HOME

Since the adoption of the EU Whistleblower Protection Directive (2019/1937), companies with over 50 employees have been legally obliged to provide internal reporting channels and protect those who speak up. Hungary transposed the directive into national law in 2023, introducing whistleblower systems as a compliance requirement for all mid-sized and large employers.

However, the transposition was not timely in some countries. In March 2025 The EU Court of Justice fined five countries for failing to implement the directive within the required timeframe, thus failed to boost protection for whistleblowers who expose fraud, tax evasion, data breaches and other misdeeds. The court handed a fine of 34 million euros to Germany, while the Czech Republic was obliged to pay 2.3 million euros and Hungary 1.75 million euros. Fines of up to 500,000 euros were handed to Luxembourg and Estonia.

Sometimes I wonder why cultural change is still lagging behind legal mandates. I watch the world changing – in this area, it still feels painfully slow…

According to the 2024 EQS Whistleblowing Survey, 96% of companies across Europe have already implemented a reporting system, and 81% are using a software-based solution. But having a whistleblowing system in place doesn’t automatically mean it’s trusted or used effectively. There is often a clear gap between ticking the compliance box and building a culture where people feel safe to speak up. According to the 2025 NAVEX Benchmark Report:

• Over 2.15 million whistleblowing reports were analyzed across 4,000+ organizations globally.
• The average substantiation rate was 46%, meaning nearly half of the concerns raised were not considered valid.

In Europe:

• 52% of reports were submitted anonymously
• Web-based platforms officially overtook hotline reporting as the preferred method
• The median reporting volume in continental Europe (excluding the UK) was 0.70 reports per 100 employees.

Other research shows that organizations often struggle to translate systems into trust. In Hungary, local analysis (Kluwer Law Online, 2025) highlights the legal transposition of the directive, but also identifies several practical barriers to enforcement — including lack of trust in the system, fear of retaliation, and uncertainty about how reports are handled or followed up internally. It shows that legal compliance alone is not enough to build confidence in speaking up.

This brings us to a deeper truth:

On paper, this is a structural change. In reality, it is a cultural and emotional transformation – and one of the most complex change management challenges I’ve encountered.

Over the years, I’ve led whistleblowing investigations in manufacturing, shared services, and commercial settings. The cases reflected the diversity of human conflict and organizational dysfunction:

• Physical fights by the production line
• Shouting, verbal abuse, and harassment
• Managerial misconduct and micromanagement
• Alleged embezzlement, favoritism, and breach of trust
• Sexual harassment and inappropriate jokes
• Discriminatory hiring practices or denial of equal opportunities
• Misuse of power, threats, psychological pressure

In my experience, over 60% of the reports involved managers as the subject of concern. Some allegations were well-founded. Others could not be substantiated due to lack of evidence. And many were clearly weaponized – used strategically to damage reputations under the cover of anonymity.

While whistleblowing systems are designed to protect those who speak up, they must also protect those who are falsely accused. Not every report is rooted in truth. Some come from misinterpretation, some from conflict, and a few are clearly driven by personal agendas.

When a report turns out to be unsubstantiated or malicious, organizations have a responsibility to ensure that the person who was named is not quietly left to carry the burden of suspicion.

Fairness goes both ways – and a trustworthy system must hold space for both the reporter and the reported.

Most multinational organizations already have mature whistleblowing platforms. There’s a hotline. A portal. A reporting flowchart. A compliance inbox. A 3-month investigation SLA.

But change doesn’t happen just because you implement. Change happens when people feel safe enough to use it – and trust that they will be treated fairly, and that misconduct will have consequences.

Using the ADKAR model, here’s what whistleblowing requires at the individual level:

• Awareness – Do people know the channel exists? What it’s for? Has it been clearly communicated that raising concerns is not only permitted, but also valued?
• Desire – Do they care enough to take action? Do they feel a personal or ethical responsibility to speak up?
• Knowledge – Do they understand how to report and what will happen?
• Ability – Can they articulate a concern clearly and professionally?
• Reinforcement – Have they seen the organization take real action before?

In my experience, Desire and Reinforcement are where things tend to fall apart. People usually know what the process is. They’ve seen the policy, they’ve probably sat through a training. But when something actually happens – when they see or experience something that should be reported – they hesitate. They’re not sure it’s worth it.

Maybe they’ve seen others speak up and nothing came of it. Maybe too many report disappeared into silence. No follow-up. No outcome. No visible action. Or worse – they saw someone suffer quietly for doing the right thing.

If individuals are hesitant to report, leadership must step in to build safety and credibility. That’s where CLARC roles become essential. As change practitioners, we often say “leadership sponsorship is key”. That applies here, too.

A whistleblowing system needs more than a compliance owner. It needs active, value-based leadership. Through the CLARC model, leaders should:

• Communicate: Explain the purpose of the system, and what it’s not.
• Liaise: Create safe feedback loops, especially in sites or roles with low power.
• Advocate: Visibly support the system – even when it’s uncomfortable.
• Manage resistance: Handle fear, suspicion, and even cynicism.
• Coach: Guide managers on how to talk about ethics, fairness, and accountability.

When a report is substantiated, leaders must act. Not with symbolic measures, but with clear decisions – including disciplinary action or even legal steps when the case requires it. This is uncomfortable, but without consequence management, whistleblowing quickly loses credibility.

You will learn what people fear, who they trust, how conflict is handled, and whether ethics are aspirational or operational.

The success of a whistleblowing process lies in the everyday choices of those who investigate, decide, and communicate. Even when someone wants to act, they often can’t. I’ve seen local managers or HR partners who sensed the issue, believed the report, but lacked the authorization or political backing to take meaningful action.

A system is only as strong as the people who are empowered to use it.

How are whistleblowing systems handled in your organization? Do they drive culture forward – or do they remain compliance checkboxes?

Let’s have an honest conversation. Because silence never made an organization safer.