New corporate whistleblowing protection obligation

Businesses are vulnerable to events that damage their reputation, and business leaders are increasingly aware of the need to ensure and demonstrate corporate integrity. They also recognise that they need to be much more proactive in managing these risks than they have been to date.
Each year, BDO's network produces an international survey on the risks that drive the business world. The pandemic has shown that risk-averse companies have done much better. Success factors included the ability to look at problems from a different perspective: openness and flexibility in processes, as well as care for employees, partners and the wider public. Loyalty, in particular, helps to weather crises of all kinds.

A secure internal communication channel and whistleblower protection are important mechanisms for responsible business. It helps to build trust in relationships, thereby fostering long-term cooperation.

What is the Whistleblower Protection Directive?

The aim of the Directive is to provide legal protection for whistleblowers who witness unethical or illegal behaviour in a company. They report damage to the public interest of which they become aware in the course of or in connection with their employment.

According to the Directive, damage to the public interest is to consist in a breach of the law in predefined areas in which the European Union institutions exercise their competence. These include public procurement, financial services, money laundering and terrorist financing, environmental protection and others. The Czech Whistleblower Protection Bill is already being discussed by the Chamber of Deputies. If the Parliament fails to approve the law, the obligations related to the Directive will be enforceable in the Czech Republic as amended by the European Directive as of 17 December 2021.

What are your obligations under it?

The new obligations do not only affect state organisations or large multinationals. All companies with 25 or more employees must set up an internal reporting system. And also public contracting authorities, with the exception of municipalities with up to 5,000 inhabitants. Businesses and other entities will be obliged to set up what is known as an internal notification system, i.e. secure procedures for receiving and investigating notifications. Above all, the system must keep the identity of whistleblowers confidential. You will also have to designate a person who will be responsible for receiving and investigating notifications. The choice of form of notification is essentially up to the whistleblower - you must allow the whistleblower to receive notifications in writing and orally. Not only employees but also contractors or job applicants can submit notifications. In addition, the whistleblower has the right to be informed in writing of the receipt of the notification within 7 days of its receipt, and has the right to be informed of the findings of the investigation within 30 days of receipt of the notification.

New Obligations

It will be crucial for companies and organisations to have an internal reporting system in place by the end of March next year. They will need to have a functional and secure system for receiving notifications by 1 April 2022 at the latest.

The penalty for violation of the obligation under the Whistleblower Protection Act is a fine of CZK 1 million or 5% of the company's net turnover. Compliance with the principles of corporate social responsibility and good relations with key partners and the public are also increasingly important. Violations of whistleblower protection obligations can discourage existing and potential partners from cooperating and damage a company's reputation.

Before you decide to implement a notification system in your company, consider what it should do:

Have you chosen a solution that is secure enough?
Have you identified the person responsible for the operation of the system?
Have you determined who will have (administrator) access to the system?
Have you ensured user confidentiality while allowing them access to feedback?
Have you selected who will review and evaluate individual notifications?
Have you established appropriate procedures and metrics for assessing notifications?
Have you educated users on how to use the system?

Legislation that would fully cover the issue of whistleblowing has been missing in the Czech Republic for a long time. As a result, Czech companies often deal with whistleblowing only marginally and some do not even use any internal whistleblowing system. Unlawful and unethical behaviour in the workplace damages the company's image, demotivates employees and can even be very costly.

The lack of a proper reporting system means that people do not know how to report. Alternatively, they are concerned that their identity will be revealed, that they will be labelled as a whistleblower and that they may be retaliated against by colleagues or superiors. They may therefore consider entrusting the information to an outside party (media, police, legal counsel, administrative authority, etc.). In such a case, there is a risk of embarrassing media scandals or even legal proceedings. The reason for having an internal whistleblowing system should therefore not only be to meet the legal requirements, but also to prevent unethical and illegal behaviour and to get regular feedback on the running of your organisation.

Physical mailboxes or email boxes are already obsolete and do not fully comply with the aforementioned European Directive. That is why these traditional notification channels are being abandoned and online solutions are being developed, for example, which meet the conditions of the new obligation. These can bring great results for companies.

It has been said:

"Companies are worried about what the new obligation will bring. The new BDO Risk Landscape confirms that those who look after their people and their environment can manage crises better. I am convinced that many businesses and owners are sympathetic to this approach, even if they may not otherwise be familiar with the EU lingo. BDO's approach is to offer pragmatic and affordable solutions. We want to support our partners to seize the opportunities and manage the risks associated with the new regulation."

BDO Solution: the Ethics Line

Internet applications can facilitate the operation of the internal notification system. Today's technologies allow for the quick and easy implementation of an ethics hotline, which serves as a helpdesk or communication platform for filing notifications. Our whistleblowing tool allows whistleblowers to raise concerns via a secure form. This kind of centralisation will help you to have more control over individual reports, make it easier to track deadlines and protect the personal data of whistleblowers.

Our experts will regularly report to you on potential submissions and suggest the appropriate course of action to address them.

Why choose our solution?

Reassurance and peace of mind: be the first to know about wrongdoing in your organisation. Keep things under control. Act with due diligence. Avoid legal, financial and reputational risks.
Speed and simplicity: the web form has a responsive design and can be accessed from desktop, tablet or mobile. It is easy to use and anyone can use the app.
Discretion: avoid disclosing your internal affairs to the authorities or the police and allow employees to make notifications on a portal dedicated to you.
Efficiency: the service is available 24 hours a day, 7 days a week.
Reliability and confidentiality: our solution guarantees the highest level of protection for the identity of the whistleblower.
All under one roof: Our team of experienced internal audit and risk management consultants can help you cover the entire downstream risk management area.