Whistleblowing & Incident Management Benchmark Report

2024 Read the report

Introduction

An efficient and trusted mechanism by which employees can anonymously or confidentially make inquires and allegations of suspected or actual misconduct without fear of retaliation is the hallmark of a well-designed compliance program.

To help, NAVEX anonymizes the data collected through our customers' reporting and incident management systems every year and creates this report to share with all organizations. Because we have the world’s largest and most comprehensive database of reports and outcomes, risk and compliance professionals trust our benchmarks to help guide decision making and better understand how their programs stack up. This 2024 report represents data collected from reports received in calendar year 2023.

This annual report is an important resource for organizations committed to benchmarking and improving program effectiveness.

Methodology

For statistical accuracy, our analysis includes only those organizations that received 10 or more reports in all of 2023. The resulting database includes 3,784 organizations that received a total of 1.86 million individual reports.

See more in full report

Executive Summary

For many of the 3,784 organizations represented in this NAVEX Whistleblowing & Incident Management Benchmark Report, 2023 was a busy year. Internal reporting programs saw a record level of use, revealed through our global database’s highest-ever Reports per 100 Employees metric. In addition, the Substantiation Rate metric reached an 11-year high, meaning more reports were received AND more were found to be true. For those with trusted and effective internal reporting programs, this added up to greater visibility into the trends of risk, ethics and culture playing out in their organizations’ operations – real-time intelligence to inform business decision-making.

To see usage of internal reporting channels rising is a good thing. When reporters trust internal resources and use them to raise concerns and make inquiries without fear of retaliation, they shine a light on places where the organization may need to act before a potential issue escalates to a bigger problem. A rise in substantiated report volume may not signal a shift toward more unethical behaviors within organizations, but rather, that compliance teams are more successful in encouraging reporters to speak up while equipping them with the knowledge of how to make a high-quality report. For many organizations in 2023, it appears that dynamic was healthy.

The story of this 2023 State of Risk & Compliance Report is one of progress. Risk and compliance (R&C) professionals are reporting greater program maturity, signaling the growing confidence, stature and sophistication of our professions. Many are also reporting promising collaboration across silos with Information Security (InfoSec), which may indicate more organizations are taking a holistic view of what it takes to successfully manage risk and build ethical cultures. And any fears that workplace culture would suffer as many temporary COVID-19 remote-work arrangements became permanent appear moot – by a wide margin, R&C professionals are reporting positive outcomes from work-from-home models.

Key Findings

Report volume and case substantiation reach milestones

Report volume, and the substantiation rates of the reports received, are two of the most highly benchmarked metrics of our annual publication. This year, both were at the highest levels ever – and both are good news. In 2023, organizations received a median 1.57 Reports per 100 Employees across organization internal reporting systems, exceeding the previous record of 1.47 set in 2022. More organizations (23%) received five or more Reports per 100 Employees, making this population the largest in our data set. And while year-over- year values fluctuated, every size of organization – from the smallest companies to enterprises with over 100,000 employees – has seen report volumes rise comparing 2021 and 2023.

Note: In this first chart, the central blue bar represents the middle 50% of organizations in our distribution, while the full range depicts the central 80%.

It’s not just the sheer volume of reports that is noteworthy. At 45%, the overall median share of substantiated or founded reports in 2023 reached an 11-year high.

Anonymous reports accounted for a median of 56% of all reports received in 2023, and for those matters where the reporter chose to provide their name, the Substantiation Rate increased to 50% in 2023 after remaining around 47% for several years. Organizations where reporters feel confident identifying themselves without fear of retaliation are likely to be among those seeing the greatest benefit from this upward Substantiation Rate trend.

These dynamics – more high-quality reports of actual misconduct – add up to an important moment for internal reporting programs and the organizations they support. Research has shown higher rates of internal reporting translate to better business outcomes. Programs that are successful in encouraging reporters to speak up have direct visibility into how these pressures are impacting their organizations, offering the opportunity to detect and mitigate risk.

Story emerging on accounting related reporting – internally and externally

Those familiar with the U.S. Sarbanes-Oxley Act of 2002 know that it was designed to protect investors from fraudulent financial reporting and impose stiff penalties for wrongdoing. Those in the compliance field also know its impact on the now-ubiquity of hotlines, as publicly traded organizations were required to provide clear reporting channels to report financial misconduct.

Accounting-related reports, while lower in overall percentage of reports received internally by organizations at a median of 4.3.% in 2023, often receive an outsized share of attention due to potential for regulatory action and the well- publicized bounty program offered by the SEC and their Office of the Whistleblower. The SEC program is continuing to see record growth in the number of tips reported to the agency, and is paying out record rewards to those with compelling information. Now the U.S. Department of Justice will also be piloting a rewards program for tips on corporate crime.

In light of opportunities and incentives for individuals to take these accounting-related reports elsewhere, a deeper dive into our data shows an emerging story about these types of reports, organization findings when receiving them, and how reporters are using the system. Specifically, reports related to Accounting, Auditing and Financial Reporting:

Showed the longest time between when an incident was observed and when it was reported to the organization
By a large margin, were least likely to be reported anonymously
Comprised an outsized share of cases for organizations that receive very few Reports per 100 Employees – meaning while these organizations received well below the benchmark number of reports, they had a much more significant percentage of accounting-related reports
Experienced the longest time to investigate and close the case
Had among the highest median Substantiation Rates, at 50%
Were most likely to cause an employment separation event as a result of a substantiated case
Accounted for twice as many of the reports submitted by third parties than the reports submitted by employees

Given that reporters are waiting longer to report these issues, and they are more likely to provide their name, this could be an indication that some reporters are considering filing an external report and are getting all documentation in order. While the longer duration of Accounting, Auditing and Financial Reporting case investigations is no doubt reflective of their inherent complexity, it is important to ensure that reporters receive periodic updates so they know that their matter is being addressed.

Third parties more likely to report business integrity and financial misconduct issues

In a first for this report, NAVEX analyzed our substantial reporting database by both employees and third-party reporters. Our analysis shows these two groups are distinct across several metrics, showing the insight organizations realize from promoting their reporting program not just internally, but externally as well.

In terms of Risk Categories, third parties as a group made a far greater median share of reports related to Business Integrity than employees in 2023 (50% versus 17%). Third-party reporters also showed twice the median share of Accounting, Auditing & Financial Reporting reports as employees in 2023 (10% versus 4.5%). Meanwhile, reports from third parties showed a lower Substantiation Rate than that of employees, likely reflecting their decreased proximity to the organization.

Third-party reporters in 2023 appeared to be an important source for reports about Business Integrity matters and financial issues, which are some of the most challenging Risk Categories organizations face. While reports from third parties may be harder to substantiate, or may lack nuance into context like organizational policies and culture, it is clear that they still provide valuable insight.

Small increase in report volume shows big payoff in healthy report mix

A new Risk Category analysis for this report gives a sense of how organizations with higher reporting volume differ from those with lower reporting volume in terms of the type of issues raised. Receiving a diverse mix of topics, inquiries and allegations in an internal reporting system is a sign of programmatic health, and our analysis shows organizations making even the smallest effort to encourage internal reporting achieve massive improvements in the balance of risk categories received in their systems.

Organizations with the lowest report volume in our distribution (between 0.0 and 0.24 Reports per 100 Employees), only 8.7% of reports fell into the HR, Diversity and Workplace Respect Risk Category. Move up one category to the group with between 0.25 and 0.49 Reports per 100 Employees, and that share increases significantly to 36.3%. Frequencies of respective report Risk Categories fluctuate throughout the distribution, but all cohorts show a healthier mix than those with the smallest report volume.

Employee Separation as case outcome grows more common

Highlighting the seriousness with which organizations are taking reports received, more substantiated reports (18%) resulted in Separation from employment in 2023, up significantly from 14% in 2022 and 12% in 2021. The share of reports resulting in No Action – effectively the opposite end of the outcome spectrum – fell from 17% in 2022 to 14% in 2023.

Individuals are taking longer to report an incident

The share of organizations in our database with a Time Difference Between Incident and Report Date of fewer than five days has steadily declined by approximately four percentage points over the last three years.

With a share of 32%, organizations with a Time Difference Between Incident and Report Date fewer than five days are still the largest group in our database by median analysis. Yet the decline for this group is a reason for organizations to question if they are doing enough to encourage expedient reporting.

Reports of imminent threat most likely to be substantiated

With nearly 9 out of 10 reports of Imminent Threat to a Person, Animals or Property proven to be substantiated in 2023, it is critical that reporters possess the training, knowledge, tools and trust that promote rapid reporting of issues. This need is made even greater by a new California workplace violence prevention law expected to go into effect this year that includes requirements for reporting, incident management and training around this Risk Type.

Workplace discord encompasses ever-greater share of reports

Workplace behaviors and other human- resources related matters are by far the highest percentage of reports received by organizations. Workplace Civility matters continued to increase in prominence in 2023, representing a median of 18% of reports. Workplace Civility had the highest median reporting rate in 2023, followed by Discrimination, at a median 12%, then Harassment, at a median 7.1%. The HR, Diversity & Workplace Respect Risk Category overall has seen a multi-year increase in its median share of all reports (from 50% in 2021, 54% in 2022 and to 55% in 2023).

Key Actions

This report includes numerous metrics and analysis not included in this summary that may have special relevance for your organization. However, with respect to global trends and findings, consider how these key actions may help your internal reporting program.

Ensure your program rises to meet the growth in report volume.

Equip reporters with the knowledge to make quality reports.

Ensure third parties can find your reporting mechanism and use it effectively.

Capitalize on the value of a holistic view of risk and compliance.

Act effectively in response to financial- type reports.

Conclusion
& Key Takeaways

See more in full report

The metrics in this report provide a powerful opportunity for organizations to understand how to grow and improve their internal reporting programs. Our analysis suggests some high-level trends to keep in mind.

Data for 2023 showed reporters to be eager to speak up, and when reporters trust an internal system, they are more likely to use it. Higher volumes are also shown to correspond with richer reporting across categories. Ensure training and messaging build trust, affirm retaliation is never tolerated, and make sure the system itself presents the lowest barriers possible for an individual to make a report.
The overall rise in Substantiation Rate may signal that reporters are growing more informed before making a report. Organizations should continue to help reporters to understand what constitutes actual misconduct – this includes training, making policies easy to access and understand, and encouraging inquiries through an internal reporting system.
Third parties in 2023 provided a different mix of reports to organizations than those organizations’ own employees.By encouraging outside individuals to make reports, organizations can achieve a better understanding of the issues that may require action to reduce risk and maintain organizational ethics and compliance.
The rise in substantiated reporting is putting more information into Compliance’s hands about the health of their organizational culture and associated business risks. Program leaders and managers can leverage that intelligence to inform risk management across other areas of the business.
The record levels of tips received by the SEC in its fiscal year 2023 is a signal that reporters have alternatives outside of internal programs. Internal reporting programs should demonstrate that they take Accounting, Auditing and Financial Reporting issues seriously.

As stated earlier in this report, there are no “right” outcomes in benchmarking reporting data. Yet by comparing their own programs against these global metrics, organizations can gain a better understanding of their culture and risks - and how to positively impact both.