Getting started with whistleblowing

The Whistleblowing module is your organisation’s reporting scheme. Anyone — employee, former employee, supplier, partner — can use a public portal to report a concern, without an account and, if they wish, anonymously. The report goes only to the handlers of the chosen channel, who deal with it in Illizeo and exchange with the reporter through secure messaging. The screens refer to EU Directive 2019/1937 on the protection of whistleblowers, which French law transposes through the Sapin II Act. This article introduces the module, its screens, its permissions and what each profile sees; it is aimed first at the administrators who set it up.

The module at a glance #

The module opens from the Whistleblowing menu entry, which has three tabs, and is configured under Settings › Whistleblowing.

• Dashboard: the figures for your cases and, if you have the right, the scheme’s compliance card — described below.
• Reports: the case list and case handling — see Handling a whistleblowing case.
• Analytics: statistics, deadline compliance and export — see Analytics, export and data privacy.
• The public portal, where a report is submitted and tracked — see Submitting and tracking a report.
• The channels and their handlers — see Setting up channels and naming handlers.
• The other settings: confirmation message, legal deadlines, organisation, DPO, appearance — see Configuring the scheme.

Before you start #

• The Whistleblowing module must be subscribed in your workspace and open to your account. Without a subscription, the public portal accepts no reports.
• The module’s rights are in the role catalogue, under Manage Employees › Employee Roles. By default:
  • Whistleblowing report, which opens the module: Administrator (Admin level), HR (Execute level), Auditor (Access level);
  • Reports — View: Administrator, HR and Auditor; Reports — Export: Administrator and HR at Execute level;
  • Whistleblowing — Read case audit trail: Administrator, HR and Auditor;
  • Settings — Compliance (GDPR / EU 2019/1937): Administrator, and read-only for HR and Auditor;
  • the configuration rights (Channels — List, Channel — Create, Channel — Edit, Channel — Configure (managers), Settings — General, Settings — Notifications, Settings — Anonymization / consent, Tenant — Branding (logo/colors), Tenant — Custom domain, Tenant — Configure DPO, Whistleblowing — Full administration): Administrator only.
• The module does not manage permissions itself: it has no “access” screen. Everything goes through the application’s role matrix.

The case access rule #

This is the point to understand first. In this module, access to cases does not follow ordinary roles:

1. permissions open the module;
2. the channel opens the case: you only see a case if you handle the channel that received it;
3. two situations close it whatever else is true: being implicated in the case, or being recused from it.

That denial cannot be overridden: neither an administration role nor system-administrator status lifts it. It is the guarantee owed to the person who reported, and every denial is recorded in the case’s audit log. In practice, an administrator who handles no channel sees no case, and a director who is implicated does not see the case that concerns them.

What each profile sees #

• The person reporting has no account. They submit on the public portal, receive a tracking password, follow progress and exchange with the handler without identifying themselves.
• The handler (or manager) is an employee named on one or more channels. They see the cases of their channels, take them on, acknowledge receipt, exchange with the reporter, record the persons concerned and close the case. They are notified of new cases and replies in the module’s bell and by email.
• The scheme administrator sets up channels, names handlers, writes the confirmation message, sets deadlines and retention, and records the DPO. They only see the cases of channels they handle themselves.
• The DPO or auditor reads the analytics and, with the compliance right, the Programme compliance card: counts of overdue cases across all channels, without any case data.

Reading the dashboard #

Open Whistleblowing › Dashboard.

• The Programme compliance card (DPO view) only appears with the compliance right. It counts the cases overdue for Acknowledgement and Response, and those to purge under Retention, with a breakdown by late channel.
• Four counters sum up your cases: Total reports, New, In progress and Resolved.
• Breakdown by category and Breakdown by channel show where reports come in.
• Recent reports lists the latest cases with their status, priority, remaining time and assignee.

Following notifications #

The bell to the right of the tabs opens the module’s notifications. They announce a new report, a reporter’s reply, and deadlines that are close or overdue. Click a notification to open the Reports tab; Mark all as read clears the counter. A person implicated in a case never receives its notifications.

Understanding your access: the My access page #

Open Settings › Whistleblowing › My Access. The page explains why you can — or cannot — see a report:

• Your role in the scheme: Administrator, Manager, DPO, Auditor or Reader. This role is not assigned in the module: it is derived from the permissions you hold, listed under Permissions held together with the Roles granting them;
• Channels you handle: it is the channel, not your role, that decides which cases appear in your list;
• How access to a case is decided: the rule described above;
• Password, two-factor authentication and sessions: these belong to your Illizeo account and are managed there (Open my Illizeo account).

Setting up the scheme #

1. Check the role permissions under Manage Employees › Employee Roles: who opens the module, who sees analytics, who administers.
2. Create the channels and name at least two handlers per channel: Setting up channels and naming handlers.
3. Write and enable the confirmation message, check the acknowledgement deadline and record the DPO: Configuring the scheme.
4. Set the retention period: Analytics, export and data privacy.
5. Share the portal address with employees and the partners concerned.

Good to know #

• The module does not replace your internal reporting procedure: it is the tool for it. Its legal content (deadlines, notices) follows what the screens cite; it is not legal advice.
• The default deadlines are 7 days for the acknowledgement of receipt and 90 days for feedback to the reporter.
• Every action on a case, including simply opening it, is recorded in its audit log.
• Emails sent to handlers contain metadata only (reference, category, priority, channel), never the account of the facts.
• The module does not configure connectors to other tools: integrations are set up in the app store.

Frequently asked questions #

I am an administrator and my report list is empty. Why? #

Because you do not handle any channel that has received a case. Permissions open the module, not the cases. Your My Access page confirms this.

Who should be a handler? #

The module leaves the choice to you: any employee can be named on a channel. Naming at least two handlers per channel keeps cases moving during an absence, and lets one handler take over if the other is implicated.

Does the reporter need an Illizeo account? #

No. The portal is public and asks for no account: that is what allows outside people to report and everyone to remain anonymous.