Conducting whistleblowing investigations amid increasing regulatory and press scrutiny

September 2024 | EXPERT BRIEFING | FRAUD & CORRUPTION

financierworldwide.com

Whistleblowing has increased significantly – both within organisations and to authorities. This rise is encouraging as it indicates that employees are becoming comfortable voicing their concerns, and it leads to issues being identified and investigated. However, the increase in whistleblowing reports also poses a challenge for organisations in ensuring that they are handling these reports effectively, while maintaining an environment that supports speaking up.

In tandem with the increase in whistleblowing, organisations are navigating changes in the investigations and enforcement landscape. These developments include the EU’s Whistleblower Directive being transposed into member state law. This has brought about complications due to different interpretations by member states of the directive’s requirements. Further developments include several jurisdictions introducing or considering financial incentives for whistleblowers, which is a longstanding practice in the US, and calls for more rigorous review by authorities and governments into how whistleblower complaints are managed.

These changes highlight the importance of having well-defined processes to address the handling of speak-up claims in accordance with applicable laws. This is especially important given the heightened attention from the media and authorities on how investigations are conducted.

This article examines developments in the whistleblowing regimes in the UK, US and EU, and considers the wider challenges organisations encounter during speak-up investigations. It also offers practical steps organisations can take to effectively manage and respond to speak-up allegations.

Authorities in the UK are updating their approach toward whistleblowers. Currently, only two systems in the UK financially incentivise whistleblowers. These are the Competition and Markets Authority’s system in which whistleblowers are compensated for providing information about unlawful cartel activity, and HM Revenue and Customs compensating whistleblowers for providing evidence on tax fraud.

In February 2024, Nick Ephgrave, the new director of the Serious Fraud Office (SFO), suggested financially incentivising whistleblowers for their information would speed up cases. His rationale was that cases might be concluded more quickly where financially incentivised whistleblowers can provide ‘smoking gun’ evidence.

In parallel, in late 2023, the Financial Conduct Authority also promised enhancements to its own whistleblower procedures. After Mr Ephgrave’s remarks, it has said that it intends to work with the SFO on developing financial incentive plans for whistleblowers.

In March 2023, the UK government initiated an assessment of its whistleblowing policies. This review, conducted by the Department for Business and Trade (DBT), is focused on evaluating how well the current framework supports employees in exposing wrongdoing, safeguards them from retaliation and job loss, and fosters a broader cultural shift.

In January 2024, a private members’ bill was proposed in the House of Commons. The bill aimed to create an Office of the Whistleblower that would oversee and enforce standards for managing and investigating whistleblowing cases, as well as handle whistleblower complaints.

As with any private members bill, its prospects of success depend in large part on the level of government support. It remains to be seen whether the new Labour majority in the House of Commons will give it the required support. Although the Labour Party has pledged to enhance protection for whistleblowers, including by enhancing protections for women who report sexual harassment at work, no further details have been given. Nevertheless, the bill and the DBT review show an intention to increase oversight of how organisations deal with complaints.

In the US, it is becoming increasingly common to offer financial incentives to whistleblowers. In March 2024, the Department of Justice (DOJ) introduced a pilot programme designed to provide financial rewards to individuals aiding in the investigation of corporate wrongdoing.

The DOJ has looked beyond just monetary compensation for whistleblowers. In April 2024, the DOJ’s Criminal Division rolled out the Pilot Program on Voluntary Self-Disclosure for Individuals (VSD), which offers immunity and non-prosecution agreements (NPAs) to those who come forward voluntarily with information relating to certain activities, such as financial, healthcare and white-collar crimes. While prosecutors have long utilised immunity and NPAs as part of their toolkit, the VSD programme aims to encourage personal accountability and transparency by offering greater assurances of non-prosecution, along with clearer criteria for who is entitled to relief.

The 2019 EU Whistleblower Directive aimed to standardise whistleblower protections across the EU. To date, 25 of the 27 member states have transposed the directive into their national legislation, with Poland and Estonia still to take steps to do so. This directive mandates that EU states provide rights to whistleblowers, and impose requirements on organisations, including setting up in-house reporting mechanisms and information on external reporting to authorities. The directive broadens protections to include current or former employees, volunteers, shareholders and those working under the supervision of contractors and suppliers.

Under the directive, businesses with at least 50 employees must set up internal reporting channels and follow-up procedures for reports. Member states are responsible for creating independent external reporting channels, but the obligation is on the companies to inform staff about how to report externally. Reporters can go straight to authorities without reporting internally, and retaliation against them is prohibited. The directive’s rollout has been slow and inconsistent, complicating efforts to standardise practices across jurisdictions. There remains a lack of uniformity across national laws, presenting challenges for multinationals trying to standardise their whistleblowing policies. For example, some countries require local reporting channels, while others allow centralised ones, and the obligation to report criminal offences varies across jurisdictions.

Consequently, adhering to whistleblower laws in one member state may not ensure adherence in another. Organisations must therefore navigate the complexity of inconsistent laws when designing their internal whistleblowing mechanisms.

Evolving practices in investigating whistleblower complaints

Four key trends are notable in dealing with speak-up reports.

First, reporters now have higher expectations. It is critical that an organisation effectively manages its speak-up investigations in order to maintain a culture that encourages reporting. Whistleblowers increasingly expect that investigations will be prompt and for there to be transparency regarding the investigation process and outcomes. Companies must therefore provide the necessary support during investigations while being aware of potential legal challenges related to data privacy and employment law (for example, data subject access requests in the UK). Addressing these concerns with sensitivity early on is essential.

Second, organisations must seek to conduct comprehensive investigations while balancing confidentiality obligations and requests for anonymity.

Third, organisations need well-defined media strategies that maintain a balance between transparency and the need to respect confidentiality, while also protecting both the company and individuals’ future interests.

Finally, organisations need to consider how best to protect themselves against any parallel or consequential litigation arising from an investigation. This includes considerations of confidentiality, privilege, thorough documentation of the investigative process and considering forensic data collection where appropriate.

Handling whistleblower reports

We recommend taking the following practical steps.

First, implement an effective whistleblowing process. A well-communicated and clear process is essential to not only meet legal requirements but also encourage individuals to report issues confidently, trusting they will be addressed effectively.

Second, examine the applicable laws concerning whistleblowing, employment and data protection. Ensure you understand the applicable regulations and necessary actions to take (as well as mistakes to avoid) regarding employment and privacy concerns. Consult with external legal counsel where necessary.

Third, develop a risk-based investigation protocol and adhere to it. This will assist with ensuring there are thorough investigative processes in place, that key decisions are documented, and employment and data privacy issues are effectively managed.

Fourth, whenever feasible, reach out to the whistleblower to ensure that their concerns are acknowledged. Doing so will encourage the whistleblower to feel comfortable in disclosing information that can help inform the investigation.

Lastly, ensure ongoing enhancement of practices. Following investigations, reflect on potential improvements with a focus on the handling, processing and management of the report; record these reflections and consider ways to refine the process accordingly.

Andrew Reeves is a partner, Emily Smith is a senior associate and Lubna Fahoum is an associate at Norton Rose Fulbright. Mr Reeves can be contacted on +44 (0)20 7444 3138 or by email: andrew.reeves@nortonrosefulbright.com. Ms Smith can be contacted on +44 (0)20 7444 2957 or by email: emily.smith@nortonrosefulbright.com. Ms Fahoum can be contacted on +44 (0)20 7444 5912 or by email: lubna.fahoum@nortonrosefulbright.com.

Andrew Reeves, Emily Smith and Lubna Fahoum

Norton Rose Fulbright