Who can report or denounce an irregularity through a company’s internal reporting channel and how can they do it?

17 May, 2024
–
Compliance
–
MES Advocats


In the private sector, all companies with more than 50 employees are required to have an internal reporting channel under Law 2/2023, of February 20, regulating the protection of persons reporting regulatory infringements and fighting against corruption (Law 2/2023).

The reporting channel allows for reporting, either identifiably or anonymously – at the choice of the informant – any action or omission that may constitute a serious or very serious criminal or administrative offense, or a breach of European Union law.

Law 2/2023 protects the informant from retaliation in a work-related context that may result from reporting the aforementioned actions or omissions, except if the informant reports classified information, or information derived from the protection of professional secrecy of medical and legal professionals, the duty of confidentiality of the Security Forces and Bodies, or the secrecy of judicial deliberations.

Now, who can report an irregularity through the reporting channel?

The list, as we will see, is extensive and includes:

Employees of the company;

Self-employed individuals;

Shareholders, participants, and persons belonging to the governing body of the company, including non-executive members;

Any person working for or under the supervision and direction of contractors, subcontractors, and suppliers;

Former employees;

Volunteers;

Interns;

Workers in training periods regardless of whether they receive remuneration; and

Job applicants of the company if the infringements occurred during the selection process or contractual negotiation.

In short, anyone who is connected to the company in a work or professional context can resort to the internal reporting channel to report an irregularity.

But how is such a report made?

The informant can choose to file the report through the company’s internal channel, or through the external channel of the competent authorities, although the former is legally configured as the preferred route.

If the internal channel is chosen, the informant, before reporting, must verify the procedure approved by the company for handling the information received.

The company may allow only written or verbal reports, or both.

Written reports may be received via postal mail or through any electronic means enabled for this purpose, either email or by completing a form hosted on the website.

Many companies opt to use computer platforms that offer the reporting channel service and guarantee compliance with the confidentiality and data protection requirements imposed by regulations.

Verbal reports, on the other hand, are made by telephone or through a voice messaging system.

Law 2/2023 also requires to foresee the possibility of reporting through the convening of a face-to-face meeting, which must be held within seven days following the formal request for it.

When reporting orally, Law 2/2023 requires documenting the communication, with the informant’s prior consent, through a secure, durable, and accessible recording of the conversation, or through a complete and accurate transcription of the conversation made by the responsible personnel. The informant has the right to verify, rectify, and accept by signing the transcription of the conversation.

And once the information has been sent or transmitted to the company, what happens?

Well, the company, and more specifically, its management or governing body, must have previously approved a procedure for handling the information received, which must be processed diligently under the supervision of the Responsible for the reporting channel.

The procedure must comply with all the requirements imposed by Law 2/2023. Firstly, acknowledgment of receipt of the communication must be made to the informant within 7 calendar days following its receipt, unless this could endanger its confidentiality.

Additionally, a maximum period must be provided for responding to the investigation actions, which cannot exceed 3 months from the receipt of the communication or, from the filing of the communication, if the receipt has not been acknowledged. Only in cases of special complexity, it is justified to extend this period for up to an additional three months.

The procedure must also anticipate the possibility of maintaining communications with the informant so that, if necessary, the latter can provide additional information to the company.

The person affected by the communication, on the other hand, has the right to be informed of the actions or omissions attributed, and to be heard at any time during the procedure. Furthermore, his or her right to the presumption of innocence and honor must be respected. Although he or she may have access to the file, the identity of the informant must not be revealed under any circumstances.

It should be noted that if the informant submits the communication through a channel not enabled for this purpose, or transfers it to personnel not responsible for its treatment, it must be immediately forwarded to the Responsible for the reporting channel for processing with due diligence.

Although Law 2/2023 does not establish additional rules on the procedure for managing received information, it is logical for the company to follow the following scheme in processing a communication:


Once the communication is submitted, its receipt will be acknowledged, except in the case mentioned above where the confidentiality of the informant is endangered. Then, it must be assessed whether the communication meets the requirements established in Law 2/2023, so that it can be admitted or dismissed.

If dismissed, the proceedings will be archived, and the procedure will be concluded.

If, on the other hand, it is admitted, an investigation phase will be initiated, which will include all those actions aimed at verifying the plausibility of the reported facts. In this phase, it is advisable to conduct an interview with the person affected in which he or she is invited to present his or her version of the facts and to provide any evidence he or she considers appropriate and relevant.

Once the investigation phase is completed, usually the Responsible for the reporting channel will issue a report that includes the facts of the communication, the investigations carried out, and the conclusions reached.

Following the report of the Responsible for the reporting channel, the company may reasonably decide on any of the following and duly communicate it to the informant:

1. Archive the communication;
2. Refer it to the Public Prosecutor’s Office if the facts could constitute a crime, or to the European Public Prosecutor’s Office if it could affect its financial interests;
3. Refer it to the authority, entity, or body considered competent for processing; or
4. If applicable, adopt disciplinary measures and/or agree to initiate legal proceedings and/or commence judicial proceedings.

Regardless of the decision made by the company, the informant will be protected against any act constituting retaliation in a work-related context, including threats and attempts, for the following 2 years after the investigations are completed.

At MES Advocats, we offer a comprehensive service regarding the reporting channel, either to implement and/or audit its compliance with Law 2/2023, or to advise the company on the management, processing, and resolution of the information received.

If you need more information or are interested in obtaining a quote, you can contact us through this link.

###


Internat reporting channel

---