Whistleblowing procedure: what it must contain and how to write it

Setting up a whistleblowing channel is not just about choosing a platform. You need a document that explains to everyone how it works: the procedure. It is the point of reference for those who want to report, for those who handle reports and for those who must check that the system complies with the EU Directive and, in Italy, Legislative Decree 24/2023.

In this guide we look at what the procedure is for, which contents it must include, how to communicate it to trade unions, which mistakes to avoid and a sample table of contents to start from. For an overview of the law, read what whistleblowing is and what Legislative Decree 24/2023 requires.

What the procedure is for

The whistleblowing procedure has three main functions:

• Inform: it tells employees and contractors that the channel exists, who can use it and how.
• Organise: it establishes who receives reports, what they must do and within what timeframes.
• Demonstrate: it documents that the organisation has adopted rules consistent with the law. In Italy, a non-compliant procedure is one of the situations ANAC can penalise.

A clear procedure reduces the doubts of those who need to report and makes the work of the channel manager easier, because they know exactly which steps to follow.

Minimum contents

Scope and persons covered

The procedure must state who can submit a report and which types of breach fall within the channel. It helps to use plain language, with examples that people without legal training can understand.

Channel manager

It must state who handles reports: an internal person or office, or an external party, in any case independent and trained. To find out more, read who can be the whistleblowing channel manager.

Reporting channels and methods

The procedure describes the ways in which reports can be made:

• written, for example through an online platform;
• oral;
• in-person meeting with the manager, at the whistleblower's request.

Handling timeframes

The EU Directive and, in Italy, Legislative Decree 24/2023 (art. 5) require acknowledgement of receipt within 7 days and feedback within 3 months. The procedure must state them and explain who is responsible.

Protections and ban on retaliation

Whistleblowers must know that their identity is protected and that retaliation against them is prohibited. This part is essential: without trust in the protections, the channel risks going unused.

Data processing and retention

The procedure must explain how personal data is processed and how long it is kept: in Italy, no more than 5 years from the final outcome of the report. Alongside the procedure, a privacy notice for the whistleblower is required.

Training

It is advisable to provide training for those who manage the channel and information for employees, so that everyone knows how the system works.

Publication and information for employees

The procedure must be easily accessible: for example on the intranet, on company noticeboards or on the website. State in the document where it is published and how new hires are informed.

Procedure checklist

Before approving the procedure, check that you can answer yes to all these questions:

• Does it state who can report and which breaches can be reported?
• Is the channel manager, internal or external, appointed?
• Are the reporting methods described: written, oral and in-person meetings?
• Are the timeframes stated: acknowledgement within 7 days and feedback within 3 months?
• Are the protections for the whistleblower and the ban on retaliation explained?
• Is it clear how data is processed and that it is kept for no more than 5 years from the final outcome?
• Is training provided for those who manage the channel and for employees?
• Does it state where the procedure is published and how employees are informed?

Notifying trade unions

Under art. 4 of Italian Legislative Decree 24/2023, the internal channel is set up after informing the trade union representatives or organisations. In practice it is advisable to:

1. prepare the final version of the procedure;
2. send it to the trade union representatives or organisations with a short cover letter;
3. keep a record of the communication;
4. activate the channel and publish the procedure.

How this communication is carried out may vary from company to company: in doubtful cases, consult your adviser. In other EU countries, check the national rules on consulting employee representatives.

Common mistakes

• Copying a generic procedure without adapting it to the real organisation.
• Not naming the manager, or naming one without independence or training.
• Forgetting the timeframes of 7 days and 3 months, or not saying who must meet them.
• Neglecting privacy, for example by not stating retention periods.
• Not publishing the procedure, leaving it in an archive nobody consults.
• Not updating it when the manager, tools or organisation change.

Sample table of contents

A possible structure, to adapt to your organisation with the support of a professional:

1. Purpose and legal references
2. Scope and persons who can report
3. Subject of reports
4. Channel manager
5. Reporting channels and methods
6. Handling the report: acknowledgement, verification, feedback
7. Whistleblower protections and ban on retaliation
8. Data processing and retention
9. Training and information
10. Publication and updating of the procedure

Ready-made templates with Whisper

Whisper whistleblowing software includes a whistleblowing procedure template and a privacy notice template for the whistleblower, ready to customise. If you are assessing different platforms, read how to choose whistleblowing software.

How to write it in practice

1. Involve the right people: management, HR, whoever handles privacy and the future channel manager, as well as your legal adviser.
2. Start from the real organisation: describe who does what in your company, not in an ideal one.
3. Write simply: anyone reading the procedure should understand in a few minutes how to report and what to expect.
4. Align procedure and tool: the methods described must match those actually available on the platform.
5. Plan periodic reviews: state who updates the document and when.

Two useful terms

Acknowledgement of receipt: the confirmation sent to the whistleblower that the report has arrived, within 7 days. Feedback: the communication to the whistleblower on the outcome or status of the report, within 3 months.

F.A.Q. - Frequently asked questions

General information only, not legal advice: check your situation with a professional and consult the latest ANAC Guidelines.