What it has to guarantee
- Confidentiality for the person reporting and the people named: only those who run the channel have access.
- Anonymity, if the person reporting chooses it.
- Acknowledgment and deadlines: the person reporting knows the report arrived and when they will get an answer.
- A case file with a trail: what came in, what was checked, who decided and when.
- Protection from retaliation for anyone reporting in good faith.
What the law says in the EU and in Spain
The EU Whistleblower Directive (2019/1937) requires internal reporting channels in many organizations. Each member state applies it through its own law. In Spain, Law 2/2023 calls it an internal information system. It requires one of companies with 50 or more employees, among others, with acknowledgment within seven days and a response within three months at most.
Outside the EU the rules are different. What applies to you is for your legal advisor to confirm.
An example
Someone in purchasing notices that one supplier always gets the orders without competing quotes, and reports it anonymously. They get an acknowledgment, and whoever runs the channel checks whether the report is admissible and investigates it. Every step is recorded until the case is closed with its outcome.
The usual mistake
Using an email inbox as the channel. It does not guarantee anonymity, does not control who reads each message, does not track deadlines and leaves no case file. Doing things right without being able to prove it is of little use in an inspection.