How it works today in many companies
When the German Whistleblower Protection Act (HinSchG) took effect, things had to move fast. Employers with at least 50 employees must set up an internal reporting office, and for many mid-sized companies the transition period ended in December 2023. What came out of it was whatever could be done quickly: a contact form on the careers page, an address like "reports@", a paragraph in the code of conduct and someone from HR or legal who runs the reporting office alongside their actual job.
Cases are entered in "Reports_HinSchG.xlsx", with columns for date received, category and status. The acknowledgment of receipt goes out by email when someone remembers. Follow-up questions to an anonymous whistleblower are impossible because there is no address to send them to.
If the company has subsidiaries or sites abroad, things quickly become confusing: one mailbox per company, form texts only in German, and a spreadsheet in which it is no longer clear which report belongs to which entity. If an external ombudsperson has been engaged, they work in their own system as well, and the cases sit in two places.
When the interim solution is to be replaced, the search starts with questions like "Which whistleblowing system complies with the HinSchG?" or "Whistleblowing systems for SMEs – what are the options?". The answers are comparison lists in which almost every product promises anonymous reports, encryption and multiple languages. The choice then often comes down to the impression left by a demo or which form goes live fastest. How the reporting office works after a report is submitted, how it meets deadlines and how it proves to third parties that confidentiality was maintained hardly comes up in these comparisons.
The moment it becomes obvious
The differences show with the first serious report. Someone anonymously reports a suspicion, and the reporting office has a follow-up question without which it cannot assess the matter. Or the report concerns a manager who has access to the mailbox. Or a customer asks during a supplier audit how deadlines and confidentiality are documented, and the answer is spread across a spreadsheet and an email folder.
At this point it becomes clear that the selection was based on the form and not on what comes after it: the dialog with the whistleblower, handling within the deadlines and evidence that confidentiality was maintained.
The analysis
Five requirements that decide the selection
They follow from the law and from the daily work of a reporting office – and none of them can be read off a tick in a comparison list.
View the digital reporting channelA return channel, even when anonymous
An anonymous report without the option of follow-up questions often cannot be processed. Without a protected dialog there is also no way to deliver the acknowledgment of receipt and the feedback at all.
Reports in writing and orally
The HinSchG requires that reports can be made in writing and orally. A text-only form covers just part of this; the rest has to be solved organizationally and without documentation.
Deadlines that monitor themselves
Seven days for the acknowledgment of receipt, three months for feedback. If the deadline sits only in a spreadsheet column, a missed deadline surfaces only when the whistleblower asks.
Access without conflicts of interest
The reporting office must work independently. Who may see a report has to be controllable per case – otherwise the very person the report concerns may end up reading it.
Documentation that holds up
The law requires every report to be documented. If the history can be changed afterwards without a trace, it is of little value as evidence, toward customers as well as in later proceedings.
The target process in six steps
A reliable reporting office does not come into being when a form goes live, but with a process defined from responsibility through to deletion.
1. Clarify structure and responsibility. Decide which companies or sites the reporting office covers and who runs it: an internal person, a deputy, or an external ombudsperson or law firm. In preeco | whistleblower, several organizations are managed on one platform, each with its own reporting form URL, its own texts and its own languages.
2. Define the reporting channel. The reporting form guides people step by step through submission, optionally fully anonymous. Oral reports are recorded as a voice message directly in the browser, with no installation and no phone connection. A recording lasts up to ten minutes and can be played back, discarded and repeated before sending. The form is available in up to 26 languages.
3. Assign roles. Administrators, ombudspersons, their deputies and case handlers have graded permissions. Case handlers see only the reports individually assigned to them; a person affected by a report is simply not assigned.
4. Set up areas of application and texts. Predefined areas of application under the HinSchG serve as a starting point, with your own categories added. Introductory texts, frequently asked questions and legal links are maintained per organization.
5. Make the channel known. A reporting channel nobody knows about meets the obligation only on paper. The form URL can be copied or generated as a QR code, for notices, the intranet and employment contracts.
6. Handle and document. Incoming reports automatically receive a deadline that can be adjusted per report; the people responsible are notified of new reports and messages. The acknowledgment of receipt is scheduled in the protected area on receipt and published automatically. The dashboard shows open, unassigned and soon-due reports. Every report can be exported with its history as PDF, DOCX or ZIP, and a deletion date ensures that closed cases do not linger indefinitely.
The dialog with the whistleblower runs through a protected area. Access consists of a system-generated report ID and a password the person chooses; no email address is needed. Messages from the reporting office, replies and system entries such as status changes and deadlines appear in chronological order, while internal comments remain invisible to the whistleblower.
What the software covers – and what it does not
Software covers channel, deadlines, roles and documentation. It does not replace the organizational duties of the reporting office: an in-person meeting must be made possible if the whistleblower asks for one, and whether someone is biased is decided by the reporting office itself. preeco | whistleblower documents such meetings as manually created reports and records in the "Confidentiality" tab whether confidentiality was maintained. The legal assessment of a report remains with the reporting office and its legal counsel.
Before and after at a glance
| Criterion | Before | After |
|---|---|---|
| Follow-up questions | Only with a known sender address | Protected dialog with report ID, also anonymous |
| Oral reports | Phone calls without documentation | Voice message in the reporting form |
| Acknowledgment of receipt | Manual, when someone remembers | Automatic in the protected area |
| Deadlines | A column in a spreadsheet | Deadline per report, overview in the dashboard |
| Access | Whoever has the mailbox sees everything | Roles and case-by-case assignment |
| Documentation | Emails and notes | Timeline whose messages cannot be changed |
| Several companies | One mailbox per company | Several organizations on one platform |
| Deletion | Folders stay | Deletion date per report |
In practice
How this looks in preeco | whistleblower
The three building blocks that carry a reporting office under the HinSchG.
Digital reporting channel
Reporting form with a step-by-step wizard, optionally fully anonymous, oral reports as voice messages, protected access with report ID and password, up to 26 languages.
Case management and dialog
A timeline of all events, two-way dialog with the whistleblower, internal comments, risk assessment and measures, assignment of lead and additional case handlers.
Deadlines and data security
Automatic deadlines, a dashboard with soon-due reports, encrypted storage, a deletion date per report and an activity log with configurable retention.
What the switch means in practice
Moving from an interim solution to a whistleblowing system is manageable, because usually only a few cases need to be carried over. The real effort lies in the decisions: who runs the reporting office, who deputizes, which companies belong to it, and which texts whistleblowers see. A cloud environment is ready once provisioned; the content decisions should be settled beforehand.
With several companies, it pays to create a separate organization per company or country, with its own areas of application, texts, deadlines and languages. Multiple languages are a linguistic adjustment, not a legal one: whether a national implementation outside Germany sets different requirements is for the company to check.
Three mistakes that undermine the reporting channel
Choosing by the form. Almost every product has an appealing reporting form. What matters is what happens after submission: return channel, deadlines, access and documentation.
Not appointing a deputy. If the only responsible person is on vacation or affected themselves, the deadline keeps running. Appoint the deputy before the first report arrives. preeco | whistleblower has a dedicated role for this with the same permissions as the ombudsperson.
Hiding the channel. A link in the legal notice is not enough if employees without a desk job never see it. Notices, the intranet and onboarding are part of it.
How to tell it is time
An interim solution is not a mistake. It becomes a risk when at least one of these applies:
- You cannot ask an anonymous whistleblower a follow-up question.
- Oral reports are not documented.
- Deadlines are tracked by hand in a spreadsheet.
- Several people can access all reports, regardless of the case.
- Customers or auditors ask about the documentation of your reporting office.
FAQ
Frequently asked questions about choosing a whistleblowing system
A system that accepts reports in writing and orally, offers a return channel even for anonymous reports, monitors the seven-day and three-month deadlines, restricts access to individual cases and documents every report. preeco | whistleblower is designed for the German Whistleblower Protection Act (HinSchG) and the EU Whistleblower Directive; the legal assessment of the implementation in each case remains with the company.
For small and mid-sized companies, what matters most is that the reporting office can be run with little effort: a form that works without training, automatic deadlines and acknowledgments of receipt, a dashboard with open reports and clear roles. preeco | whistleblower is operated in ISO 27001-certified data centers in Germany.
Yes. The HinSchG requires that reports can be made in writing and orally. preeco | whistleblower implements oral reports as a voice message in the reporting form, recorded directly in the browser – also for anonymous reports. Phone reports and in-person meetings are documented by the reporting office as manually created reports.
The law allows third parties to be entrusted with the tasks of the internal reporting office. External compliance service providers, ombudspersons and law firms use preeco | whistleblower to run reporting offices for several clients; the software supports multiple clients and can be provided in their own branding.
Then the report should be handled by an office the people concerned cannot access. In preeco | whistleblower this works through roles, case-by-case assignment and separate organizations, for example for an external ombudsperson. The software does not check for conflicts of interest automatically; the reporting office makes that call.
Go through your reporting office together
Bring your current solution. In 30 minutes we show how reporting channel, deadlines and documentation are set up in preeco | whistleblower.