During the Probuddy Whistleblowing period, which offers your employees a professional and anonymous guarantee, you can make use of our guide to establish the most appropriate process, enabling more accurate and professional findings and the correct identification of areas within your company that are open to improvement. This guide has been prepared based on whistleblowing channels developed to be sector-neutral and in full compliance with Probuddy’s principle of technical anonymity.
Introduction: Taking a secure and consistent approach to the process
Define a report in plain language as an organisational notification that can trigger an assessment of matters such as suspected ethical breaches, policy violations or misconduct.
State that this guide supports both employees in preparing reports and compliance teams in guiding the process in a clear and understandable manner.
Manage reader expectations: These five steps constitute a general framework; the specific scope, responsibilities, communication methods and record-keeping rules are determined by the organisation’s current policy.
Add a transparency note: As the official product documentation for Probuddy could not be verified in this research, no assumptions are made regarding the platform’s specific technical or operational features.
Transition sentence: Clarifying the correct channel and scope first facilitates the smooth execution of the subsequent four steps.
Step 1: Confirm the scope and the authorised reporting channel
Objective: To clarify whether the matter falls within the scope of the code of ethics and which internal channel should be used.
Points for employees:
Check the scope in the current code of ethics, whistleblowing policy, employee handbook or compliance notices.
Identify any separate organisational procedures to be followed in the event of an urgent security risk, a personal data incident or other specific circumstances.
Define the matter in terms of an observable incident, rather than rumours or personal assessments.
Points for compliance teams:
Recommend that the scope statement and authorised channel information are kept accessible, up to date and clear.
Security checkpoint: “Confirm which notification channels are configured in your Probuddy account/setup, who has access rights, and which event types are routed.”
Claim to avoid: Do not state that Probuddy offers web, telephone, email, mobile or multi-channel notifications.
Step 2: Carefully prepare the facts, timeline and necessary documents
Objective: To establish a verifiable reporting framework that facilitates the investigation and contains no unnecessary information.
Recommended preparation points:
What the incident was, when and where it occurred.
Known individuals/roles involved and the incident’s potential impact on business processes.
Clearly distinguishing between direct observation, documentation or records, and personal interpretation.
Where applicable, ensuring the source and date information of any documents, screenshots or communication records is preserved.
Emphasis on data minimisation: Do not include personal data unrelated to the matter, sensitive information or unverified incriminating statements; determine how the document is to be shared in accordance with organisational procedures.
Security checkpoint: “Confirm whether your Probuddy account or setup has any additional uploads, document type limits, retention periods or personal data routing.”
Claim to avoid: Do not state that the platform accepts files, uses encryption or possesses specific data protection features.
Step 3: Communicate the report via a transparent, impartial and authorised channel
Objective: To convey the information to the correct recipient in a structured manner that supports the assessment.
Recommended reporting process:
Begin with a brief summary of the subject.
Explain the events in chronological order, based on known facts.
State the available evidence and, if applicable, the reason for urgency under separate headings.
Rather than making definitive statements about unknown points, label them as ‘unknown’ or ‘requires confirmation’.
Writing standard recommendation for the compliance team: The notification form or guidance text should encourage the distinction between facts, impacts and evidence.
Safety check: “Confirm the steps for submitting a report, the mandatory fields and how the submission confirmation is displayed in your Probuddy account/setup.”
Claims to avoid: Do not guarantee anonymous submission, concealed identity, automatic approval or uninterrupted access.
Step 4: Maintain follow-up communication using verified methods and adhering to record-keeping procedures
Objective: To ensure that requests for further information are answered reliably and that process communication remains traceable.
Recommendations for the person making the report:
If provided by the organisation, securely retain the report reference and any relevant correspondence.
Respond to requests for further information only via the communication method verified by the organisation.
Distinguish new developments from the previous report; avoid repetitive messages that could give rise to speculation or create pressure.
Recommendations for the compliance team:
Review whether communication responsibilities, access restrictions and the approach to status sharing are defined in the organisation’s procedures.
Security checkpoint: “Confirm whether your Probuddy account/setup includes a tracking reference, secure messaging, a status screen or the option for anonymous feedback.”
Claim to avoid: Do not claim that a tracking number, anonymous two-way communication or a specific response time is available.
Step 5: Implement the organisation’s procedure for review, closure and lessons learnt
Objective: To ensure that the report is assessed by the appropriate authority, recorded and that the process is closed in a responsible manner.
Key points for compliance teams:
Conduct the preliminary assessment, referral for investigation, decision-making, record-keeping and access management in accordance with the organisation’s approved procedure.
Make the organisation’s approach to protecting the reporter and addressing concerns about retaliation clear through the relevant policy.
Upon closure, manage the level of information that can be shared in accordance with confidentiality and authorisation limits; review trends for process improvement.
Key point for employees: Manage expectations regarding outcomes or feedback within the framework of the organisation’s reporting and confidentiality rules.
Security checkpoint: “Confirm the review workflow, role-based access, log export, closure and reporting options in your Probuddy account/setup.”
Claim to avoid: It should not be stated that Probuddy conducts independent investigations, reports the outcome, prevents retaliation or provides analytics.
Checklist: Before submitting and managing
Under, present this under two brief subheadings: ‘For the reporter’ and ‘For the compliance team’.
For the reporter:
I have checked the scope of the incident and the authorised channel against the organisation’s policy.
I have separated the facts, dates and evidence from any comments.
I have not included any unnecessary personal data or irrelevant documents.
I am using the communication and follow-up method exclusively via the verified channel.
For the compliance team:
The scope, routing and access details are up to date.
The active channels, roles and workflow in the Probuddy setup have been confirmed by the organisation.
Recording, access, communication and closure procedures are in line with the organisation’s procedures.
Please suggest an HTML list in a tick-box format (); do not present the checklist as a list of legal obligations.
Conclusion: Verification, diligence and proper guidance
Summarise the common principle underlying the five steps in a single paragraph: correct scope, fact-based narrative, authorised channel, controlled communication and a conclusion in accordance with procedure.
State that any technical or operational features relating to Probuddy may only be included in the text once they have been verified by an official product document, contract, security statement or the organisation’s accessible user flow.
In the final sentence, encourage staff to refer to current organisational policies and guidance from the compliance team.
Include a separate brief note stating: “This guide is for general information purposes only; it does not constitute legal advice.”