Reading time: 4-6 minutes
Whistleblowing refers to reporting systems that allow employees or third parties to securely and confidentially—sometimes anonymously—report serious incidents or illegal acts within an organization so they can be investigated and addressed.
Reports may involve HR-related situations (harassment, discrimination, etc.) or ethical and compliance breaches (non-compliance with internal rules, fraud, corruption, etc.).
In large organizations, and particularly in the banking sector, these systems are now strictly regulated to ensure whistleblower protection.
With European Directive 2019/1937, transposed via the Waserman Law in France, and increased requirements from supervisory authorities, the regulatory framework now requires companies to implement reliable, secure, and traceable mechanisms for processing alerts.
On the ground, however, these projects go far beyond simple compliance.
This was illustrated by a project successfully supported by Althéa for a major international bank, as part of the deployment of a harmonized reporting system across several countries.
The context: harmonizing an existing system within an international group
The bank already had reporting systems in place in certain entities.
However, these mechanisms had several limitations:
- different processes depending on the country
- disparate or local tools
- limited visibility at the group level
- alert management that was difficult to consolidate and monitor.
In a reinforced regulatory context, the group therefore launched a project aimed at:
- harmonizing alert processing procedures,
- deploying a single whistleblowing tool,
- securing the management of sensitive data,
- strengthening the global oversight of the system.
Althéa was asked to support this project, from the scoping phase through to operational deployment.
Identified challenges: compliance, sensitive data, and governance
Very quickly, the project revealed several structural challenges.
1. Data protection
A whistleblowing system involves managing particularly sensitive information:
- identity of the whistleblower
- reported facts
- individuals potentially involved.
In an international banking group, this raises critical questions:
- data localization
- compliance with local regulations
- access security
- absolute confidentiality of information.
The management of this data became the heart of the system.
2. International regulatory complexity
The group operated in several jurisdictions with:
- different whistleblowing laws
- varied requirements from supervisory authorities
- specific data protection constraints.
The objective was therefore to find a balance between global harmonization and local adaptation.
3. Governance of alert processing
Beyond the tool, the project quickly raised organizational questions:
- Who is responsible for processing an alert?
- What is the autonomy of local entities?
- How to handle sensitive cases involving managers?
- How to guarantee the independence of investigations?
The project thus highlighted a central issue: the governance of the reporting system.
Althéa’s approach
To address these challenges, Althéa structured the project around several key stages.
1. Scoping and diagnosis of the existing system
This phase allowed for the identification of:
- existing processes in the various entities
- regulatory gaps
- technical and organizational constraints.
2. Formalization of a target model
Working with the group’s Compliance, HR, IT, and Data Protection teams, Althéa helped to:
- define alert management processes
- clarify roles and responsibilities
- structure the governance of the system.
3. Tool selection assistance
The project then included an evaluation of market solutions phase.
The offers and approaches of the main specialized players (Navex, EQS, Whispli) were analyzed according to several criteria:
- security and data protection
- access management and information segregation
- investigation workflows
- consolidated reporting
- multilingual capabilities.
4. Deployment and support
Finally, Althéa also supported:
- the configuration of the selected solution
- the implementation of workflows
- change management
- training for alert managers.
In terms of timeline, the project took place over a period of 14 months:
- Scoping, formalization of the target, and RFP preparation: 4 months
- RFP / solution selection / contracting: 5 months
- Configuration and international deployment: 5 months
Key lessons from the project
This case study highlights several key success factors.
1. Clarify governance before the tool
The tool alone cannot resolve organizational trade-offs.
Roles and responsibilities must be defined beforehand.
2. Harmonize without uniformizing
An international system must integrate local constraints while ensuring global consistency.
3. Build trust in the system
A compliant system that is rarely used does not achieve its objective.
Employee trust is essential.
4. Manage the project as a cross-functional transformation
A whistleblowing project involves several functions:
- Compliance
- HR
- IT
- Data Protection
- Risk.
It must therefore be managed as a cross-functional risk governance project.
In conclusion
Deploying a whistleblowing system in a major international bank is not just about installing a regulation-compliant tool.
It is about structuring a system capable of:
- protecting extremely sensitive data,
- effectively handling potentially critical situations,
- and strengthening the maturity of the risk management framework.
As illustrated by this project supported by Althéa, success relies above all on governance, trust, and process structuring.
Would you like to discuss these challenges or a whistleblowing project?
Editorial
Olivier Collet, Senior Expert in organizational transformation
