You’ve heard that “putting an internal reporting system in place has become an obligation,” but exactly what—and how far—do you need to prepare? This is a question we often hear from those responsible. This article organizes what companies are required to do under the revised Whistleblower Protection Act, and explains the requirements a reporting channel must meet in practice and the common shortcomings.
This article organizes the outline of the system in an accessible way. For handling individual matters, please also refer to the Consumer Affairs Agency’s guidelines and commentary and, as needed, confirm with a professional.
What was made mandatory
Under the revised Whistleblower Protection Act, businesses that regularly employ more than 300 workers are required to put in place the systems necessary to respond appropriately to internal reports. For businesses with 300 or fewer, it is treated as a duty of effort.
The “systems” here mean more than simply setting up somewhere to consult. They rest on three main pillars.
- Establishing a channel — Designate a channel to receive reports and make employees aware of it. 2. Designating personnel engaged in whistleblowing response — Designate the personnel (the engaged staff) who receive reports, investigate, and take the measures necessary for correction. 3. Confidentiality and structural measures — Keep confidential information that could identify a whistleblower, prevent detrimental treatment of whistleblowers, and take other measures to make the system function effectively.
A mechanism that protects whistleblowers is the premise
The foundation of the Whistleblower Protection Act is the prohibition of dismissal and other detrimental treatment on the grounds of having made a report. As long as a whistleblower carries the fear “won’t I be retaliated against?”, reports won’t come up in the first place. Whether the system functions hinges on whether whistleblowers can raise their voices with peace of mind.
For that reason, in practice the following two points are especially important.
- Anonymity — Being able to report without revealing one’s identity, and to continue the subsequent exchanges anonymously.
- Confidentiality — Information that could identify a whistleblower not leaking beyond the minimum necessary staff involved in the response.
Four requirements a channel must meet in practice
Just “having a channel” sometimes doesn’t reach the level the system requires. It becomes a “system” only when it holds together including operation. Organizing the requirements a channel must meet in practice comes down to these four points.
1. Guaranteeing anonymity
With email or phone channels, the name and contact details can reach the recipient at the moment of the report, making anonymity hard to maintain. The ideal is a mechanism where a whistleblower can report without revealing their identity, and moreover conduct the subsequent follow-up interviews and progress updates two-way while staying anonymous.
2. Independence of intake
There are also cases where the subject of a report could be the very staff member receiving reports. In this case, separating the intake staff from the subject of the report and being able to limit, per case, who can view it is required. It’s more robust if you can combine an independent intake such as an attorney or an external channel.
3. Audit trail of the response
It’s also important that records remain that can later show you “responded appropriately.” If it’s recorded who viewed and handled a report and when, and you can detect reports that have gone unaddressed for a long time, you can prevent oversights. Having records also builds trust for audits and inquiries from outside.
4. Multilingual support
As foreign employment spreads against a backdrop of labor shortages, without a way to receive reports from employees whose native language isn’t Japanese, the gateway for reports effectively narrows. Being able to use it in a language the whistleblower selects widens that gateway.
Common shortcomings
- The channel was set up, but employees aren’t sufficiently aware of it — A channel no one knows exists won’t be used.
- You can report anonymously, but the subsequent exchanges reveal your identity — You need a design that maintains anonymity through the two-way exchanges.
- Records of the response are scattered across individual mailboxes — They don’t remain as an audit trail and are lost when staff transfer or leave.
- The intake staff is fixed, and independence can’t be maintained when they become the subject — Separating the assignee per case is required.
Meeting the system requirements with a mechanism
Meeting these requirements continually through email or spreadsheet operations is a heavy burden and tends to depend on individuals. Using an internal reporting system lets you meet, as a standard mechanism, the elements of anonymous intake, anonymous exchanges, access control, an audit trail, and multilingual support all together.
The internal reporting system SHANNON provides, SealGate, complies with the Whistleblower Protection Act and combines in one place everything from anonymous report intake, anonymous exchanges with whistleblowers, access control and independence for intake staff, an audit trail and unaddressed-report alerts, to multilingual support. Because it comes with standard report categories and an intake flow, you can open a channel with minimal setup, and our development company supports you from rollout to raising employee awareness and establishing operations.