Make your policy clear. A written statement on whistleblowing should explain why reporting wrongdoing is important and how you will respond when concerns are raised. It should also reassure potential whistleblowers about how their disclosure will be handled. Samantha Mangwana, employment partner at solicitors Russell Jones & Walker, which represents whistleblowers, says: 'A well-drafted policy can be useful in persuading potential whistleblowers that they can make a disclosure in confidence.'
Draw the lines. 'Make clear the relationship your whistleblowing procedure has to other procedures such as grievance,' says David Lewis, professor of employment law at Middlesex University and convenor of the International Whistleblowing Research Network. The Public Interest Disclosure Act specifies categories of wrongdoing for which a whistleblower is protected - criminal, regulatory, health and safety and environmental malpractice. Poor management does not count.
Be flexible. 'Each case is different,' says Cathy James, chief executive of Public Concern at Work. 'You may want to refer to your fraud team or the police, or bring in your HR, audit or legal team to investigate.' A BSI code of practice can be downloaded from the PCAW website.
Offer a back-stop. Ideally, people should contact their line manager to start with. 'But if they are uncomfortable with that there should be a mechanism to bypass their immediate boss,' says James. Name more senior managers and even a regulator who your people can approach.
Encourage, rather than compel. 'The NHS constitution contains an "expectation" that people will report wrongdoing,' says Lewis. 'The problem with making it a duty is that people may report trivial matters.'
Internal is best. Outsourcing your whistleblowers' hotline and procedure can be time-wasting and a diversion. But an external advice line can be useful.
Avoid anonymity. 'If the concern is raised anonymously, you may not be able to get any more information and you can't give reassurances or protect somebody,' says James. 'It can cause problems when assumptions are made about who has raised concerns.'
Train people. 'Managers need to understand about confidentiality, providing feedback, when to escalate a concern and how to manage expectations,' James adds.
Tell the good stories. 'Publicise successful resolutions of concerns,' says Mangwana. 'If there is evidence this process resolves problems, people will think it is worth doing.'
Do say: 'Those who report any matters of serious wrongdoing will not be victimised.'
Don't say: 'Snitch.'