Reporting channels: written, oral, in a meeting and for people without a computer

What the Act requires

The methods of making internal reports are set out in the procedure, but the Polish Act of 14 June 2024 on the Protection of Whistleblowers (Journal of Laws 2024, item 928) sets a minimum: a report may be made orally or in writing (Article 26(1)). An oral report may be made by telephone or through other voice communication systems and, at the whistleblower's request, at a face-to-face meeting arranged within 14 days of receiving the request (Article 26(2) and (4)). A written report may be made on paper or electronically.

An oral report must be documented in the manner indicated in the Act: by recording the conversation, with the whistleblower's consent, or by a complete and accurate transcript or minutes which the whistleblower can check, correct and approve (Article 26(3) and (5)). A phone call to compliance without minutes does not meet the requirement.

In addition, the channel must be accessible to everyone who may be a whistleblower, which includes candidates, former employees, subcontractors and shareholders. This rules out solutions available only from the internal network or after logging in with a company account.

Three groups the channel design forgets

Employees without a computer workstation. Drivers, warehouse staff, production workers, cleaning staff and security. They have private phones, no company email, and the only computer at the depot sits in the supervisor's room. The channel for them is a page at an address that can be remembered and opened on a phone, plus a telephone number with a defined method of documentation. A QR code on the notice board works better than a link on an intranet they cannot access.

People outside the organisation. A subcontractor who sees an irregularity on a construction site, a former employee, a candidate. They have no account of any kind. The reporter page must be public, and the procedure announced so that it can be found: a link in the footer of the company website, in subcontractor agreements and in the information for candidates required by Article 24(7).

People who cannot write in peace. An employee who shares an office with the person concerned by the report will not write the report on a company computer. A form that saves a draft, can be returned to after a break and does not have to be completed in one sitting handles this case better than a survey with a time limit.

The electronic channel: what it should have

1. The client's own domain, not the vendor's address. The whistleblower trusts the company's site, not an unfamiliar tool; besides, an address in the organisation's domain is part of the announced procedure.
2. No IP address logging, no tracking scripts, no external resources. Otherwise an anonymous channel is not anonymous, and a confidential one leaves traces with third parties.
3. A case number and access code instead of an account. The whistleblower returns to the conversation without giving an email address; the acknowledgement of receipt and the feedback wait in the case.
4. Attachments with metadata removed. A photo from a phone contains the device model and often GPS coordinates; a Word document contains the author's name. Without automatic cleaning, the whistleblower reveals themselves unknowingly.
5. Accessibility. A form that works with a keyboard and a screen reader, with adequate contrast and adjustable text size, and no time limits. This is a WCAG 2.2 AA requirement and at the same time a condition for the channel to work for every employee.
6. Multiple forms and languages. A branch, a group company or a group of employees from another country should have a form in their own language, with permissions set for their own case handlers.

Telephone and SMS

A telephone report is an oral report: it requires consent to recording or minutes approved by the whistleblower. A good solution is to indicate in the procedure a number on which calls are recorded after prior notice, with a note that the reporter may instead ask for a meeting.

An SMS is a written report in electronic form. The message reaches the channel like a report from the form and receives a case number. For a driver who will not open a page behind the wheel, this is often the only route they will actually use. Bear in mind that the sender's telephone number identifies the whistleblower; the procedure should say so explicitly.

Email: permitted, but with limitations

An email address as a channel is permissible, but by itself it records the sender's identity, does not acknowledge receipt, does not count deadlines and does not keep a register. If email remains one of the channels, reports received through it should be transferred to the register immediately on receipt, with the date of receipt, and the mailbox should be accessible only to authorised persons. In practice, a shared intake address from which messages automatically enter the system as cases solves both problems at once.

A meeting within 14 days

A request for a meeting may arrive through any channel, including anonymously with a contact method provided. The organisation has 14 days to arrange the meeting, and minutes of it are drawn up, which the whistleblower approves. The venue and the person conducting it should be chosen so that the meeting does not reveal the whistleblower to those around them: a conversation in the office of the branch director where the person concerned by the report works defeats the purpose of the entire procedure.

How this works in sygnadesk

The client runs a reporter page under its own domain and brand, with any number of forms and languages. Reports from the form, email and SMS go into a single register as cases with a case number and PIN, and the conversation with the whistleblower takes place within the case, with no address and no account. Oral reports and meetings are recorded manually by the case handler in the same case, with the minutes as an attachment, so deadlines and the audit log cover all channels, not only the electronic one.