|
|
Establish internal reporting channels and follow-up procedures |
Governance |
-
|
|
|
- Description:
- Establish channels and procedures for internal reporting and for follow-up, after consultation and agreement with social partners where required by national law.
- Frequency:
- One-time
- Check frequency:
- -
- Products/Services:
- The company's internal reporting and follow-up processes for breaches of Union law within the Directive's material scope.
- Checking responsibility:
- Competent national authorities under applicable national implementation law.
- Check method:
- Review of whether compliant internal reporting channels and follow-up procedures have been established.
- Rule set:
-
-
- Source reference:
- Article 8(1)
- Source excerpt:
- Member States shall ensure that legal entities in the private and public sector establish channels and procedures for internal reporting and for follow-up, following consultation and in agreement with the social partners where provided for by national law.
|
|
|
Protect report confidentiality and access |
Governance |
-
|
|
|
- Description:
- Design, establish and operate report-receiving channels securely so that the identity of the reporting person and third parties mentioned in the report remains confidential and unauthorised staff cannot access it.
- Frequency:
- Continuous
- Check frequency:
- -
- Products/Services:
- Internal reporting channels.
- Checking responsibility:
- Competent national authorities under applicable national implementation law.
- Check method:
- Assessment of channel security, confidentiality controls and access permissions.
- Rule set:
-
-
- Source reference:
- Article 9(1)(a)
- Source excerpt:
- channels for receiving the reports which are designed, established and operated in a secure manner that ensures that the confidentiality of the identity of the reporting person and any third party mentioned in the report is protected, and prevents access thereto by non-authorised staff members;
|
|
|
Acknowledge receipt of internal reports |
Other |
-
|
|
|
- Description:
- Acknowledge receipt of a report to the reporting person within seven days of receipt.
- Frequency:
- Event-triggered
- Check frequency:
- -
- Products/Services:
- Reports received through internal reporting channels.
- Checking responsibility:
- The designated receiving or follow-up person or department.
- Check method:
- Check report timestamps and acknowledgment records.
- Rule set:
-
-
- Source reference:
- Article 9(1)(b)
- Source excerpt:
- acknowledgment of receipt of the report to the reporting person within seven days of that receipt;
|
|
|
Designate an impartial follow-up function |
Governance |
-
|
|
|
- Description:
- Designate an impartial person or department competent to follow up on reports, maintain communication with the reporting person, request further information where necessary and provide feedback.
- Frequency:
- One-time
- Check frequency:
- -
- Products/Services:
- Internal reports and their follow-up.
- Checking responsibility:
- Competent national authorities under applicable national implementation law.
- Check method:
- Review of the designation, impartiality and assigned responsibilities.
- Rule set:
-
-
- Source reference:
- Article 9(1)(c)
- Source excerpt:
- the designation of an impartial person or department competent for following-up on the reports which may be the same person or department as the one that receives the reports and which will maintain communication with the reporting person and, where necessary, ask for further information from and provide feedback to that reporting person;
|
|
|
Follow up diligently on reports |
Due Diligence |
-
|
|
|
- Description:
- Carry out diligent follow-up on reports received through the internal reporting channels.
- Frequency:
- Event-triggered
- Check frequency:
- -
- Products/Services:
- Internal reports of breaches.
- Checking responsibility:
- The designated impartial person or department.
- Check method:
- Review of investigation and follow-up records for timeliness and diligence.
- Rule set:
-
-
- Source reference:
- Article 9(1)(d)
- Source excerpt:
- diligent follow-up by the designated person or department referred to in point (c);
|
|
|
Provide feedback on internal reports |
Reporting |
-
|
|
|
- Description:
- Provide feedback to the reporting person within a reasonable timeframe not exceeding three months from acknowledgment of receipt, or from expiry of the seven-day acknowledgment period if no acknowledgment was sent.
- Frequency:
- Event-triggered
- Check frequency:
- -
- Products/Services:
- Internal reports and the follow-up action taken or planned.
- Checking responsibility:
- The designated impartial person or department.
- Check method:
- Review of feedback dates and content against report and acknowledgment records.
- Rule set:
-
-
- Source reference:
- Article 9(1)(f)
- Source excerpt:
- a reasonable timeframe to provide feedback, not exceeding three months from the acknowledgment of receipt or, if no acknowledgement was sent to the reporting person, three months from the expiry of the seven-day period after the report was made;
|
|
|
Provide information on external reporting |
Reporting |
-
|
|
|
- Description:
- Provide clear and easily accessible information about procedures for reporting externally to competent authorities and, where relevant, to Union institutions, bodies, offices or agencies.
- Frequency:
- Continuous
- Check frequency:
- -
- Products/Services:
- Information provided to workers and other eligible reporting persons about external reporting channels.
- Checking responsibility:
- Competent national authorities under applicable national implementation law.
- Check method:
- Review published and internal information for clarity, accessibility and completeness.
- Rule set:
-
-
- Source reference:
- Article 9(1)(g)
- Source excerpt:
- provision of clear and easily accessible information regarding the procedures for reporting externally to competent authorities pursuant to Article 10 and, where relevant, to institutions, bodies, offices or agencies of the Union.
|
|
|
Enable written and oral internal reporting |
Reporting |
-
|
|
|
- Description:
- Enable reporting in writing or orally, including by telephone or other voice messaging systems and, upon request, through a physical meeting within a reasonable timeframe.
- Frequency:
- Continuous
- Check frequency:
- -
- Products/Services:
- Internal reporting channels.
- Checking responsibility:
- Competent national authorities under applicable national implementation law.
- Check method:
- Testing available reporting routes and reviewing channel specifications.
- Rule set:
-
-
- Source reference:
- Article 9(2)
- Source excerpt:
- The channels provided for in point (a) of paragraph 1 shall enable reporting in writing or orally, or both. Oral reporting shall be possible by telephone or through other voice messaging systems, and, upon request by the reporting person, by means of a physical meeting within a reasonable timeframe.
|
|
|
Keep records of reports |
Record Keeping |
-
|
|
|
- Description:
- Keep records of every report received, in compliance with confidentiality requirements, and store them no longer than necessary and proportionate to comply with applicable legal requirements.
- Frequency:
- Event-triggered
- Check frequency:
- -
- Products/Services:
- All reports received by the company's internal reporting channels.
- Checking responsibility:
- Competent national authorities under applicable national implementation law.
- Check method:
- Review report registers, retention periods and confidentiality controls.
- Rule set:
-
-
- Source reference:
- Article 18(1)
- Source excerpt:
- Member States shall ensure that legal entities in the private and public sector and competent authorities keep records of every report received, in compliance with the confidentiality requirements provided for in Article 16. Reports shall be stored for no longer than it is necessary and proportionate in order to comply with the requirements imposed by this Directive, or other requirements imposed by Union or national law.
|
|
|
Document recorded oral reports and allow verification |
Record Keeping |
-
|
|
|
- Description:
- Where a recorded telephone line or voice messaging system is used and the reporting person consents, document the oral report by a durable recording or a complete and accurate transcript, and offer the reporting person the opportunity to check, rectify and agree the transcript by signing it.
- Frequency:
- Event-triggered
- Check frequency:
- -
- Products/Services:
- Oral reports made through recorded telephone or voice-messaging systems.
- Checking responsibility:
- Staff members responsible for handling reports.
- Check method:
- Review recordings or transcripts and evidence of the reporting person's verification and signature.
- Rule set:
-
-
- Source reference:
- Article 18(2)
- Source excerpt:
- Where a recorded telephone line or another recorded voice messaging system is used for reporting, subject to the consent of the reporting person, legal entities in the private and public sector and competent authorities shall have the right to document the oral reporting in one of the following ways:
- **(a)** by making a recording of the conversation in a durable and retrievable form; or
- **(b)** through a complete and accurate transcript of the conversation prepared by the staff members responsible for handling the report.
Legal entities in the private and public sector and competent authorities shall offer the reporting person the opportunity to check, rectify and agree the transcript of the call by signing it.
|
|
|
Document unrecorded oral reports and allow verification |
Record Keeping |
-
|
|
|
- Description:
- Where an unrecorded telephone line or voice messaging system is used, document the oral report in accurate minutes and offer the reporting person the opportunity to check, rectify and agree them by signing.
- Frequency:
- Event-triggered
- Check frequency:
- -
- Products/Services:
- Oral reports made through unrecorded telephone or voice-messaging systems.
- Checking responsibility:
- The staff member responsible for handling the report.
- Check method:
- Review minutes and evidence of the reporting person's verification and signature.
- Rule set:
-
-
- Source reference:
- Article 18(3)
- Source excerpt:
- Where an unrecorded telephone line or another unrecorded voice messaging system is used for reporting, legal entities in the private and public sector and competent authorities shall have the right to document the oral reporting in the form of accurate minutes of the conversation written by the staff member responsible for handling the report. Legal entities in the private and public sector and competent authorities shall offer the reporting person the opportunity to check, rectify and agree the minutes of the conversation by signing them.
|
|
|
Document requested reporting meetings and allow verification |
Record Keeping |
-
|
|
|
- Description:
- Where a reporting person requests a meeting, with the person's consent ensure that complete and accurate records are kept in a durable and retrievable form, using a recording or accurate minutes, and offer the person the opportunity to check, rectify and agree the minutes by signing them.
- Frequency:
- Event-triggered
- Check frequency:
- -
- Products/Services:
- Physical meetings requested for internal reporting.
- Checking responsibility:
- Staff members responsible for handling reports.
- Check method:
- Review meeting records, consent and evidence of verification and signature.
- Rule set:
-
-
- Source reference:
- Article 18(4)
- Source excerpt:
- Where a person requests a meeting with the staff members of legal entities in the private and public sector or of competent authorities for reporting purposes pursuant to Articles 9(2) and 12(2), legal entities in the private and public sector and competent authorities shall ensure, subject to the consent of the reporting person, that complete and accurate records of the meeting are kept in a durable and retrievable form.
|
|
|
Process reporting personal data lawfully |
Record Keeping |
-
|
|
|
- Description:
- Carry out processing of personal data under the Directive in accordance with the applicable EU data-protection rules and delete personal data that are manifestly irrelevant to handling a specific report without undue delay.
- Frequency:
- Continuous
- Check frequency:
- -
- Products/Services:
- Personal data processed in connection with internal reporting and follow-up.
- Checking responsibility:
- Data-protection supervisory authorities and other competent authorities under applicable law.
- Check method:
- Data-protection compliance review, including review of deletion and processing practices.
- Rule set:
-
-
- Source reference:
- Article 17
- Source excerpt:
- Any processing of personal data carried out pursuant to this Directive, including the exchange or transmission of personal data by the competent authorities, shall be carried out in accordance with Regulation (EU) 2016/679 and Directive (EU) 2016/680. Any exchange or transmission of information by Union institutions, bodies, offices or agencies shall be undertaken in accordance with Regulation (EU) 2018/1725.Personal data which are manifestly not relevant for the handling of a specific report shall not be collected or, if accidentally collected, shall be deleted without undue delay.
|
Emtract Ingest