Whistleblowing system for a manufacturer: corruption in procurement

What the Act says in this situation

Corruption and public procurement open the catalogue of breaches in Article 3(1) of the Whistleblower Protection Act, and in a private company operating on a regulated market the rules of competition and the financial interests of public contracting parties come on top. An employee of the purchasing department is a whistleblower within the meaning of Article 4 regardless of the form of engagement, and their report starts the clock: 7 days for acknowledgement of receipt and 3 months for feedback.

A manufacturer with 50 or more people (counting contractors and B2B engagements as at 1 January or 1 July) must have a procedure whether or not it has ever received a report. If it handles public procurement as a contractor, the channel is also part of the due diligence that contracting authorities ask about.

What to watch when implementing

1. A case handler from outside the purchasing department. The Act requires impartiality of the unit taking follow-up actions. A report about a supplier cannot land with the director who selected that supplier.
2. Attachments without metadata. Documents from the purchasing department carry the author and revision history in their metadata. A photo of a bid taken with a phone carries the device model and often the location. Without automatic cleaning, the whistleblower gives themselves away with the first file.
3. Access for production staff. The night shift has no company email. A reporting page under the company's address, opened from a private phone, with a QR code next to the notice board.
4. The "internal regulations" category. A conflict of interest in selecting a supplier is not always corruption in the criminal-law sense. A procedure extended to cover the code of ethics will accept such a report without a dispute over classification.

Features that make the difference

• Anonymous report with a case number and PIN: the whistleblower returns to the conversation and answers the case handler's questions without giving their identity (confidentiality and identity protection).
• Metadata removal from attachments: EXIF, document author and revision history disappear before the file is saved.
• Permissions per form and per case: the purchasing department does not see that the case exists (compliance and permissions).
• Deadlines counted by the system: acknowledgement within 7 days, escalation before the 3 months run out, no closing a case without feedback (case handling).
• Audit log: the board and the auditor see who had access to the case and when, which matters once the case reaches a prosecutor.

Frequently asked questions

Is a B2B contractor a whistleblower?

Yes. The catalogue in Article 4 covers persons performing work on a basis other than an employment relationship, including sole traders. A B2B contractor who reports a rigged tender is protected in the same way as a salaried employee, and the company cannot terminate their contract or withhold payment on that account.

What if the report turns out to be unfounded?

The whistleblower is protected if they had reasonable grounds to believe the information was true. A report that, after verification, does not confirm a breach is closed with feedback giving the reasons, and the whistleblower keeps their protection. Liability rests solely with a person who knowingly reports something untrue.

More on who the Act covers in the article The Polish Whistleblower Protection Act: who it applies to.