Skip to content
EMPOBase
en

How to set up a whistleblowing channel that staff trust

By the EMPOBase team · · 4 min read

Short answer

A trusted whistleblowing channel has three parts: a safe way to report, a named group that receives reports and has no conflict, and a clear process with fixed steps and timelines. Promise no retaliation, protect the reporter's identity as far as you can, and tell staff what happened in general terms. Trust grows when people see reports handled fairly.

Key points

  • Offer more than one way to report, including a route that skips the line manager.
  • Reports go to people who have no stake in the outcome.
  • Promise protection from retaliation and treat any retaliation as serious misconduct.
  • Acknowledge every report quickly and give feedback on the outcome where you can.

Why does a channel fail even when it exists?

Many NGOs have a whistleblowing policy and still hear nothing. The reason is usually trust, not paperwork. Staff stay silent when they think the report will go to the person they are reporting, when they have seen someone suffer for speaking up, or when earlier reports vanished with no answer. A channel works only if people believe it is safe and that something will happen.

What should the policy say?

Keep it short enough that people read it. Cover:

  1. What can be reported. Fraud, corruption, abuse or exploitation, harassment, safety risks, misuse of funds and breaches of the code of conduct. State clearly that sexual exploitation and abuse reports follow your safeguarding procedure as well.
  2. Who can report. Staff, volunteers, partners, suppliers and, where possible, the people you serve.
  3. How to report. At least two routes, for example a web form, an email address and a named person.
  4. Who receives reports. Name roles or a small group.
  5. What happens next. The steps and timelines in plain words.
  6. Protection. A statement that retaliation is not allowed, and what happens to anyone who retaliates.

Check your national law and donor requirements, since rules on protecting whistleblowers differ by country.

How to design the process

  1. Choose receivers with no stake. Avoid routing reports through the line manager. A small group, for example head of HR, head of finance and a board member, reduces the chance that one person buries a report.
  2. Add a route around the top. If the report concerns a member of the receiving group, it must go to someone else.
  3. Acknowledge fast. Confirm receipt within a few working days, even if you can say nothing more.
  4. Assess first. Decide whether the report needs an investigation, a quick fix or a referral, and write down why.
  5. Investigate fairly. Use a trained person who is independent of the case. Give the person accused a fair chance to respond.
  6. Decide and act. Record the outcome and any action taken.
  7. Close the loop. Tell the reporter what you can. You may not be able to share details, but you can say that the case was reviewed and closed.

How do you protect the reporter?

  • Limit who sees a report to those who need to.
  • Keep case files in a space with restricted access.
  • Never share the reporter’s name beyond the receiving group, unless law requires it.
  • Watch for retaliation after a report: a bad appraisal, a sudden transfer, a lost contract. Check in with the reporter at set points.
  • Treat retaliation as a separate breach, handled on its own.

How do you build trust over time?

Trust comes from visible results. Do these things:

  • Tell staff about the channel at induction and once a year after that.
  • Publish a short yearly summary: how many reports came in, what types, how many closed and what changed. Leave out details that could identify anyone.
  • Thank people who report, even when the report is not upheld.
  • Ask staff in surveys whether they would feel safe reporting, and act on the answers.
  • Make sure managers know that taking a report badly is a failure of their role.

A rise in reports often signals growing trust, not a worse organization. Tell your board so they do not read it the wrong way. Related reading: board governance basics for NGOs.

A short example

A junior staff member sees a supervisor approving payments to a supplier owned by a relative. She is afraid to tell her manager, who is friends with the supervisor. Because the policy offers a web form that goes to a small group outside the line, she reports there. Within three working days she receives an acknowledgement. A trained, independent person reviews the case, and the group decides to investigate.

Months later she is told that the case was reviewed and that action was taken, though no detail is shared. She has seen that a report leads to a result and that nobody treated her badly. When a colleague later asks whether to speak up, she says yes.

This is what a trusted channel looks like from the inside: a safe route, a quick reply, a fair process and some word at the end. Each of those steps needs a named person and a target time.

Where EMPOBase fits

EMPOBase includes a Whistleblower area within Governance & Compliance, alongside Conflict of Interest and the Risk Register. You can read more on the platform page and about access controls on the security page. Software cannot create trust on its own: the receivers, the timelines and the no-retaliation promise are decisions your organization must make and keep. Check what your local law requires before you promise anonymity.

Questions people ask

Should anonymous reports be accepted?

Most good policies accept them, because fear stops many people from giving a name. Anonymous reports are harder to investigate, so also make named, confidential reports as safe as possible.

Who should handle reports about the director?

Someone above or outside the director, usually the board chair or a committee of the board. Staff must know that route exists.

How long should handling a report take?

Set your own targets and publish them. For example, acknowledge within a few days and give a first update within a few weeks. Complex cases take longer, so promise updates, not speed.