“Plan twice to implement once” is Teqball Group Legal Director Marianna Erdei’s approach to implementing new whistleblowing regulations in a manner that is not compliant only with Hungarian law but takes into account the local needs of other jurisdictions.
CEELM: What are the biggest challenges in your view in implementing the new whistleblowing regulations?
Erdei: What is very important to note is that the EU regulation on it is something that needs to be implemented in a way that the country’s own law will be respected. In my case, several of the group companies and the sports federation itself are located in Hungary, meaning that we need to keep the Hungarian law in mind. There are differences between EU and Hungarian legislation and you need to overcome those obstacles.
For example, look at anonymity. Under Hungarian legislation, it is not a necessity – which adds an interesting spin to EU legislation. That said, working for an international group of companies, you have many local subsidiaries that have other local flavors. However, using the same system is pretty much a requirement for any international body, giving rise to questions on how to set up a system that takes these differences into.
And that is just one example of the challenges of finding a system that will be both good for the company and the whole set of companies in the international group. Keep in mind that, the goal is to have independence locally to be able to investigate any reports on a local level while also sharing any findings in compliance with local rules. If it is against the rules to share them abroad, you need to find a chain of investigators who can be involved but are independent enough to be able to have an independent result.
Another consideration when looking at an international group is language. It is a requirement for reporting opportunities to exist in a language that the whistleblower understands – i.e., local language. As such, you need to both localize reporting lines while also ensuring you have processing capabilities in the local language.
CEELM: How do you recommend tackling these challenges?
Erdei: Use internal resources if you are a big enough organization or look for off-the-shelf solutions that can be localized. The latter have their limitations, of course. If you have something that is already available, you can then use local resources to adjust to your local needs.
There is of course always a question as to who is independent enough but also possesses the internal knowledge and expertise to cover the investigation. Most of the companies that operate in sensitive areas already have some systems in place but now have a specific set of requirements that they need to adjust to. If your organization is rather small, you’ll need to start spending money to either externalize or train internal resources. Of course, not only one responsible person is needed because if they are tainted by any info received, you need to be able to deal with those conflicts. Having an efficient compliance department is important in light of the new legislation but not all can afford a whole compliance team.
CEELM: What are the options if there are no internal resources then?
Erdei: My approach would be to see what would be most efficient in all instances – both in terms of time and money. There is no one good path, but an evaluation of the company’s situation is needed – to see if the cost of external services, or the cost of training of an available and appropriate team member(s) is more suitable for the company. In a lucky scenario, the company can rely on the already existing compliance teams (and even IT internal resources).
I believe that in most cases a combination of the available solutions would work. My advice would be to find the simplest setup as well. Ultimately, I asked myself what was the most important message from the legislator that should be considered when implementing the whistleblowing system. My answer would be to have appropriate ways that people can submit a complaint efficiently. I propose to identify the channel that complies and do our best to make it available to all concerned persons (i.e., ensure access).
CEELM: Which function is best positioned in your view to receive and process complaints?
Erdei: May this be a little bit extraordinary view, but I think almost either – IT, compliance, legal, HR – you need to look more at the personal set of skills needed to carry out the relevant investigation. Compliance is likeliest to have those skills the most by virtue of what they do but, for smaller companies, my choice would probably be to look at individuals rather than functions per se. Probably look at HR or legal but I wouldn’t rule out any department (or its member) that might have the necessary skill set and training. Ensuring independence for the investigator might mean you need to consider outsourcing, should the internal circumstances not allow unquestionable independence for the internal resource.
CEELM: If the skill set is more important then, what are the skills you’d look out for?
Erdei: First and foremost: analytical thinking – to be able to gather and analyze the facts for any complaint. Second, probably some legal knowledge or background would be useful, and to be familiar with the code of ethics (or equivalent) you wish to enforce. Third, strong communication skills are definitely needed – whoever is in charge of this needs to be able to tactfully and efficiently communicate with the reporter and witnesses. Last but not least, good problem-solving skills are needed to propose appropriate measures at the end of the investigation.
CEELM: What are the most effective channels for reporting issues?
Erdei: In the era of the internet, probably online is the easiest to set up channels (through your intranet or website or the like). Also, to gather info and evidence, it makes more sense to have it written down as well. I wouldn’t rule out email either as a very common communication channel.
CEELM: Once the new system is set up, how do you communicate it best internally?
Erdei: Like any other compliance matter – it is all about raising awareness and training, showing how team members can use it or what options are available, but they should also be made aware of the potential consequences (good faith vs bad faith reporting) because it is not something that should be taken too lightly. It’s a great tool to have and important for any organization to know if there is something wrong internally, but you need to make sure it is used wisely and ethically.
CEELM: Do you have any tips for the actual setup?
Erdei: It is important to collect information on what works best for your organization. Starting a system not well suited for you will probably mean losing time and money, so you need to plan it out well before you go for any option. Also, if you have a procedural framework and templates in place, you will not be surprised by the first few submissions. You should practice it out – what everyone does under varying scenarios. Working out templates will ensure you have a methodology in place both in terms of how you react to and how you engage the whistleblower. That way you can focus on engaging with the substance of a received report, not the form of how to connect. Bottom line: Plan it out well and build up templates while testing.
If you think about it, it is ultimately a compliance exercise. We’ve had the GDPR and the like before, so we are used to incorporating a new system. And, if you are lucky, you already have a similar system in place. It is important to look at it from a positive perspective and internalize it as an opportunity for the organization to be in control over its operations. Having used it wisely, under certain circumstances, this system can ensure competitiveness for the company, not to mention, that in other cases it can spare the organization a lot of headaches by preventing a problem from getting bigger.
