Whistleblower Investigations Explained: From Report to Resolution

Whistleblowers are one of the most valuable sources of information an organisation has. Yet many companies still treat a report as an inconvenience — or, worse, try to identify the person who made it. That approach is now not only short-sighted but, in the EU, potentially unlawful.

The EU Whistleblowing Directive (2019/1937) requires many private-sector organisations — generally those with 50 or more employees — to operate internal reporting channels, to acknowledge reports within seven days, to provide feedback within three months, and to protect reporters from retaliation. In Romania, the Directive was transposed by Law no. 361/2022 on the protection of whistleblowers in the public interest. Always check the precise obligations that apply to your organisation with legal counsel.

Compliance with the law is the minimum. The real goal is a process people trust and that reliably gets to the truth.

1. Intake and acknowledgement

Every report should be logged in a secure, access-restricted register with a unique reference, the date received and the channel used. Acknowledge receipt promptly. If the report is anonymous, use the channel’s mechanism to communicate back — anonymous reporters often hold crucial details.

2. Triage

Within days, a small, independent triage group decides:

• Is this within the scope of the policy (e.g. fraud, corruption, safety, data protection), or is it an HR grievance better handled elsewhere?
• How serious and credible is it on its face?
• Is there a risk of evidence being destroyed or of ongoing harm?
• Who must not be involved because of a conflict of interest?

Triage decides the route: a full investigation, a limited fact-finding review, a referral, or closure with reasons documented.

3. Protect confidentiality — and the reporter

The reporter’s identity must be known only to those who strictly need it. Watch for indirect identification: a detail in the allegation may reveal who made it. Brief managers on the prohibition of retaliation, and monitor the reporter’s situation (assessments, assignments, dismissal decisions) during and after the case.

4. Plan the investigation

Write a short investigation plan before collecting anything: allegations to test, hypotheses, sources of evidence, people to interview, legal constraints (labour law, data protection, privilege) and timeline. Preserve evidence early — emails, system logs, documents, devices — following a documented chain of custody.

5. Gather and analyse evidence

Start with documents and data, then interview. Typical work includes reviewing transactions and approvals, analysing emails and access logs, and reconciling what people say against what records show. Keep an open mind: the purpose is to establish facts, not to confirm the allegation.

6. Interview fairly

Interview witnesses first and the subject of the allegation last, once you understand the evidence. Explain the purpose, keep questions open and non-leading, allow the person to respond to the key evidence, and document the interview accurately. Fairness to the subject is both an ethical duty and what makes conclusions defensible.

7. Conclude and report

The report should state each allegation, the evidence considered, the findings (substantiated, not substantiated, or inconclusive) and the reasoning. Separate facts from opinions. Recommend actions: disciplinary, legal, recovery of losses and — crucially — control improvements to prevent recurrence.

8. Feedback and lessons learned

Give the reporter feedback within the required timeframe, within the limits of confidentiality and the rights of others. Then close the loop internally: trends in reports are a powerful indicator of where your culture and controls need attention.

Common pitfalls

• Letting the manager of the accused handle the case.
• Starting interviews before preserving evidence.
• Losing track of deadlines for acknowledgement and feedback.
• Treating the case as closed without fixing the underlying control gap.

A credible process protects everyone: the reporter, the person accused, management and the organisation. If you need an independent investigator, or want to train the team that runs your channel, see our forensic investigations service and the Whistleblower Investigations course.