The benefits of trust in a whistleblowing program can prove invaluable to organisations.

---

In brief:

• New whistleblowing legislation around the world is improving safeguards but attitudes toward integrity and conduct are slow to change.
• Despite enhanced protection policies, 54% of respondents who reported wrongdoing said they felt under pressure not to report.
• Trust, awareness, training and communications, and enabling technology are vital to a whistleblowing program embedded into the global compliance strategy.

Whistleblowing protection mechanisms promote integrity, accountability and ethical practices within organisations and society. They’re potent tools that empower individuals to speak up against misconduct and unethical behavior. These mechanisms also serve as crucial safeguards against corruption, fraud and other forms of wrongdoing — provided they are properly implemented and respected within an organisation.

Some of the largest misconduct cases in recent memory — defective parts and quality shortcuts at a prominent aerospace company, or the falsification of medical testing devices at a health technology startup, or massive accounting fraud at an energy company — are a result of whistleblowers who risked everything to do the right thing. Employees must be able to trust that when they see wrongdoing, they can report it without fear of retaliation and have confidence that leaders will act. Given that 43% of all fraud is uncovered through tips by whistleblowers¹ — more than three times that of the next common method (internal audit) — it’s imperative for organisations to get whistleblowing protection programs right.

But what happens when leaders themselves feel the pressure to look the other way? In the EY Global Integrity Report 2024, we surveyed 5,464 board members, senior managers, managers and employees of large organisations across 53 countries and more than a dozen industries. Our findings indicate that 64% of board members and 57% of senior managers felt under pressure not to report misconduct (versus 54% of employees). Four in 10 board members also admit that when an issue is reported, they themselves have faced retaliation, or have witnessed adverse consequences toward someone else who reported misconduct through the organisation’s whistleblowing mechanism (versus 17% of employees).

New regulations are pushing organisations to do more to support whistleblowers. In 2023, the US² and the EU³ introduced new whistleblowing legislation to improve protection mechanisms and make them mandatory for more companies. The introduction and expansion of whistleblower protection laws such as these, along with increased awareness on the importance of reporting misconduct and advancements in communication technology, have created more efficient and effective channels to report wrongdoing.

While there is some concern about dilution, particularly with President Trump’s recent executive order pausing all enforcement of the Foreign Corrupt Practices Act, there is hope that new and enhanced regulations will ultimately strengthen whistleblowing protection mechanisms.

New whistleblowing laws and regulations, several with slightly different compliance requirements, have increased scrutiny of whistleblowing processes and compliance obligations for global organisations. However, organisations that choose to embrace the compliance challenge and make an investment into an effective whistleblowing program will find that the value is clear. As the Association of Certified Fraud Examiners (ACFE) notes in its recent report,⁴ the presence of a formal reporting mechanism, such as a hotline, can reduce the median loss due to fraud, as well as the duration of the fraud by 50%.

Chapter 1: Prevailing Attitudes Hinder Whistleblower Protection Programs

Additional whistleblowing legislation helps, but integrity culture is slow to change.

New legislations in several jurisdictions around the world are improving safeguards for whistleblowers. In 2024, countries in the Americas, EU, United Kingdom (UK), the Middle East and Asia-Pacific have drafted or enacted new whistleblowing laws and regulations or enhanced existing laws. Below you can find more information of specific jurisdictions.

In countries that have strengthened whistleblower protection mechanisms, or where monetary incentives are offered, more individuals appear emboldened to step forward with knowledge of wrongdoing. In 2024, the US SEC reported that it received nearly 25,000 whistleblower tips, up from 18,354 tips in fiscal year 2023. ⁵ Further, the SEC awarded more than US$255 million to 47 whistleblowers. In the fiscal year 2024, the UK also saw a slight uptick, with 1,124 whistleblower reports to the Financial Conduct Authority (FCA), versus 1,086 in the previous year. ⁶

In Germany, between the enaction of its Whistleblower Protection Act (HinSchG) in July 2023 and the first two months of 2024, 689 whistleblowing reports were received by the federal external reporting office (Bundesmeldestelle). ⁷ “This is a positive development but probably not the full picture, as Bundesmeldestelle is only one of the many whistleblower reporting offices that were put in place on federal- and state-level in Germany,” notes Andreas Pyrcek, EY Global Forensics Integrity, Compliance & Ethics Leader.

In the Netherlands, 369 individuals who reported suspected wrongdoing at work contacted the Dutch House for Whistleblowers for advice, up from 243 the year before. ⁸ “It was striking that in 2023, more (political) office holders, managers, confidential counsellors and self-employed persons reported concerns than in previous years,” says Dina Meyer, Forensic & Integrity Services Senior Manager, EY Accountants B.V.

Despite efforts to strengthen whistleblowing protection mechanisms, attitudes toward integrity slow to change. According to the EY Global Integrity Report 2024, attitudes toward integrity and conduct show that organisations are resistant to change. Our report suggests that although board members and management say they feel more confident that the whistleblowing environment has improved over the last two years, employees are less convinced:

• More than one-third (36%) of senior management say it has become easier for employees to report their concerns, versus only a quarter of employees.
• Four out of 10 members of senior management say that solutions for whistleblowing are more advanced and offer greater anonymity and flexibility to raise concerns, versus 18% of employees.
• Roughly one-third of senior management say whistleblowers are now offered more protection from retaliation, versus 14% of employees.

Despite enhanced protection mechanisms, more than half of the EY Global Integrity Report 2024 global respondents who reported misconduct said they felt under pressure not to report. The report also raises further cause for pessimism. Among all respondents, 38% say they didn’t report concerns because they felt they wouldn’t be acted upon; 35% were concerned about their future career progression; and 30% were worried about their safety.

The data suggests that even though there may be whistleblower protection laws in place, whistleblower reporting procedures don’t necessarily offer the required protection, nor do they provide easier reporting. As a result, many potential whistleblowers still don’t trust the process.

Chapter 2: Four Ways to Enhance Whistleblowing Protection Mechanisms

Culture, communication and technology are critical to a whistleblowing program within the organisation’s global compliance strategy. 

To improve the risk management benefits of their whistleblowing framework, organisations need to win the trust of their employees. Here are four actions organisations can take to strengthen the integrity of their whistleblowing programs.

1. Nurture an integrity-first culture

Organisations need to create an environment where employees feel psychologically safe to speak up and are confident that their concerns will not only be heard but also acted upon. This is easier said than done.

The 2023 LRN Code of Conduct Report,⁹ published by LRN Corporation, found that globally, a “speak up” culture appears deficient in most organisations. The 2023 LRN Code of Conduct Report reviewed the codes of conduct of top publicly traded companies across Europe, North America and Asia, assessing them on metrics such as the ease of speaking up about risky topics, usability of the codes of conduct and knowledge reinforcement through learning and development initiatives. Slightly more than half (57%) of the studied codes have a strong non-retaliation policy for employees who speak up about misconduct.¹⁰ Fewer than one- in- five (17%) can explain the procedure for investigating misconduct. In Asia, Singapore’s Straits Times Index (STI) 30 had the lowest code effectiveness scores. Companies in Japan’s Nikkei (NIK) 40 were only slightly better. US Standard & Poor (S&P) 100 companies ranked among the top performers.

Creating a culture that focuses on employee engagement and raising awareness around integrity and accountability is important. According to research¹¹ by the Einaudi Institute for Economics and Finance (EIEF), the Kellogg School of Management, and the University of Chicago Booth School of Business, the higher the measure of integrity, the better the firm’s performance. Companies with an integrity-first culture were more often chosen by students as an attractive place to work and less likely to be subject to unionisation attempts.

Yet, even with robust whistleblower programs in place, cultural influences can be a significant factor when it comes to speaking up. In some countries, a culture of deference to more senior members in the workplace may contribute to individuals being fearful of reporting misconduct.

Consequently, leaders need to do more than encourage employees to speak up when they see wrongdoing — they need to actively engage them. More than making space for employees to speak, leaders need to be proactively soliciting their opinion. It’s less about broadcasting a message and more about establishing multidirectional dialogue. As such, leaders need to not only listen to their employees but also act on what they hear.

2. Increase Awareness, training and communciation

According to the findings of the EY Global Integrity Report 2024, more organisations have implemented whistleblowing hotlines, with the percentage of respondents who said that their organisation doesn’t have one dropping to 7% from 14% two years ago. Furthermore, one-third of all respondents indicated it has become easier to report concerns, and that the solutions for whistleblowing are more advanced and offer greater anonymity.

These advancements may, at least in part, explain why board members and senior management say they feel more confident that the whistleblowing environment has improved over the last two years. Yet, when respondents in the EY Global Integrity Report 2024 were asked how often they had heard management communicate about the importance of behaving with integrity, only fewer than half of all respondents (47%) said communication was frequent. Among employees, the percentage falls to one-third (33%).

When asked how much they knew about the legal protection or policies their organisation or country had in place to safeguard whistleblowers from retaliation, 44% of all respondents said they knew a great deal or a fair amount. One-quarter knew nothing about, had never heard of or didn’t know about what whistleblower protection programs were available to them. Among employees (as opposed to managers, executives or board members), these percentages were reversed: only 25% knew a great deal or a fair amount, whereas 42% knew nothing or had never heard anything about whistleblower protection mechanisms.

Awareness, training and communication are critical to strengthening and maintaining an integrity-first culture, particularly when it comes to whistleblowing. It’s associated with both faster detection of fraud and lower losses. According to the ACFE, organisations that didn’t provide fraud awareness training to their employees lost nearly two times more financially than those who did provide training.

Given that more than half (52%) of whistleblowers are rank-and-file employees (as opposed to managers, executives or board members)¹², it’s imperative to give them the right awareness training and multiple channels of communication to report wrongdoing. Of those who reported wrongdoing, 40% used online forms to report their concerns, followed by email (37%) and telephone (30%).¹³

“Organisations should regularly communicate, potentially to the point of over-communicating, the importance of speaking up with safety and anonymity,” notes Jonathan Feig, EY Forensic & Integrity Services Partner.

At the same time, organisations also need to formulate mechanisms and clearly communicate the actions and consequences of malicious whistleblowing to deter the misuse of the whistleblowing program.

To maximise the effectiveness of whistleblowing programs, organisations should regularly track stakeholders’ awareness and confidence in these initiatives, for instance, through staff engagement surveys. The point is not only to ensure that employees feel empowered to report issues, but that they also feel that their information is appreciated and acted upon, and that the organisation demonstrates a willingness to continually evolve the program in response to employees’ needs.

3. Use technology to augment traditional channels of whistleblowing communcatio and reporting

As critical as training and communication are in developing a robust integrity-first culture, traditional tools aren’t always effective. Employees may miss an email outlining the organisation’s whistleblowing policy or forget what they have learned in a training module. Technology advancements are, therefore, being used to augment and improve communication and management of whistleblowing programs.

In Europe, for example, organisations are integrating several new technologies into their whistleblowing frameworks to improve communication, including allowing individuals to report concerns from any location or device, providing flexible reporting forms, and offering optional anonymity for whistleblowers. According to the NAVEX 2024 Whistleblowing & Incident Management Benchmark Report¹⁴: “An efficient and trusted mechanism by which employees can anonymously or confidentially make inquiries and allegations of suspected or actual misconduct without fear of retaliation is the hallmark of a well-designed compliance program.”

In addition to technology innovations to improve communications channels for whistleblowers, evolving technology is also helping organisations to monitor, store, manage and address misconduct reports. This includes external report management, online repositories to securely store and share relevant documents, audit trails, intuitive case management, anonymisation and archiving for General Data Protection Regulation (GDPR) compliance, configurable access rights management, and internal chat platforms for secure exchange of messages and documents among teams and external advisors.

Artificial intelligence (AI) and generative AI (GenAI) are also making their way into whistleblowing frameworks, from individual report analysis (content and document analyses, as well as activity logging) to database analyses (natural language processing, pattern recognition and trend analysis). “GenAI significantly enhances the system’s usefulness and capabilities. It can provide summaries and translations of allegations, analyse the content of documents submitted by whistleblowers, and manage the overall triage of cases. This includes classifying complaints, identifying relationships between complainants, assessing the urgency and criticality of issues, and identifying common patterns within the reports to summarise the necessary actions to be taken,” says Wojciech Niezgodziński, EY Forensic & Integrity Services Partner, Ernst & Young spółka z ograniczoną odpowiedzialnością. “It can even support automating reports and recommending next steps.”

4. Embed whistleblower program into the organsiation’s global compliance strategy

Whistleblowing programs, which are crucial for organisations, shouldn’t be considered as siloed risk management components. The program needs to be integrated into an overall compliance and risk management strategy and operations to enable the organisation to not only manage and mitigate risks, but also help employees to feel confident, heard and protected.

When employees and third-parties feel confident that their concerns will be taken seriously, it reinforces the importance of compliance across the organisation, ultimately reducing the likelihood of future misconduct. Real-life examples, such as the role whistleblowers played in exposing corporate scandals like defective parts and quality short cuts at a prominent aerospace company or the falsification of medical testing devices at a health technology start-up, demonstrate how intervention can prevent future harm.

The Value of a Whistleblowing Program Far Outweighs Cost

Whistleblowing has gained significant attention and recognition in recent years. The introduction of whistleblower protection laws, increased awareness of the importance of reporting misconduct, and advancements in communication technology have all contributed to creating a more conducive environment for whistleblowing.

Within organisations, whistleblowing programs have become a vital element of global compliance strategy, as they provide crucial mechanisms for identifying and addressing unethical behavior, regulatory violations, or other misconduct that may put the organisation at risk. By uncovering potential issues early, these programs help mitigate risks, close compliance gaps, and promote a culture of integrity, accountability and trust.

The value to be gained legally, financially and reputationally, far outweighs its cost.

Summary

Employees must be able to trust that when they see wrongdoing, they can report it without fear of retaliation and have confidence that leaders will act. New regulations are pushing organisations to do more, but whistleblowers still face challenges as attitudes toward integrity are slow to change. By taking action to strengthen the integrity of their whistleblowing programs, and uncovering potential issues early, organisations will find the value they gain far outweighs the cost.

The article was first published by EY.

Photo by Azzedine Rouichi on Unsplash.