observation
- Take all indications seriously, as long as there are no objective reasons to the contrary.
- Always evaluate advice based on its content and, if necessary, rephrase it into an objective presentation.
- Inform the whistleblower on the progress and outcome of the investigation to an appropriate extent.
- Uphold the presumption of innocence from start to finish
- Protection of all involved persons through confidentiality and the need-to-know principle
- Protection of the whistleblower against retaliation, even if their identity becomes known
- Respectful communication with whistleblowers while maintaining necessary objectivity
„Beware of the trap!“ - The most important don'ts
- Never make decisions about the content of the notice dependent on the person.
- Do not accept the assessments, motivations, or similar of the whistleblower.
- Whistleblowers could „leak“ information. Therefore, caution is advised when sharing information in communications with the whistleblower.
If a tip-off turns out to be false, it is not necessarily due to malicious intent. It is most often simply a wrong assessment of a situation. Whistleblowers always see just one specific moment of a larger situation from a subjective viewpoint and then evaluate that single moment. If the entire context is not known, it is quite possible for a wrong assessment to occur.
In such cases, complete documentation and detailed justification of decisions are particularly important. : In cases of intentional or grossly negligent incorrect reports, the person providing the tip may be liable for compensation for any damage caused. Whether labour law or other measures are permissible and appropriate in addition must be examined on a case-by-case basis. There is no automatic obligation for the company to sanction every incorrect report or to bring about a specific compensation. However, it is not advisable to use this circumstance to make an example of the person providing the tip. This could lead to employees no longer using the whistleblowing system even for justified concerns.
If you want to learn more about the path of a tip within a digital whistleblowing system, feel free to read Part 7 “Process of a digital whistleblowing system“our whistleblowing basics series. Do you have questions about our whistleblowing system or about whistleblowing in general, contact us. You like one of our experts.
Website. Know-how page or in our Guide to implementing the Whistleblower Protection Act in your company”.
(The male form used refers to all persons, regardless of gender.)
