Supporting whistleblowers at work is part of your integrity system

A speak-up channel can be easy to launch. The harder work starts after someone uses it.

Support is often treated as a people issue that sits beside investigations. In practice, it shapes whether people report early, stay engaged, and share usable detail. When support is weak, integrity risk becomes harder to manage because you lose signal quality. That matters for fraud, conflicts of interest, procurement misconduct, safety breaches, and other issues that rarely arrive as neat case files.

Kirsten Trott, Co-founder of Veresure, captured the reality in a line that has operational consequences. When someone speaks up, “they’ve had to be very brave,” and when they “don’t hear anything… it’s terrible.”

Silence is a support failure that spreads

Many organisations go quiet early because they don’t want to overpromise or risk compromising an investigation. The whistleblower often reads silence differently. They start to assume the report will be minimised, or that they have put themselves at risk for nothing. Once that belief sets in, engagement drops and evidence quality tends to follow.

This dynamic shows up in research as well. Studies on whistleblowing behaviour consistently find people weigh likely outcomes and organisational response when deciding whether to report. If they expect inaction or harm, they hold back.

A practical prompt helps here. When someone raises a concern, can you describe what they will hear from you in the first week, and when they will hear from you again. If your answer is unclear, the experience is likely inconsistent.

Victimisation often looks like routine management

Retaliation is easy to spot when it is overt. The harder cases involve actions that look normal in isolation, a sudden shift in performance management, exclusion from meetings, loss of opportunity, or being moved aside “for business reasons.” That is one reason victimisation can be hard to evidence later, even when it is real.

The risk is also common enough to influence behaviour. Academic literature has reported retaliation rates in public sector whistleblowing across Australia, Norway, and the United States ranging from 4% to 22%.

Those numbers don’t need to be perfect to matter. People don’t require certainty that retaliation will happen. They often act on the chance that it might.

Risk assessment should stay live as the case evolves

Some organisations run a risk assessment once and treat it as done. In the session, Kirsten emphasises that exposure varies by context, including seniority of the subject, workplace dynamics, isolation, and vested interests.

That view fits how cases actually move. As more people learn about a report, as scope shifts, or as rumours start, exposure can rise quickly. A live risk assessment lets you adjust support in real time, with clearer check-ins, better monitoring for victimisation, and better decisions on who should handle which parts of the process.

One simple operational habit is to revisit risk at set points, after intake, after the first substantive follow-up, after any scope change, and before closure. You can keep it light. The value comes from discipline and consistency.

Legal protections help, but they do not run your programme

Legal regimes vary, and protections do not remove workplace reality. The EU Whistleblower Protection Directive includes confidentiality requirements and protections against retaliation, and it can shift the burden of proof in certain proceedings.

Even with strong laws, organisations still need operating mechanisms that work day to day. People want to know who will check in, how their confidentiality will be handled, what happens if they face subtle reprisal, and how the organisation will respond when a report involves seniority or sensitive topics.

Technology improves support because it improves follow-up

Kirsten makes a practical point about anonymity. Anonymous reporting used to limit follow-up, which often meant thin information and stalled progress. Two-way anonymous communication changes this because you can ask clarifying questions while the whistleblower stays protected.

“You can ask follow-up questions and the whistleblower can remain anonymous.” says Kirsten

This matters because integrity risk management depends on usable detail. Better follow-up tends to produce better facts, and better facts make decision-making more defensible. It also helps organisations demonstrate duty of care through behaviour, which is increasingly what stakeholders judge.

External NFPs exist because internal safety is uneven

People seek independent advice when they don’t feel safe testing concerns internally, or when they need help thinking through options. In the UK, Protect provides confidential whistleblowing advice and supports organisations with their arrangements.

For employers, the lesson is not about competing with external support. It’s about building internal handling that is consistent enough that employees do not feel forced to go outside first.

A short self-check for leaders

If you want to pressure-test your programme, focus on what your process teaches employees about speaking up.

• What does a whistleblower experience in the first week, in practice.
• Who owns the support plan, separate from investigation steps.
• How do you monitor for victimisation without relying on the whistleblower taking more risk.
• If the subject is senior, what stays consistent in your handling.
• Can you follow up safely with anonymous reporters to improve fact quality.

If these questions feel hard to answer, that itself is a signal. It points to where your integrity system may rely on good intentions rather than a process you can run consistently.

Listen to the full conversation

If you want the full discussion with David Morgan and Kirsten Trott, including practical examples on support, victimisation risk, legal considerations, and the role of technology and external NFPs, listen to the episode: [link]

{{wb-webinar-support-for-whistleblowers-inside-the-workplace="/components"}}