Internal whistleblowing channels: what your SME must have in place

Not just for large companies

The duty to operate an internal reporting system applies to companies above a given headcount, and also to certain sectors regardless of how many staff they employ. Many Barcelona SMEs that assumed they were outside its scope find that they are in fact covered.

Beyond the legal obligation, a well-run channel has a practical benefit: problems surface internally before they become a labour inspection complaint or court proceedings.

What a proper channel requires

An email inbox is not enough. The system must guarantee the informant's confidentiality, allow anonymous reports, acknowledge receipt within the set period and give a reasoned response within a reasonable maximum timeframe.

You also need to appoint a person responsible for the system, have the governing body approve a management procedure, and tell staff clearly and accessibly how to use it.

Data protection within the channel deserves specific attention: information received should be kept only as long as strictly necessary, with access restricted to authorised people.

The risk of a token implementation

A channel that exists on paper but has no procedure or follow-up creates a false sense of security. In a dispute it does not evidence diligence, and it can worsen the company's position if it emerges that a report was received and never processed.

The opposite extreme is worth avoiding too: procedures so complex that nobody uses them. Proportionality to the size and activity of the business is the criterion that works best.

How we approach it

At AAMC we support the full implementation: assessing whether the obligation applies, drafting the procedure, appointing the responsible person, providing basic staff training and supporting the handling of any reports received.

If you are unsure whether your company is covered, tell us about your situation and we will review it with you, with no obligation.