External vs. internal competent authority managing whistleblower reports

A trustee, ombudsman or delegated person. All of these terms you may encounter refer to one and the same thing, namely the so-called "competent authority", who is a key function in the internal whistleblowing system. 

Companies implementing a whistleblowing system are therefore faced with the important question of who to assign to this function. In the following, we look at what responsibilities are associated with the function, how to select the right person and whether it is more appropriate to choose an internal employee or an external delegate for this role.

Who is the competent authority and what are his/her duties?

One of the main duties associated with the forthcoming Whistleblower Protection Act is the appointment of a 'competent authority' who:

• receives and assesses the reasonableness of a notification made through the internal whistleblowing system,
• proposes corrective measures following a notification,
• maintains confidentiality; and
• acts impartially.

The person who receives and deals with the notification must be of good repute, of the utmost trustworthiness, independent, free from conflicts of interest and properly trained. It is extremely important to keep the whistleblowing system as credible and efficient as possible through a sufficiently knowledgeable competent authority, thus avoiding the risk of the whistleblower disclosing information. A whistleblower may disclose information when they do not have sufficient confidence in the whistleblowing system or when they feel that the firm is not adequately handling the disclosure (they may get this feeling from a mere lack of communication).

What are the steps to be taken by the competent authority once a notification has been made?

• The competent authority is obliged to receive the oral or written notification via the internal notification system. If the whistleblower requests it, the competent authority is also obliged to receive the notification in person.
• The competent authority must notify the notifier in writing of the receipt of the notification within seven days of the date of receipt.
• The competent authority shall assess the validity of the notification and inform the notifier in writing of the results of the assessment within thirty days of receipt of the notification. (In complex cases, this period may be extended by up to thirty days, but not more than twice.)
• If the notification is assessed as substantiated, the competent authority shall propose measures to prevent or remedy the unlawful situation and shall inform the notifier in writing.
• If the notification is not found to be justified, the competent authority shall inform the notifier in writing.
• Is an internal employee the appropriate person to receive and evaluate the notification?

The head of the legal department, the compliance officer or someone from the human resources department are usually suggested as the appropriate person. However, this is a rather demanding and very responsible position which involves a large number of responsibilities. In addition, the person chosen must be sufficiently independent to avoid a conflict of interest in the investment of the notification. Last but not least, they must reliably maintain confidentiality, prevent anyone from having access to the content of the notification and must not provide anyone with any information that could defeat the purpose of the notification. A violation of these duties of the competent authority is punishable by a fine.

If the company does not have a suitable candidate to perform this function, it is possible to appoint an external person who guarantees independence and professionalism in dealing with the notification and proposing effective measures. 

See a comparison of the benefits of an external and internal competent authority

External competent authority:

• less administrative burden for the company
• the investigation is guaranteed to be objective
• no risk of conflict of interest
• notifications are better evaluated by a professional with experience in receiving and dealing with notifications
• lower risk of disclosure of the identity of the whistleblower

Internal competent authority: 

• better knowledge of the company and internal processes
• lower financial costs
• easier accessibility for verbal notifications

Who receives and evaluates the notification can be quite crucial to the fate of the entire incident. Failure to properly carry out the duties of the person in charge jeopardises the credibility and functionality of the entire notification system. The company is then at risk that the employee will either not file a report at all and the problems will accumulate, or will disclose their information, causing the company to lose control of the situation, but more importantly, the company may suffer devastating reputational or financial damage.