Anonymous reporting at a university: irregularities in a grant
At a university the community is small, formal and informal hierarchies overlap, and the person who knows about an irregularity is often professionally dependent, for years, on the person it concerns. Anonymity here is not a convenience. Without it there will be no report.
The situation
A doctoral student notices grant costs being booked against equipment nobody on the team has seen. The project lead is also the supervisor of his thesis. The field is small and everyone knows who works with whom.
How it works
Anonymity here is not a convenience but the precondition for reporting at all. Revealing an identity requires the consent of two authorised people, so nobody can look it up alone, even out of curiosity. The reporter follows the case without an account or a login.
- Anonymity
- Audit log
- Legal compliance
In this scenario 4
What the Act says in this situation
Irregularities in a grant financed from public or EU funds are a breach concerning the financial interests of the State Treasury or the European Union (Article 3(1)), and where purchases are made from the grant, public procurement as well. A public university is a legal entity covered by the Act regardless of any doubts about the threshold; it employs hundreds of people.
A doctoral student is a whistleblower: the Act lists trainees, interns and persons performing work on a basis other than an employment relationship, and a doctoral student at a doctoral school receiving a scholarship and carrying out tasks in a project falls within that definition. A person assisting with the report is also protected, for example a colleague from the team who supplied the documents.
Retaliation in academia is rarely dismissal. It is a negative reference, being left off a publication, a review that drags on. The catalogue of retaliation in Article 12 covers a negative performance assessment, being passed over for training and actions that make it harder to find work in a given sector.
What to watch when implementing
- Anonymity written into the procedure. The university should decide expressly that it accepts anonymous reports (Article 25(2)(1)); otherwise an anonymous report does not start the deadlines, and a doctoral student will not report under their own name.
- Separation of identity from content. If the whistleblower gave their identity, it should be available only on a request approved by a second authorised person. In a small community "a peek out of curiosity" is a real risk, and disclosing identity contrary to the law is an offence under Article 56.
- A case handler from outside the faculty. Impartiality requires that a grant case be handled by someone outside the unit in which the grant is carried out, for example internal audit or the academic ombudsman.
- Access without a university account and after it expires. A doctoral student who has finished the doctoral school and a former employee are still whistleblowers. The reporting page must be public.
Features that make the difference
- Report without an account, case number and PIN, no IP stored, no tracking (confidentiality and identity protection).
- Identity disclosure only with a second person's approval and a register of identity disclosure requests: who requested, for what purpose, who approved.
- Four-eyes principle for weakening protection: nobody can switch it off alone.
- Tamper-proof audit log: in a dispute over retaliation the university can show that the supervisor had no access to the case (compliance).
- Multiple forms and languages: a separate form for doctoral students and for foreign staff.
Frequently asked questions
Is a doctoral student on a scholarship a whistleblower?
Yes. The definition in Article 4 covers persons performing work on a basis other than an employment relationship as well as trainees and interns, and the information about a breach must be obtained in a work-related context. Carrying out tasks in a grant project meets that condition.
Does a university have to accept anonymous reports?
It does not have to, but it may, and it records the decision in the procedure. If it does not accept them, an anonymous report does not start the statutory deadlines, though it is still worth examining. A whistleblower whose identity is established later is protected against retaliation in the same way.
More in the article Anonymous reports: do you have to accept them.
From the knowledge base
- Anonymous reports: do you have to accept them and how to do it safely The Act permits but does not require anonymous reports. What each choice means, how to protect identity when given, and anonymity versus confidentiality.
- Retaliation and whistleblower protection: what an employer must not do The Act's list of retaliatory actions, protection conditions, reversed burden of proof, compensation of at least the average wage, facilitator protection.
A procedure is a document. A channel is the system that carries it out.
sygnadesk counts the deadlines, keeps the register and protects the reporter’s identity the way the knowledge base describes. See how it would look in your organisation.