Whistleblowing: managing reports in the company

An employee discovers an inflated invoice, an undisclosed conflict of interest or a security breach. What do they do? If they have no clear and protected channel to report it, the answer is often: nothing. Or they turn to the outside, to a newspaper or an authority. Whistleblowing exists precisely to bring these problems to light before they turn into damage, inside the company and not outside.

What Swiss law says

In Switzerland there is currently no comprehensive law on whistleblowing for the private sector. The attempt to introduce a general set of rules into the Code of Obligations was rejected by Parliament in 2020. This means that, unlike the European Union, which adopted a specific directive, the Swiss company has no generalised legal obligation to establish a reporting channel.

Note, however: the absence of a general obligation does not mean a regulatory vacuum. The following remain relevant:

• The employee’s duty of loyalty (art. 321a CO): the employee must safeguard the employer’s interests, and in principle report internally first, then possibly to the authorities.
• Protection against wrongful dismissal (art. 336 CO): dismissing someone who reports a violation in good faith may constitute a wrongful dismissal, with compensation of up to six months’ salary.
• Sector-specific regulations: banks, insurers and financial intermediaries are subject to FINMA requirements that in effect impose internal reporting channels.

Anyone dealing with clients or data from the European Union must also consider the European directive, which may apply to groups with an EU presence.

Why it is worthwhile to have a channel anyway

Even without an obligation, adopting a whistleblowing system is a smart governance choice. The reasons are concrete:

• Early emergence of problems: much internal fraud is uncovered thanks to reports, not audits. An effective channel reduces losses.
• Reduction of reputational risk: better to manage a critical issue internally than to see it explode in the press.
• Sign of a healthy culture: it shows employees, clients and partners that the company takes integrity seriously.

How to set up the channel in practice

A credible system is not a forgotten email inbox. It needs a minimal but solid structure.

1. Define who receives the reports

The collection point must be independent of those who might be involved. It can be a dedicated member of management, an internal body or a trusted external party. In small structures, relying on an external partner guarantees impartiality.

2. Ensure confidentiality and, if possible, anonymity

The whistleblower’s identity must be protected. Many reports never arrive out of fear of retaliation. Providing the possibility of reporting anonymously, or at least with guaranteed confidentiality, increases trust.

3. Formalise the procedure

An internal set of rules is needed, establishing:

• What can be reported (violations of law, of the code of ethics, fraud, security risks).
• How to submit the report and to whom.
• Response times and verification stages.
• The explicit prohibition of retaliation.

4. Handle the data correctly

Reports often contain sensitive personal data. Their handling must comply with the Swiss data protection law: limited access, proportionate retention, information to the persons involved within the limits allowed by the investigation.

The mistakes to avoid

• The showcase channel: announcing it without genuinely managing it is worse than not having it. Every ignored report destroys trust.
• Disguised retaliation: transfers, demotions or negative evaluations after a report expose the company to disputes over wrongful dismissal or treatment.
• Confusing reporting with public denunciation: the system must encourage the internal route. If it works, the employee has no reason to turn straight to the outside.

Whistleblowing and the code of ethics

The reporting channel does not live in isolation. It works when it rests on a clear code of ethics that defines what the company considers unacceptable. Without that reference, the whistleblower does not even know what is worth reporting. The two instruments reinforce each other.

Our approach

At SIH ONE we help companies build whistleblowing systems proportionate to their size: from the internal set of rules to the independent collection channel, through to compliant data handling and integration with existing governance. The goal is not bureaucracy, but a tool that genuinely works when it is needed.

Do you want to set up a solid and compliant reporting channel? Let’s talk it over.