Internal controls are sometimes not enough to detect fraud. A survey conducted by Price Waterhouse Cooper in 2007 found that professional auditors were only able to detect 19% of frauds that occurred in private companies, while whistleblowers were able to expose 43% of frauds. The surveyed executive said that whistleblowers saved billions of dollars of their shareholders’ money.

Therefore, a whistleblowing or whistleblowing hotline system is important to the company as protection for valuable assets, just like life insurance for any individual. But what is exactly a whistleblowing hotline? And how important is this system?

What is a whistleblowing hotline?

Being a whistleblower or a fraud reporter is always accompanied by risks such as being ostracized, getting threatened, or even fired from the company. These risks are dilemmas for potential whistleblowers, making them delay the reporting process or even refrain from reporting the fraud completely.

Whistleblowing or a whistleblowing hotline system, such as the Canary Whistleblowing Hotline, is a channel where whistleblowers can report illegal activity or fraud that happened within organizations – their companies- with the identity of the reporter staying anonymous. The system receives reports and passes them on to the company’s authorities, but still creates a favorable working environment because the identity of the reporter is kept confidential.

Why is a whistleblowing hotline important to the company?

1. An early warning system. According to the ACFE (2024), fraud schemes take an average of around 12 months to detect. Schemes detected in less than six months cause a median loss of approximately US$30,000. In contrast, schemes that continue for five years or more cause a median loss of around US$875,000. The earlier fraud is detected, the lower the potential losses.

2. Employees are a major source of information. The same study found that employees provided more than half (52%) of all fraud tips, while 15% of tips were submitted anonymously. Without a safe reporting channel, valuable information may never reach management.

3. Lessons from Enron. In August 2001, Sherron Watkins, an Enron executive, sent an internal memo to CEO Kenneth Lay warning him about questionable accounting practices. However, the warning did not lead to timely corrective action, and Enron filed for bankruptcy in December 2001. Whistleblowers are often loyal employees who care about their company’s future. What they need is a safe way to speak up and management that takes their concerns seriously.

4. Regulatory and compliance requirements. For financial services institutions in Indonesia, Financial Services Authority Regulation (POJK) No. 12 of 2024 requires the implementation of an anti-fraud strategy built around four pillars: prevention; detection; investigation, reporting, and sanctions; and monitoring, evaluation, and follow-up. The Financial Services Authority (OJK) identifies whistleblowing as part of this strategy. Outside the financial sector, standards such as ISO 37001, which focuses on anti-bribery management systems, also require mechanisms for internal and external parties to report concerns.

What can be reported through a whistleblowing channel?

The scope of reportable issues should be clearly defined in the company’s policy. This helps employees understand which concerns they should report. Common examples include:

Fraud and financial misconduct
Corruption, bribery, improper gifts, and conflicts of interest
Harassment and discrimination
Workplace safety and ethical violations
Misuse of company assets or data
Violations of company policies and regulations

Routine complaints and customer service issues should be directed to other channels. This helps prevent the whistleblowing hotline from being overwhelmed with reports that fall outside its intended purpose.

ISO 37002 and ISO 37001: ISO Standards for whistleblowing

ISO 37002:2021 is an international guideline for whistleblowing management systems, published in July 2021. It is based on three key principles: trust, impartiality, and protection. The guideline outlines four stages of handling whistleblowing reports: receiving reports, assessing reports, addressing reports, and closing cases. It applies to organizations of all sizes and sectors, including both private and public organizations.

Meanwhile, ISO 37001 is a certifiable anti-bribery management system standard. As mentioned earlier, it also requires mechanisms for raising concerns. Organizations can use ISO 37002 as a guide when designing a whistleblowing system, while ISO 37001 provides a broader framework for preventing and addressing bribery.

Integrity Indonesia’s Canary™ Whistleblowing System follows a similar four-stage process: reporting, review, follow-up, and closure.

Why do many whistleblowing systems become mere window dressing?

A whistleblowing hotline becomes little more than a formality when:

The company culture does not support reporting. Employees submit reports, but the company takes no visible action.
Whistleblowers do not trust the anonymity safeguards. Management influence becomes a particular concern when the company assigns responsibility for handling reports to people who may be influenced by management. That is why it is important to provide anonymous reporting options.
There is no visible follow-up. Reports are submitted, but nothing seems to happen. Over time, employees may stop reporting misconduct.
The company assigns reports to the wrong people. Those responsible for handling reports may lack proper training or have conflicts of interest.
Employees are unaware of the system. The company does not communicate the reporting channel clearly, so employees do not know it exists or how to use it.
Retaliation is ignored. Threats, harassment, or violence against whistleblowers are allowed to continue without appropriate action.

Should you manage your whistleblowing hotline internally or outsource it to a third party?

Criteria	Managed Internally	Managed by an Independent Third Party
Whistleblowers Trust	Whistleblowers may worry that their reports will be seen by their supervisors or the IT team.	Generally higher because the system is managed by an independent party.
Anonymity	Depends on internal access controls.	The whistleblower’s identity can be kept separate from the company.
Availability and Languages	Often limited to business hours and one language.	Can support multiple reporting channels and languages.
Workload	The internal team handles all report intake and triage.	An external operator assists with report intake and initial screening.
Conflicts of Interest	Risks may arise when reports involve management.	Objectivity is easier to maintain.

How to choose a whistleblowing service provider

Here are several key criteria to consider when choosing a whistleblowing service provider:

Information security certification, such as ISO 27001
Multiple reporting channels and languages
Anonymous two-way communication between whistleblowers and case handlers
Case management system with status tracking
Regular reporting and operator support
Training and awareness materials
Transparent pricing

Canary™ Whistleblowing by Integrity Indonesia offers multiple reporting channels, including a web portal, mobile app, email, dedicated hotline, SMS, and postal mail. The system supports more than 15 languages. Explore the full features of our whistleblowing system.

How to make whistleblowing effective

Without stakeholder support, a whistleblowing system can become little more than a formality. For it to work effectively, organizations need to take several important steps:

Build a supportive company culture. Encourage employees to report any illegal activities or misconduct they discover.
Provide effective whistleblowing training. Train employees on how whistleblowing works, how the company will protect them, and how it will update them on the reports they submit.
Communicate the importance of reporting misconduct. Reassure stakeholders that the company will protect whistleblowers and respect their confidentiality. Make it clear that the company will not tolerate threats, harassment, or any other form of retaliation against whistleblowers.
Enforce consequences for failures to protect whistleblowers. Hold stakeholders accountable if they fail to protect employees who report misconduct.
Assign the right people to manage the system. Handle every report carefully, objectively, and appropriately, and follow up to ensure you address each concern.

Frequently Asked Questions

Can employees report misconduct anonymously?

Yes, if the system supports anonymous reporting. With Canary™, reporters can choose to disclose their identity fully, partially, or remain anonymous. They can also communicate with the operator while maintaining their anonymity through the Canary™ Mute feature.

When should companies use an independent whistleblowing service provider?

Consider an independent provider if any of the following conditions apply: reports may involve management or company owners, employees work across multiple locations or speak different languages, the internal team lacks the capacity to receive and screen reports, or employees have limited trust in the company’s ability to maintain confidentiality. In these situations, outsourcing the process to a third party helps maintain objectivity.

Can a whistleblowing hotline serve vendors, business partners, and employees across multiple locations?

Yes, provided the company offers a multilingual, multi-channel reporting system. Companies can make their whistleblowing hotline accessible to employees, business partners, and other third parties. Integrity Indonesia’s Canary™ Whistleblowing System offers a web portal, mobile app, email, dedicated hotline, SMS, and postal mail, with support for more than 15 languages. These options help companies reach diverse groups of reporters across different locations.

How do I report misconduct through a whistleblowing hotline?

Use the reporting channels provided by the organization, such as a telephone hotline, online portal, or official email address. Prepare the key facts, including what happened, when it happened, who was involved, and any supporting evidence you have.

How much does a whistleblowing hotline cost?

The cost depends on your organization’s needs, including the number of reporting channels, language requirements, and customization options. Contact our team through the form next to this article to request a quote.

Whistleblowing hotline 2026: building an effective reporting channel