Whistleblowing – a real danger?

Beyond the „Hall of Fame”: Whistleblowing in Small and Medium-sized Enterprises

Whilst „star whistleblowers“ such as Edward Snowden or Chelsea Manning caused a worldwide stir with their revelations regarding the NSA and the US Army respectively, there are a number of cases that only reach the public eye to a limited extent. The aforementioned institutions paint a picture of the significance of the whistleblowing phenomenon, albeit a distorted one. Apart from the Wuhan hospital, these are large organisations, all with at least 20,000 employees.

However, the idea that the risk of whistleblowing is limited to such giants is a fallacy. Cases also occur beyond this whistleblowing „hall of fame“, namely in medium-sized companies and to a corresponding extent. According to a survey, almost 28 percent of German companies with 20 to 249 employees experienced at least one instance of illegal or unethical behaviour in 2019, meaning some experienced it more than once.

What is Whistleblowing? A Working Definition

• A whistleblower is therefore, firstly, a member of the organisation in question,

• Secondly, he possesses incriminating information about illegal or unethical activities.

• And thirdly, he discloses these to individuals in order to rectify the malpractice.

Have you noticed anything? Possibly the first criterion. As practice shows that whistleblowing is also carried out by individuals outside the organisation, this has been extended accordingly in academic discourse, so that customers and suppliers can also be whistleblowers (Maume Haffke*). Furthermore, a distinction is made between passing on information to external versus internal in which the former is often regarded as the only true form of whistleblowing, with the argument that the process when disclosed internally is fundamentally incomparable (Farrell and Petersen in Near, Miceli²).

Are there indicators for whistleblowing?

No. That is precisely what makes the phenomenon so elusive. And this is not least reflected in the breadth of incidents. Attempts to narrow it down to specific company sizes, economic sectors or company divisions fail. Although it is primarily large companies and corporations where whistleblowing cases develop the dynamic and societal relevance to break through into the public.

As highlighted, however, misconduct also occurs in German SMEs. If the threshold were raised to 500 employees, the number of affected companies would likely grow. After all, in 2018, a good 40 percent of companies above this threshold experienced one or more instances of misconduct.

The situation is similar with regard to the division into sectors. Although European and German case law has identified particularly vulnerable areas and, in places, introduced obligations to implement reporting systems, such as for financial services companies. However, it is obvious that offences such as sexual harassment or bullying are not confined to any particular sector.

For grievances can occur in all sorts of forms. From health and environmental hazards, to corruption, to data manipulation or money laundering: everything has Can happen and everything happens, as experience shows. Business areas like finance and accounting may be primarily associated with such risks, but they are at most as vulnerable as other areas. Therefore: Malfunctions cannot be ruled out or concentrated anywhere.

For further information on how to handle whistleblowers in an emergency, please also read our article „Powerless against whistleblowers?“.

Grievances can lead to scandals.

The scandals surrounding Cambridge Analytica, the NSA and co. have shown one thing without a doubt: the explosive power of whistleblowing is immense. For some, like Cambridge Analytica, to Significant. Within two months of the dubious business practices coming to light, the company filed for insolvency in May 2018. Whether unsubstantiated or not, the exposure of misconduct quickly throws companies off their usual orbit. The various stages of escalation can be illustrated along the following cascade.

Best Case

In a perfect world, management would succeed in preventing misconduct at its inception through preventative measures and clear signals. Although this is, as described, hardly possible, most SMEs (92 percent) rely on such „management signals“ as a means of prevention. The Code of Conduct follows far behind (67 percent).

How is damage caused to the company?

All cases that fall between the mid and worst-case scenarios pose a risk to the company. But how can this risk be translated into the business context of SMEs? The following differentiation is helpful in answering this question:

Financial damages

Firstly, whistleblowing cases cause quantifiable financial damage. Losses are incurred on both the cost and revenue sides.

A tip-off can cause internal investigation effort, but it neither has to confirm a legal violation nor lead to a fine. Whether sanctions arise and whom they affect depends on the established facts and the applicable regulations in each case. The dimensions of such payments vary. Reaching a record high in 2009 was the Pharmaceutical company Pfizer, which ended up costing him dearly due to the illegal marketing of the painkiller Bextra. The company paid a fine of 2.3 billion US dollars. However, small and medium-sized companies in this country are not immune to fines either. While these are on a different scale, their financial cushion is weaker. Pfizer achieved revenues of over 50 billion US dollars in the year of the fine – meaning the fine payment was less than five percent of the annual revenue. For comparison: in 2009, the company generated almost five times as much from the bestseller active ingredient Lipitor (11.4 billion US dollars)³.

SMEs, on the other hand, generally do not possess diversified portfolios capable of easily absorbing the impact of scandals in a single business segment. In such cases, a fine can quickly pose an existential threat. Experience shows that whistleblowing cases can result in substantial financial penalties for small and medium-sized enterprises as well. In the Bottrop pharmacist scandal—which came to light through whistleblowing—the total damages amounted to 17 million euros, a sum to be borne by the pharmacist, who has since been convicted. He is also liable for the full amount of the legal costs. Overall, just over 30 percent of German SMEs reported suffering financial losses exceeding 10,000 euros due to corporate misconduct in 2019, with ten percent reporting losses of more than 100,000 euros.

The damages to the company are multifaceted and often not precisely foreseeable from the first day. Financial damages form the basis for an initial assessment. Beyond this, however, damages on the revenue side are also significant, and the losses from customer or sales channel attrition must also be factored in. Therefore, to assess the full extent of the damage, a holistic view of the damage along the company's entire value chain is required.

Non-financial damages

In contrast, there are damages that cannot be quantified. Firstly, these are damages to the company's external perception. Loss of image is particularly painful for SMEs with reputations built over generations. Restructuring or realigning to new business areas can be so financially resource-intensive that they are unaffordable for SMEs. Businesses with small product lines and customer bases, in particular, are limited in their ability to compensate for image damage.

A company like Pfizer, on the other hand, can relatively quickly restore its clean image by divesting the affected segment. Consider an example based on the recent whistleblower video from the Tönnies canteen: If such material were to surface regarding a much smaller business outside of the coronavirus era, that company would likely struggle to escape the line of fire of public outrage.

The becoming known of a wrongdoing can strain the working atmosphere. However, the cause is not automatically the reporting person, but regularly the underlying facts and the company's handling of the report. Stigmatising communication can also increase the risk of prohibited reprisals . Contrary to how it is perceived from the outside, minor missteps in internal communication are enough here to spread the matter among the workforce. Given the working atmosphere, which typically relies on trust and short communication channels, this can be particularly painful and become a stress test for employee integrity. Restructuring, changes of position or relocations, which might be considered to ease the atmosphere, are significantly harder to implement in SMEs with monocentric structures than in matrix-structured corporations with numerous locations.

The great danger here lies in underestimating these damages, which are not or are only difficult to quantify. Mostly these are not one-off effects, but rather deeper factors that affect the company's image, brand value, or the SME's employer branding profile. This is why German companies most often cite strengthening their image as an integrated, ethical company as the reason for introducing reporting systems.

The challenge for management teams

So where should SMEs start if they want to limit such damage? To put it simply, the following three factors can be expressed in an equation:

Total Damage = Number of Cases x Severity of Offence x Channeling of Procedure

Prevention

The first two factors aim at prevention. Recall the escalation levels mentioned. The best-case scenario (successful prevention of offences) is not only unlikely but also barely controllable. There is no direct lever for management here. Management of corporate culture and compliance can only counteract misconduct, not nip it in the bud. The NSA could have invested heavily in an improved corporate culture. However, this does not make past unfair business practices disappear from reality.

Channelling

The third factor is a lever that you can actively manage. It decides whether the grievance becomes a scandal or not. Whistleblowers can generally choose whether to contact an internal or an external reporting office. A trusted internal channel can be the preferred practical point of contact, but is legally not necessarily the first point of contact. SMEs benefit from trust-based employment relationships. Unlike in large enterprises, where the emotional attachment to the company, values, managers and colleagues tends to be lower, reporting systems in SMEs are potentially a valued vehicle for employees to appropriately draw attention to a wrongdoing.

From „nice to have“ to „need to have“

The most frequently cited reason by German companies for not having a whistleblowing system is simply the lack of a legal obligation. Whistleblower Protection Act has been in force since 2 July 2023. Private employers with generally at least 50 employees must, as a rule, set up an internal reporting office. Special regulations apply to certain sectors. However, the motto should be: „Better safe than sorry“. The earlier you operate the lever of channeling, the more effectively you can minimise the risk of damage. The effort involved in introducing a reporting system is relatively low when you weigh the aforementioned costs against the non-financial damage caused by uncovered irregularities.

According to the survey, German SMEs currently primarily use cost-effective methods: email, personal conversations, and telephone. Whistleblower systems, on the other hand, are only used by 21 percent of the companies surveyed. While emails, personal conversations, or phone calls run the risk of being dismissed in passing or getting lost in day-to-day operations, „always on“ reporting systems can be specifically integrated into a process. This signals to SMEs that they promote integrity within the company and are receptive to tips about problems. In our article „Which whistleblowing system is right for you?“, you receive an overview of the current options on the market.

Conclusion

Whistleblowing is a real danger to any company. Malpractices, even with the best preventive measures, are difficult to avoid. If there are no internal reporting mechanisms and information leaves the internal company environment, the damage is done. From this point onwards, the company is exposed to the public and can, at best, mitigate the damage. Significant financial losses can push SMEs to the brink of existence. The addition of reputational damage and a strained working atmosphere means the damage can neither be quantified nor contained in the short term. Reporting systems can help to minimise these risks. While no whistleblower system can offer one hundred percent certainty, it is certainly a step towards increased integrity.

As a next step, download our guide: "Implementing the Whistleblower Protection Act in Your Company." Or contact one of our experts for a personal consultation.

(The masculine form used refers to all people, regardless of gender.)