The Internal Reporting Office in Your Company: Rights & Duties

1. Tasks of an internal reporting office
2. Reporting office vs. reporting channel
3. Organization of the internal reporting office
4. Procedure in case of a report
5. 5 Softwares for internal reporting offices

In every organization, there can be misconduct or violations that have the potential to harm both the company and the general public. This is where the internal whistleblowing point comes into play - an essential tool that allows employees to report such violations safely and anonymously. The internal reporting point serves as a central point where whistleblowers can express their concerns without fear of retaliation.

Especially with the entry into force of the Whistleblower Protection Act (HinSchG) in July 2023, internal reporting points have gained enormously in importance. Since then, companies with more than 50 employees have been obliged to offer such whistleblowing systems in their company. You can find out more about these obligations, the transitional regulation and a selection of suitable tools in our guide article on the Whistleblower Protection Act and our list of the best Whistleblower Protection Act software. In this article, we look at what features an internal reporting point should have and who needs to set up and manage a so-called whistleblowing system.

As always with legal topics: The information provided in this article is intended solely for general understanding of the Whistleblower Protection Act and does not constitute legal advice. For specific legal issues, you should consult a qualified lawyer.

Tasks of an internal reporting office

The HinSchG defines the tasks of the internal reporting points in order to create a regulated and secure framework for reporting misconduct within an organization. The following areas of responsibility are covered by such a reporting point in your system:

• Operation of reporting channels: According to § 16 of the law, internal reporting points should set up special channels through which employees can report misconduct. These channels should be easily accessible and secure to facilitate the reporting of concerns and keep the information confidential.

• Implementation of the reporting process: According to § 17, the reporting points are responsible for conducting the process as soon as a report is received. This includes checking the report, contacting the person who made the report for possible queries and forwarding the report to the responsible authorities. You can find out more about the exact procedure later in the text.

• Initiating follow-up measures: According to § 18 of the law, the reporting points should take appropriate follow-up measures after receiving a report. This could be the initiation of internal investigations or the reporting to external authorities, depending on the type and severity of the reported misconduct.

• Provision of information on external reporting procedures: The internal reporting points should also provide clear and easily accessible information on external reporting procedures. This includes information on how and where employees can also report misconduct outside the organization, for example to relevant bodies, institutions or other entities of the European Union.

Reporting office vs. reporting channel

The terms "reporting office" and "reporting channel" refer to two different aspects in the context of reporting misconduct or other relevant information within an organization. It is important to distinguish between these two in order to have a clear understanding of the structure and the process of information reporting.

• Reporting office: A reporting office is an organized unit or department within an organization or an external institution that is specifically set up to receive, manage and process reports. The reporting office has defined tasks and responsibilities, ranging from receiving reports, checking their contents, to initiating follow-up measures. It serves as a central point of communication between the person reporting and the organization and ensures that the reports are handled in an appropriate and legal manner. The reporting office can be operated by internal staff or by an external service provider and is responsible for protecting the person reporting and maintaining the confidentiality of the information.

• Reporting Channel: A reporting channel, on the other hand, is the specific medium or platform through which reports can be transmitted to the reporting office. Reporting channels can take various forms, such as a telephone hotline, an email address, an online form on the organization's website, or a special mobile application. The reporting channel is the interface through which individuals can report misconduct and should be designed to be easily accessible, user-friendly, and secure. A well-designed reporting channel encourages people's willingness to express concerns and establishes a secure line of communication to the reporting office. By the way: With OMR Reviews you can find the right whistleblowing softwares.

Organization of the internal reporting office

Organizing an internal reporting office is a complex undertaking that requires careful consideration and a clear strategy. The reporting office can either be managed internally by your organization or externally by specialized service providers. Both approaches have their own advantages and disadvantages.

Operation of the reporting office by your company:

Advantages:

• Control: With internal management of the reporting office, your organization maintains full control of the process. This allows for quick adaptation to internal policies and legal requirements.

• Cost: Internal management can be more cost-effective as there are no additional fees for external service providers.

• Knowledge of internal procedures: Internal staff often have a better understanding of the internal culture and the specific challenges of the organization.

Disadvantages:

• Resource-intensive: Operating an internal reporting office can be very resource-intensive, both in terms of personnel and technology.

• Possible conflict of interest: There could be a conflict of interest, especially if the reporting office is not sufficiently independent of other departments.

• Lack of expertise: There may be a lack of specialized know-how required to operate an effective and legally compliant reporting office.

Operation of the reporting office by service providers:

Advantages:

• Expertise: External service providers typically have specialized knowledge and experience in operating reporting offices and can ensure legal compliance.

• Independence: External management can provide a higher level of independence and objectivity, which increases trust in the reporting office.

• Relief of internal resources: Outsourcing the reporting office can relieve internal resources and allow the organization to focus on its core competencies.

Disadvantages:

• Cost: Hiring external service providers can be more expensive.

• Possible lack of internal context: External service providers may not have the same degree of understanding of the internal culture and dynamics of the organization.

• Communication: Communication between the organization and the external service provider can be challenging, and it may be more difficult to make quick adjustments.

Procedure in case of a report

Handling reports is a critical aspect in operating an internal reporting office and must be managed carefully and according to clearly defined processes to maintain the integrity of the reporting process and protect all parties involved. According to the HinSchG, you must proceed as follows in case of a report:

Step 1: Confirmation of receipt

As soon as a report is received at the internal reporting office, it is their duty to confirm the receipt of the report to the person who gave the hint within seven days. This represents initial communication that strengthens the trust of the whistle-blower in the process.

Step 2: Examination of the scope of application

The reporting office must then check whether the reported violation falls within the material scope of the reporting office, as defined in § 2 of the HinSchG. This ensures that the reporting office concentrates its resources on relevant and permissible reports.

Step 3: Maintaining contact

It is important that your internal reporting office stays in touch with the person giving the hint throughout the process. This creates an open communication line and allows for further information to be obtained if needed.

Step 4: Examination of the validity

The internal reporting office must check the validity of the incoming report. This includes checking the information provided and possibly obtaining further proof or confirmations.

Step 5: Request for additional information

If necessary, the reporting office can ask the person giving the hint for further information to get a clearer picture of the reported violation.

Step 6: Taking appropriate follow-up measures

Based on the information collected, the reporting office must take appropriate follow-up measures according to § 18 of the HinSchG. This could include internal investigations, the initiation of disciplinary measures, or reporting to external authorities.

Step 7: Feedback to the person giving the hint

Within three months of confirming the receipt of the report (or at the latest three months and seven days after the report was received if the receipt was not confirmed), the reporting office must provide feedback to the person giving the hint. This feedback should include the planned and already implemented follow-up measures and the reasons for them. However, it is important that this feedback does not hamper internal investigations or investigations and does not violate the rights of other affected persons.

5 Softwares for internal reporting offices

In our Whistleblowing category you will find numerous tools with which you can quickly and easily implement an internal reporting office for your company. We have already brought along five providers for you:
whistle.law

Hintbox

heyData

OneTrust

hintcatcher