Whistleblowing Report Handling Checklist Template

The first task’s answers set both deadlines, decide which acknowledgement and feedback steps appear and name the reviewer who signs off the case.

• Log the case on the day the report arrives — record the receipt date, channel, regime, case reference, handler and independent reviewer; the report itself stays in the reporting channel
• Limit access to the case to the people handling it — Article 16 keeps the reporter’s identity within authorised staff unless they consent; use a case reference, never a name
• Write up oral reports and meetings accurately — record with consent or take full minutes, then let the reporter check, correct and sign them, as Article 18 requires
• EU: acknowledge receipt within seven days — reply through the channel the reporter used, including the anonymous mailbox, as Article 9(1)(b) requires
• UK and elsewhere: acknowledge promptly and explain what happens next — the UK sets no deadline, so check local law elsewhere and treat seven days as the target
• Point the reporter to information on external routes — competent authorities in the EU, prescribed persons in the UK; internal reporting is never the only option

An out-of-scope report gets a routing task. Phases 3 and 4 appear only when the report is wholly or partly in scope.

• Check the handler and reviewer have no conflict with the people named — anyone named in the report, or in the line management of the person concerned, steps aside
• Decide whether the report falls within the whistleblowing policy — EU: a breach in an Article 2 area or a national extension; UK: a section 43B category raised in the public interest
• Route out-of-scope matters to the right process — a personal grievance about pay or a manager goes to HR, and the reporter is told where it went and why
• Assess urgency and the risk of harm — danger to people, ongoing losses, destruction of evidence or a threat of retaliation set the pace for everything that follows
• Check for reporting duties outside the organisation — a personal data breach, a regulatory self-report or an insurance notification each run on their own clocks
• Preserve evidence before anyone is approached — suspend deletion of the mailboxes, logs and files involved, without alerting the person concerned

Shown only for reports in scope. The anonymous-contact task appears only when the reporter is anonymous.

• Appoint an impartial investigator — independent of the person concerned and their reporting line; bring in an external investigator for allegations against senior leaders
• Write terms of reference for the investigation — each allegation framed as a question, the evidence to gather, the people to interview and a target date
• Map what could reveal who the reporter is — dates, documents and phrasing only they would know; plan interview questions that do not point back to them
• Anonymous reports: keep contact through the channel’s secure mailbox — ask follow-up questions there, and make no attempt to identify the reporter
• Put protective measures in place — no change to the reporter’s role, pay, shifts or appraisal without review, and tell their manager only what is necessary
• Plan when and how to hear the person concerned — Article 22 protects the presumption of innocence and the right to be heard; time it so evidence is not compromised

The regime answer decides which feedback task appears. The findings answer on the last task decides whether Phase 5 appears.

• Gather documents and data against the terms of reference — log each source, keep originals intact and set aside personal data that is plainly irrelevant, as Article 17 requires
• Interview witnesses and the person concerned — agree a note of each interview, and put every allegation fairly before any conclusion is drawn
• EU: give feedback within three months of the acknowledgement — say what action is planned or taken and why, even when the investigation is still running
• UK and elsewhere: give feedback where feasible and appropriate — explain what has been done, within the limits set by confidentiality and the rights of others
• Record a finding on each allegation — substantiated, partly substantiated, not substantiated or inconclusive, with the evidence behind each

Shown only when the findings substantiate at least part of the report.

• Refer conduct findings to the disciplinary process — the investigation report is evidence for a separate, fair hearing, not a sanction in itself
• Fix the control that failed — give each root cause an action, an owner and a date, and track it to closure
• Report to regulators, auditors or the board where required — substantiated fraud or a breach of law can trigger a notification duty or a disclosure to the external auditor
• Recover losses and correct records — payments, contracts, financial statements or data affected by the wrongdoing
• Feed the lessons into policy and training — flag the affected policy for its next review and brief the teams involved

The closure approval is assigned to the independent reviewer named in Phase 1.

• Write the final case report — allegations, process, findings, actions and decisions, with the reporter identified only by case reference
• Tell the reporter the outcome — as much as confidentiality and the rights of others allow, and how to raise any retaliation they experience
• Check how the reporter has been treated since the report — compare appraisals, shifts, pay and assignments with before; in the EU the employer must justify any detriment
• Independent reviewer approves the closure — checks impartiality, the investigation and the feedback dates, then records Approved or Not approved
• Set the retention date and close the file — keep records only as long as necessary and proportionate; Germany, for example, deletes them three years after closure
• Add the case to the channel metrics — days to acknowledge and to feedback, scope, outcome and any retaliation complaint, for the periodic channel review