Whistleblowing: A powerful Lever for Corporate Governance

Anonymous alerts: an asset or a threat?

Directive (EU) 2019/1937 marked a turning point for whistleblowing in Europe. In particular, it requires companies with more than 50 employees to set up secure and confidential internal reporting channels, and prohibits any form of retaliation against whistleblowers. It also provides for support measures for whistleblowers, such as access to free legal advice and effective remedies. These protections go well beyond the current Swiss framework as the prohibition on dismissing a whistleblower does not really exist in Swiss law and, even if a dismissal were to be established as a result of a whistleblowing incident, the compensation provided for in the event of unfair dismissal under article 336 of the Swiss Code of Obligations is relatively modest.²

In Switzerland, there is no legal requirement for private employers to introduce an anonymous internal whistleblowing system. Attempts to codify the law at Federal level, in particular by revising the Code of Obligations, have so far been in vain. However, the Federal Parliament has already taken up the issue: in 2023, it adopted a postulate³ calling for a comparative analysis of foreign systems for protecting whistleblowers, with particular attention paid to the possibility of anonymous reporting. At cantonal level, only the canton of Geneva has taken the step of introducing dedicated legislation. In 2019, it adopted a specific law on the protection of whistleblowers in the public sector⁴ providing, among other things, for a right to anonymous reporting, an external entity for handling reports and measures against reprisals. This initiative, based on the Geneva Constitution (art. 26 para. 3), shows that a formal, balanced and protective framework is possible at institutional level and makes up for deficient national legislation in this area.

Despite the absence of any legal obligation at Federal level, many Swiss companies have voluntarily chosen to adopt whistleblowing channels, some of which are anonymous, demonstrating a strong commitment to transparency and good governance. Under increasing pressure from ESG⁵ standards, ISO⁶ certification and CSR⁷ initiatives, companies are setting up internal systems to encourage anonymous whistleblowing. ISO 37002:2021, a standard specifically devoted to whistleblowing management systems, provides guidelines for receiving, processing and following up whistleblowers’ reports within a framework of trust, impartiality and protection against reprisals.⁸ It complements ISO 37301 on compliance management and ISO 37001 on anti-corruption, which all require the existence of effective internal whistleblowing mechanisms.

In terms of ESG criteria, non-financial rating agencies such as MSCI, Sustainalytics, ISS ESG and Moody’s ESG systematically include the existence, accessibility and independence of internal whistleblowing systems in their assessment of the “Governance” pillar (G). These systems are considered a key indicator of the level of internal control, prevention of corruption risks and management transparency.⁹ A company that does not have a credible whistleblowing system may receive a lower governance score, which may affect its attractiveness to institutional investors. Conversely, the presence of a well-structured whistleblowing channel, particularly if it guarantees anonymity and protection against reprisals, is valued as proof of proactive, responsible governance that complies with international best practice.

These systems enable us not only to meet the growing expectations of internal and external stakeholders, but also to prevent reputational, legal or financial risks. Properly managed, anonymous whistleblowing is a strategic asset: it enables risky behaviour to be detected at an early stage, for the working environment to be made safer and for the confidence of employees and external partners to be strengthened.

That said, anonymity – in the context of whistleblowing – also raises fears. Some believe that authorising anonymous whistleblowing could open the door to abuse and personal vendettas. If the whistleblower is not identified, is there not a risk that he or she will make more reckless or malicious accusations? However, this fear that anonymity could lead to abuse is not demonstrated by the figures: in practice, truly abusive alerts are rare. One study shows that only around 5% of anonymous alerts turn out to be malicious, a proportion comparable to that of non-anonymous alerts.¹⁰ In addition, companies that offer an anonymous channel report an increase in the number and quality of alerts, even though a significant proportion of alerts are closed. In other words, allowing anonymity encourages more employees to speak out without generating a flood of unfounded accusations. This method of reporting is becoming the norm (in 2019, two-thirds of Swiss companies with a whistleblowing system accepted anonymous reports¹¹) and it is popular with employees whenever it is offered. Anonymity can therefore be a positive lever: it encourages those who would otherwise remain silent for fear of reprisals to speak, and it refocuses attention on the facts reported rather than on the identity or motivations of the messenger.

Obviously, anonymity must not become a shield for abuse. Each report must therefore be based on sufficient suspicion, made in good faith and supported by factual evidence. It is therefore essential for the whistleblowing system to be governed by precise internal rules defining the information to be transmitted, the guarantees of confidentiality, and the procedures for rapid and rigorous handling.

Reasonable suspicion: a carefully calibrated threshold

Setting up a credible and operational alert system involves determining the threshold for triggering an alert: at what level of suspicion is a report justified? Should we demand concrete evidence, or recognise the legitimacy of mere suspicions?

The challenge lies in striking a balance. A threshold that is too low risks opening the door to unfounded or malicious whistleblowing, which could compromise the effectiveness of the mechanism and unfairly damage reputations. Conversely, an excessive evidential requirement could dissuade employees acting in good faith from reporting malfunctions that are real, for fear of not being heard or of exposing themselves to reproval.

The generally accepted compromise is that of reasonable suspicion. In other words, the whistleblower must have reasonable grounds to believe that there is an irregularity; if he reports facts in good faith, even if they have not yet been verified, he deserves to be listened to and protected. This formula is enshrined in the Geneva law on the protection of whistleblowers (art. 3 LPLA):

“A whistleblower within the meaning of this law is a member of staff who, in good faith and in order to safeguard the public interest, on the basis of reasonable suspicion, has reported to his or her superiors or to any other competent entity irregularities that he or she has lawfully observed in the performance of his or her duties.”

This requirement is directly inspired by art. 26 para. 3 of the Geneva Constitution, which protects any person who, in good faith and in the public interest, discloses unlawful conduct that has been lawfully observed.

There is a risk of abuse, even if it remains limited in proportion. This is why safeguards need to be put in place when receiving and assessing reports. For example, some companies set up a dedicated internal committee or appoint an independent referee to examine the credibility of allegations before launching an in-depth investigation. Impartiality in the selection of the people authorised to carry out this preliminary examination is crucial: a conflict of interest could lead to a well-founded alert being dismissed (to protect an incriminated colleague or superior), or on the contrary to an employee being unfairly targeted for internal political reasons.¹³ To mitigate this risk, it is often advisable to bring in an external viewpoint at this initial stage. Independent legal counsel or a third-party service provider can be commissioned to objectively assess the merits of the report and advise on the appropriate follow-up. This external analysis reduces the likelihood of mismanagement or inaction in the face of a serious alert, by guaranteeing a neutral and professional assessment of the case submitted.

The requirement of reasonable suspicion also protects the employer against reckless denunciations. Under Swiss law, dismissal on the basis of unverified accusations may be considered unfair if the employer has accused the employee lightly and without serious cause (“suspicion dismissal”¹⁴). In other words, the imprudent manager who acts without having gathered sufficient evidence then exposes herself or himself to legal challenges from the employee concerned. By setting a clear threshold and carrying out the necessary preliminary checks, this kind of backlash can be avoided.

Ultimately, a well-designed whistleblowing system needs to strike a balance between encouraging employees to raise legitimate concerns without fear of reprisal, while ensuring that unfounded or malicious reports are rigorously filtered out. This means putting in place impartial and proportionate assessment procedures to distinguish genuine whistleblowing from potential abuse, while respecting the rights of all concerned.

Finally, it should be noted that an appropriate infrastructure (confidential reporting platform, hotline managed by a third party, etc.) can help to formalise this preliminary review. Many systems allow the whistleblower to provide detailed information, or even documents, and to talk anonymously with the entity in charge of the review. These functions make it easier to gather concrete evidence and enable the external entity to determine whether the reasonable suspicion criterion has been met. By investing in such tools and processes, companies can professionalise the handling of alerts and give themselves the means to better calibrate the necessary threshold to justify an investigation.

The internal investigation: an organisational challenge

Once a report is considered sufficiently credible, the company enters a decisive phase: that of the internal investigation. For a private company, this represents a challenge on several levels, both organisational and legal. On a human level, it often involves managing sensitive situations – questioning employees, possibly laying off the accused employee, or protecting the whistleblower against possible reprisals – with direct repercussions on the social climate and trust within teams. From a legal point of view, the internal investigation is part of a complex framework in which the company must navigate between various obligations. In particular, article 328 of the Swiss Code of Obligations imposes a duty on the employer to protect the privacy of its employees, both in relation to the whistleblower and to the employee concerned. The latter cannot be punished unless the facts have been clarified impartially and rigorously, in accordance with the requirements of proportionality.¹⁵

In cases of sexual harassment, the internal investigation lies at the delicate interface between employment law and criminal law¹⁶. The employer’s duty to protect (art. 328 of the Swiss Code of Obligations) requires it to clarify the facts promptly when it becomes aware of suspicions or accusations. Added to this is the specific obligation arising from the Law on Equality (LEg), in particular articles 4 and 5 para. 3, which require the prevention and effective punishment of sexual harassment in the workplace.¹⁷

The investigator – whether internal or external – does not have the prerogatives of a judicial authority, but must nevertheless take care to gather admissible evidence and conduct interviews in accordance with the rules of the article.¹⁸ When the investigation is conducted by a lawyer specifically mandated for this task, the report may, under certain conditions, benefit from the protection of professional secrecy.¹⁹

Finally, in addition to the human and legal issues at stake, an internal investigation also presents economic challenges: mobilisation of internal resources, interruption of activities, and even reputational risk if the matter were to become widely known. To limit these impacts, rigorous planning, controlled internal communication and, if necessary, the use of qualified external investigators are strongly recommended. Faced with these difficulties, more and more companies are opting to outsource all or part of the most sensitive internal investigations.²⁰ In practice, when a case involves complex, sensitive or serious facts (e.g. financial fraud, accusations of harassment or corruption), it is strongly recommended that the investigation be entrusted to specialised external entities – typically law firms or audit firms. These external experts offer numerous advantages: firstly, they have specialist skills and experience with investigations that the company does not necessarily have in-house. Secondly, they provide a neutral and independent view of the people involved, ensuring that the conclusions are objective. The use of external investigators is becoming more widespread in practice. Furthermore, external specialists are better able to avoid legal pitfalls (e.g. not violating the nemo tenetur principle – no one is obliged to accuse themself – during hearings, respecting the proportionality of investigative measures, etc.). For all these reasons, outsourcing is often considered an optimal solution for the most difficult cases. It does not prevent the company from retaining control of the final decisions, but it relieves it of the operational and technical burden of the investigation, while guaranteeing greater impartiality when the facts are sensitive. If the investigation is carried out internally, it must be carried out by people who are independent and unconnected to the protagonists. This is not always easy to ensure, which is why the choice of using external specialists is often of strategic importance.

Best practice for the private sector

In order to make whistleblowing a real lever for positive governance, it would be beneficial for Swiss companies to adopt several tried and tested best practices. These include:

• Drawing up a clear internal policy: put in place an internal rule or directive on what to do in the event of a whistleblowing incident (reporting channels available, guarantees offered to the whistleblower, stages of the investigation, etc.). Ideally, these directives form an integral part of the personnel regulations or the employment contract, so that all employees are aware of them. This formalisation provides a frame of reference and avoids improvisation when the time comes.
• Staff training and awareness-raising: a hotline or e-mail alert system is not enough; its operation and purpose still need to be explained. It is recommended that training courses be organised (particularly for HR and managers) on detecting reprehensible behaviour and the alert procedure.²¹ At the same time, all staff should be made aware of the existence of the system, emphasising its positive role. Dispelling the fear of a “whistleblowing culture” is crucial: good communication about the rights and obligations of whistleblowers is the best weapon for preventing abuse and removing misunderstandings. Employees need to understand that whistleblowing is a collective protective tool and a safeguard, not a means of settling scores.
• Involvement of governance bodies: the Board of Directors and its committees (in particular the audit committee, if there is one) should be involved in the whistleblowing system. The Board of Directors could, for example, define a whistleblowing policy at group level, and receive a periodic (anonymised) report on the alerts received and how they have been dealt with. Such monitoring at the highest level ensures that the subject is taken seriously and integrated into the company’s governance. In addition, in the event of an alert directly concerning management, the Board of Directors must be in a position to intervene or initiate an independent investigation.
• Independent and confidential handling: whether in-house or outsourced, the mechanism for handling alerts must offer guarantees of impartiality. If the company provides for internal channels, it is advisable to designate a separate unit (e.g. attached to internal audit or compliance) rather than HR, in order to avoid conflicts of interest. In all cases, the confidentiality of reports and investigations must be strictly preserved, to protect both the whistleblower and the person implicated until clarification.
• Working with experienced external partners: entrusting the technical management (and even, where appropriate, the initial review) to a trusted third party can increase whistleblowers’ sense of security. These external partners provide know-how, objectivity and technological tools, avoiding the company having to “reinvent the wheel” while guaranteeing a high level of reliability.

By combining these good practices – a formalised policy, training, commitment from top management, independence and outsourcing of the process – a company creates an environment conducive to constructive whistleblowing. The message sent is clear: “We encourage our employees to speak out about irregularities in complete safety if the request is made in good faith, and we undertake to treat their reports seriously and fairly”. This proactive approach transforms whistleblowing from a simple compliance obligation into a genuine corporate governance management tool.

Conclusion

Long viewed with suspicion, whistleblowing is gradually emerging as a powerful governance tool when used responsibly. Rather than simply being subjected to it, it is in the interests of companies to integrate it into their internal control systems and ethical culture. If properly managed, whistleblowing can help to detect problems at an early stage that could otherwise tarnish a company’s image, leading to talent departures and recruitment difficulties. It provides managers with an invaluable channel for highlighting any irregularities in the organisation, correcting what needs to be corrected and, in some cases, preventing any escalation, particularly harmful publicity for the company (before the authorities or the public get involved). In addition, an effective and credible whistleblowing system meets the growing expectations of regulators, investors and the public in terms of transparency.

In this respect, corporate culture is a determining factor in the success of any whistleblowing mechanism. It is not enough to create a formal channel: it must also be part of a sincere desire to treat reported situations seriously and to provide concrete responses. An organisation that demonstrates a genuine commitment to resolving irregularities helps to establish a lasting climate of trust with its employees. This climate promotes not only risk prevention, but also the well-being of employees, who perceive whistleblowing as a tool for collective protection, and not as a threat.

Furthermore, offering people in distress the opportunity to be heard by an external entity, independent of the hierarchy, is an effective way of calming situations of tension or conflict. This helps to defuse internal crises, reduce psychosocial risks and show that the company takes its employees’ views seriously.

When these conditions are in place, whistleblowing proves to be one of the most effective tools for combating abuses that are otherwise difficult to detect (such as fraud or corruption). It becomes an ally of responsible management, complementing audits and other internal controls.

In conclusion, far from being a threat, a well-orchestrated internal alert is an asset for the modern company. It is up to company decision-makers to make whistleblowing a proactive lever of governance, by creating the conditions for its success: a solid framework, an open culture and impartial management.

¹ Whistleblowing is the loyal reporting of irregularities or offences committed in a company or organisation, with a view to protecting the general interest, by an employee or a person with knowledge of the facts (ATF 127 III 310).
² BYDZOVSKY/ADJABI, Contours et enjeux des enquêtes internes en entreprise, in Revue de l’avocat, 2025, p. 123-124.
³ Partial revision of the Code of Obligations (Protection in the event of reporting of reprehensible acts by the employee), Explanatory report of the Federal Council on the preliminary draft, p. 6; Question by Laurence Fehlmann Rielle of December 14, 2022, “Protection of whistleblowers. Switzerland under fire from criticism” (https://www.parlament.ch/fr/ratsbetrieb/suche-curia-vista/geschaeft?AffairId=20224384).
⁴ Law on the protection of whistleblowers within the State (Loi sur la protection des lanceurs d’alerte au sein de l’État), dated 29 January 2021.
⁵ This abbreviation refers to the three areas – Environment (E), Social (S) and Governance (G) – used to assess the sustainability and ethical impact of a company or investment. These criteria are used in particular to guide sustainable investment decisions and to increase the transparency of companies in terms of sustainability.
⁶ ISO (International Organization for Standardization) is an independent, non-governmental international organization that develops voluntary, consensus-based and globally recognized standards to ensure the quality, safety and efficiency of products, services and systems.
⁷ Corporate Social Responsibility (CSR) refers to the voluntary integration by companies of social, environmental and ethical concerns in their commercial activities and in their interactions with stakeholders.
⁸ ISO 37002:2021, International Organization for Standardization.
⁹ MSCI ESG Ratings Methodology 2023; Sustainalytics ESG Risk Ratings Methodology 2023.
¹⁰ Transparency Switzerland, Prévention et lutte contre la corruption dans les PME, Gestion d’alertes (« whistleblowing »), 2021, p. 5 and 34.
¹¹ NEUHAUS, Haute école Arc, istleblowing et signalements anonymes (https://www.he-arc.ch/chroniques-ilce/whistleblowing-et-signalements-anonymes/).
¹² Transparency Switzerland, Prévention et lutte contre la corruption dans les PME, Gestion d’alertes (« whistleblowing »), 2021, p. 33.
¹³ Report of the legislative committee responsible for studying PL 12661-A, PL 12076-A and R 838-A, République et canton de Genève, 27 August 2019.
¹⁴ TF, judgment 4A_485/2016, c. 2.2.2; TF, judgment 4A_694/2015, c. 2.2-2.3 and 4-5 (wrongful dismissal of a care assistant in a nursing home on the grounds of theft, based solely on the statements of the resident who reported that CHF 9 was missing from his wallet, without carrying out any further checks); TF, 4A_99/2012, c. 2.2.1 (wrongful dismissal of care assistants lightly accused of mistreating the residents of a medical-social establishment); ATF 130 III 699, c. 5.2; TF, arrêt 4C.174/2004, c. 2.3.1.
¹⁵ BYDZOVSKY/ADJABI, Contours et enjeux des enquêtes internes en entreprise, in Revue de l’avocat, 2025, p. 123-131.
¹⁶ POGLIA/JAKUBOWSKI, Les enquêtes internes pour harcèlement sexuel à l’ère (post ?)-MeToo, in Forumpoenale, 3/2024, p. 187-193.
¹⁷ ATF 126 III 395.
¹⁸ BYDZOVSKY/ADJABI, Contours et enjeux des enquêtes internes en entreprise, in Revue de l’avocat, 2025, p. 123-131.
¹⁹ TF, judgment 1B_85/2016, c. 6.5.
²⁰ Transparency Switzerland, Prévention et lutte contre la corruption dans les PME, Gestion d’alertes (« whistleblowing »), 2021, p. 30-34.
²¹ Transparency Switzerland, Prévention et lutte contre la corruption dans les PME, Gestion d’alertes (« whistleblowing »), 2021, p. 20.