Custom software to manage your internal whistleblowing policy
If a reporter is disadvantaged, they do not have to prove that it resulted from their report. The employer must demonstrate that the disadvantage had nothing to do with the report. That is an evidential position you build long before you need it, or one you can no longer build at the moment it matters.
What the law requires of the employer
Organisations with fifty or more employees must set up an internal reporting channel. The internal reporting procedure sets out how a report is handled, when there is a suspicion of wrongdoing, which independent officers receive reports, and that a reporter may consult an adviser in confidence. There are also two deadlines: an acknowledgement of receipt within seven days, and information on the follow-up within a reasonable period, not exceeding three months.
The scheme itself cannot be freely determined. With the addition of a new item to Article 27 of the Works Councils Act, the reporting scheme falls under the works council's right of consent. A revised scheme adopted without consent is, formally, a scheme that does not exist.
In addition, the employer has a duty to inform. Employees must be given information about the reporting scheme itself, about the external reporting routes to competent authorities, and about legal protection against adverse consequences following a report. This is not a one-off notice but something that must demonstrably remain available.
Then there is the prohibition on detriment, with its reversal of the burden of proof. In proceedings, the employer must demonstrate that any detriment to the person who reported was not a consequence of the report. If a reorganisation, an assessment or a non-renewed contract happens to follow a report, the question is not whether there is a link, but whether you can show that there is none.
How we build this
The core is the procedure itself and the context around it, not the report itself. Reports are made through a secured channel; this system concerns what must be demonstrably in place around it.
Every version of the reporting procedure, with its date, the works council's consent, and the period during which it applied.
What information on internal and external routes and legal protection was made available, to whom, and when.
Different branches or legal entities have their own procedures and points of contact, with their own deadlines.
Personnel decisions are recorded with their rationale and timeline, so that it can later be shown that they stood on their own.
What the software actually does
Managing the procedure underpins the whole. What else you need depends on your size and on the number of entities within the organisation.
Version control with consent
For each version, the date, the consent and the period of validity. This makes it possible to say which procedure was in force when a report came in.
Demonstrable duty to inform
Which information on internal routes, external routes and legal protection was available, and since when.
Points of contact per entity
Who receives reports in which unit, and who covers in case of absence. Otherwise deadlines keep running unnoticed.
Deadlines at organisational level
The seven days and the three months apply per report. At board level, what matters is whether they are structurally met.
Detriment file
For decisions concerning a reporter, the rationale and timeline, built up before any dispute arises.
Aggregated overview
Volumes and processing times across entities, without anyone needing to look at individual reports.
Who we build for
Who manages this differs by organisation. Four situations.
HR directors
They take personnel decisions where the question may later arise whether these stood apart from a report.
Compliance officers
They manage the procedure and must be able to show that it was validly adopted and properly communicated.
Board members
They carry the responsibility and want to know whether deadlines are structurally met, not just occasionally.
Works councils
They hold consent rights and want to see exactly what has changed compared with the previous version.
Test your idea first: a working prototype in 1 day
With OneDayBuild, we turn your idea into something tangible in one day for €1,150, so you can see whether further development is worth the investment. Decide to go ahead with the full build? Then we credit the full cost.
Explore OneDayBuild →Technology and integrations
Legislation is amended, supervisory tasks shift and organisations restructure. Procedures, entities and deadlines should be configurable and not hard-coded.
Why Appfront
The burden of proof rests with you
In the event of detriment, you must demonstrate that it had nothing to do with the report. We build the records that make this possible, before any dispute arises.
A procedure without consent does not count
The reporting procedure falls under works council consent rights. We link version, consent and period of validity together.
Informing is not the same as being able to demonstrate it
The duty to inform concerns availability. We keep track of what was in place and since when.
We do not build the reporting channel into this system
Reporting itself belongs in a secured environment with its own access controls. That separation is the core of the protection.
Security and privacy
A reporter's identity must remain confidential, and that is not a setting but a design principle. For that reason we keep the management of the procedure strictly separate from the reports themselves: whoever manages the procedure sees no content of reports, and aggregated figures cannot be traced back to individuals. Data is not kept longer than necessary, and access is logged, including access by administrators.
For this topic, the reliability of the moment is what matters. A justification for a decision that was only written down after a report came in will work against you in proceedings. We record decisions and documents immutably, with timestamp and author, and any correction appears as a visible amendment alongside the original entry. You can read how we handle security ourselves in our information security policy.
Frequently asked questions about the internal reporting scheme
Organisations with fifty or more employees must set up an internal reporting channel. For the financial sector, this obligation applies regardless of that threshold.
A reporter receives an acknowledgement of receipt within seven days of submission, and information on the follow-up to the report within a reasonable period of no more than three months.
Yes. With the addition of a new component to Article 27 of the Works Councils Act, the reporting scheme falls under the works council's right of consent.
In proceedings, the employer must demonstrate that any detriment was not a consequence of the report. The reporter does not have to prove the link; you have to prove that there isn't one.
About the reporting scheme itself, the external reporting routes to competent authorities, and the legal protection against adverse consequences following a report.
In a protected reporting channel, separate from this administration. We describe how reporting works with or without a name, and how deadlines are monitored per report, on our page about the app for the internal reporting scheme.
Can you demonstrate that this decision was independent of that report?
Pick one personnel decision from the past year and find the supporting documentation, with its date. If it was only written down once questions arose, that is exactly the position the law does not grant you. We build this as a standalone application and as part of a wider custom software development project.