Speak-up culture
A speak-up culture is an organisational culture in which employees can raise wrongdoing, breaches and concerns openly without fearing disadvantages – and in which those reports are taken seriously and handled in a traceable way.
Speak-up culture is the cultural foundation on which any working whistleblowing system rests. The German Whistleblower Protection Act (HinSchG) and EU Directive 2019/1937 prescribe channels, deadlines and protective rights – but culture decides whether those channels are ever used. A mature speak-up culture rests on three pillars: psychological safety (raising a problem is welcome and carries no career risk), accessibility (employees know the reporting routes and trust them) and responsiveness (reports visibly lead to something). If any one of them is missing, the internal reporting office exists on paper but has no practical effect.
German law reflects this connection. Under section 7(3) HinSchG, employers are expected to create incentives for whistleblowers to turn to the internal reporting office before approaching an external one – provided the breach can effectively be addressed internally and the whistleblower need not fear reprisals. The free choice between the internal and the external channel under section 7(1) HinSchG cannot be restricted by instruction; it can only be influenced by trust. This is reinforced by the prohibition of reprisals in section 36 HinSchG, including the reversal of the burden of proof, the confidentiality requirement in section 8 HinSchG and the duty to provide clear information about reporting routes in section 13(2) HinSchG. International standards such as ISO 37002 (whistleblowing management systems) and ISO 37301 (compliance management systems) treat culture work explicitly as a management element in its own right, not as decoration.
When it comes to report volumes, a counter-intuitive rule applies: a rising number of reports is usually a good sign, not a bad one. It shows that the system is known and trusted, and it gives the organisation the chance to investigate matters internally before they reach an external reporting office or a public disclosure under section 32 HinSchG. Conversely, a permanently empty inbox rarely proves compliance; more often it indicates that the channel is unknown or not trusted. Qualitative indicators are therefore more meaningful than raw volume: the share of substantiated reports, the share of non-anonymous reports (a trust indicator), compliance with the seven-day and three-month deadlines under section 17 HinSchG, and whether reports actually translate into follow-up measures under section 18 HinSchG. In practice, culture work means a visible commitment from senior management (tone from the top), trained line managers as the first point of contact, a low-threshold, multilingual and accessible reporting channel, the option to report anonymously, and anonymised feedback of outcomes to the workforce.
Legal Basis
Sections 7(1) and 7(3), 8, 13(2), 17, 18 and 36 HinSchG (German Whistleblower Protection Act); Art. 7(2) Directive (EU) 2019/1937; ISO 37002; ISO 37301
Practical Example
A mechanical engineering company with 900 employees across four sites has run an internal reporting office for two years and received exactly three reports in the first year. The compliance officer reads this not as a success but as a warning sign and launches a speak-up programme. Management states explicitly at the works meeting that reports are wanted and that reprisals will have employment-law consequences. The reporting channel gains an anonymous dialogue function plus Polish and Romanian, and is posted as a QR code on noticeboards and in the production hall. All line managers complete a two-hour training session on how to respond to concerns raised in person and when they must refer them to the reporting office. The works council is involved early under section 87(1) nos. 1 and 6 of the Works Constitution Act. In the following year 21 reports come in, 14 of them non-anonymous; two concern occupational safety breaches that are fixed before an accident happens. In an anonymised annual report to staff, the company shows how many reports were received and what measures followed – without allowing conclusions about individuals.