Internal reporting channels: understanding requirements for group structures

Does every entity in a group structure require its own reporting channel?

Article 8(3) of the EU Directive requires legal entities in the private sector with 50 or more employees to establish internal reporting channels and procedures that employees can use to reveal information on breaches of EU law.

This is not open to interpretation. Every legal entity with 50 or more employees must establish its own reporting channels and procedures—even if it belongs to a group of companies. Helpfully, however, individual entities with less than 250 employees may share resources when it comes to receiving reports and any subsequent investigation as part of the follow-up process.

Is a centralised approach at the group level still allowed? Or will an entity-by-entity approach be required?

A group-wide reporting channel is still permitted, and you can continue to encourage all workers in the group to use the group-wide reporting channel. But for individual subsidiary entities, the group-wide reporting channel cannot be the sole option available to the individual entity’s workers. A separate, local reporting channel must be provided for each entity in the group with more than 50 employees.

What should an organisation provide to employees in corporate branches (i.e. not legal entities)?

The EU Directive and the Irish legislation are silent on the issue of branches. A degree of interpretation is therefore required to determine the most appropriate approach. You should have specific regard for the law of the country where the employees are physically located.

In summary

The requirements of the EU Whistleblowing Directive present Irish companies with a solvable task. Companies with well-developed whistleblowing systems can retain group-wide reporting channels and processing procedures. All they have to do is modify their processes and establish customised local extensions, taking country-specific requirements into account. Reports can be directed to the parent or local subsidiary according to the whistleblower's preference with little effort. Should a whistleblower wish to contact a local person, this option should also be ensured. Provided the national requirements are met, it is also possible to standardise report processing.

What should you do now?

Organisations with a cross-border EU presence need to examine whether their scale brings them within the scope of the Directive. If the answer is yes, they must implement the necessary measures. Business leaders should also gauge the extent to which branches and subsidiaries are bound to comply with the new measures so that internal processes can be revised accordingly. Internal reporting channels should be introduced promptly, and new rules communicated to employees and other workers as quickly and comprehensively as possible.

How can we help?

Our digital solution facilitates both global and local reporting within a single programme. The software can facilitate reporting in 80+ languages and be easily tailored to ensure compliance with the laws of individual EU member states. It also provides an end-to-end process for secure, confidential and streamlined reporting. If you would like to arrange a demonstration of our software, please get in touch.