The EU Whistleblower Protection Directive requires organisations with 50 or more workers to provide internal reporting channels, acknowledge reports within seven days and give feedback within three months. Compliance with those requirements is the floor, not the goal.
A channel that nobody uses is a warning sign. Low report volumes rarely mean there is nothing to report.
What builds trust
- Independence: reports are handled by people without a conflict of interest.
- Confidentiality: identities are protected, and people know how.
- No retaliation: visible consequences when retaliation occurs.
- Feedback: reporters hear what happened, within the limits of confidentiality.
- Learning: themes from reports reach management and the board.
Measure trust directly: survey awareness and confidence in the channel, and track how many reports come from named versus anonymous sources over time.
