Complaints channel

Complaints channel

Written by Ana Canteli on 3 March 2023

On 21 February this year, law 2/2023 on protecting persons who report regulatory offenses and the fight against corruption entered into force in Spain. Until now, the legal framework relied on provisions such as the law on criminal prosecution or the law on the prevention of harassment. However, to promote a confidential and secure reporting channel for information on activities that are illegal, inappropriate, or contrary to an organization's policies, this law advocates the creation of what is known as a complaints channel.

What is a complaints channel?

A complaints channel is a system designed and developed to detect and address illegal or inappropriate behavior within an organization and to foster a culture of ethics and transparency while protecting complainers.

The need to have a complaints channel is a relatively recent practice.However, implementing complaints channels in many countries has become a recommended or required practice.

In the US, the Sarbanes-Oxley Act of 2002, passed after the Enron scandal, requires companies to implement a complaints channel for employees to report potential accounting fraud. The 2019 Complaints Protection Directive in the EU establishes a common framework for protecting Complaints and creating complaints channels in all organizations. These laws and regulations are constantly evolving and updating to address new forms of illegal or inappropriate behavior.

Why create a complaints channel?

The creation of a complaints channel has several objectives, among them:

• Promote a culture of ethics and transparency: having a complaints channel demonstrates that the entity takes its code of ethics and commitment to transparency seriously. It can increase stakeholder confidence and employee loyalty.
• Detecting and preventing illegal or inappropriate activities:A complaints channel can help identify and address illegal or improper activities such as harassment, discrimination, fraud, corruption, and other unethical behavior.
• Reduce the risk of legal liability: If an organization does not have a complaints channel and illegal or inappropriate behavior occurs, it may be liable for malice - failure to take reasonable steps to prevent it. By having a complaints channel, the organization can demonstrate that it took appropriate measures to address any reported illegal or inappropriate activity.
• Protect complainers: complaints channels make reporting issues confidentially and anonymously possible. Reduce the fear of harassment or retaliation by the complainer.

Who should set up a complaints channel?

Organizations are not always legally obliged to have a complaints channel; however, some laws may require it nationally. In Spain, the new law stipulates the creation of a complaints channel for companies with more than 50 employees. Some examples of organizations that are required or recommended to create an ethical channel are:

• Listed companies: listed companies are required by law or stock exchange regulations to have a complaints channel for reports of violations of the law or company policies.
• Companies with public sector contracts: In some cases, companies with government contracts may be required to have a complaints channel as part of the public administration's legal and regulatory compliance requirements.
• Financial institutions: such as banks, lenders, and insurance companies, may be required by law and industry practice to have a complaints channel for reports of illegal activities, such as money laundering.
• Non-profit organizations: In some cases, non-profit organizations such as foundations or NGOs may be required to have a complaints channel to promote ethical behavior and transparency.

Operation of a complaints channel

The operation of a complaints channel may vary depending on the organization. It is vital that the organization establishes clear and consistent policies on the process of the complaints channel and communicates them to all employees and stakeholders. The organization should also ensure that the complaints channel is accessible and confidential and that measures are taken to protect complainers from retaliation.

Law 2/2023 states that complaints channels must comply with specific requirements and procedures to function correctly. The following are some of the most critical aspects of how a complainers channel operates under this law:

• Accessibility: The complaints channel must be accessible to complainers, both internally and externally to the entity, through different communication channels (email, telephone, online form, etc.).
• Confidentiality: The complaints channel must guarantee the privacy of complainers and the confidentiality of reports, protecting the identity and personal data of those affected. Confidentiality also applies to the information collected during the investigation.
• Anonymity: Complainants should have the option to report anonymously. However, they are encouraged to identify themselves to be provided with information on the status of the investigation.
• Procedural clarity: The organization should establish clear and detailed procedures for receiving, recording, handling, and resolving complaints. Procedures should be easily accessible and understandable to complainants.
• Investigation: Complaints should be handled appropriately and impartially, involving specialist complaint management and compliance staff, ensuring that evidence and information are sufficient and relevant.
• Reporting: If necessary, the organization should provide a detailed report to the complainants and the competent authority on the actions taken and the results obtained following the investigation.
• Protection: Complainants and persons involved in the investigation should be protected against retaliation or negative consequences for making a complaint in good faith.
• Training: The organization should provide adequate training to its staff to promote a culture of ethics and integrity and to know how to act in case of detection of misconduct.

Responsible for the complaints channel

Depending on the organization's structure and size, the management of a complaints channel may be the responsibility of different parties. The most common options are:

• Compliance department: In some companies, the compliance department manages the complaints channel and investigates reports received. This is because the department is designed to ensure that the organization complies with applicable laws and regulations and that internal policies and procedures are followed.
• Human resources department: The human resources department may manage the complaints channel, especially if the complaints relate to harassment, discrimination, or other employment-related issues.
• An outsourcer: In some cases, companies may hire another entity, such as a law firm or a company specializing in complaints channels, to manage the complaints channel. It can help ensure that reports are handled confidentially and that an objective investigation is conducted.
• Audit committee: In listed companies, the audit committee may oversee the complaints channel and ensure appropriate action is taken to address reports received.

The person or team responsible for the complaints channel must have the experience, skills, and independence to handle complaints appropriately and effectively. The management of a complaints channel should also be transparent and in line with the organization's internal policies and procedures and legal and regulatory requirements.

Who can use a complaints channel?

In general, anyone can use a complaints channel, and it can include employees but also customers, suppliers, contractors, or investors, among others.

Most entities have policies and procedures limiting complaints channels to specific organizational issues. For example, a complaints channel may be designed exclusively for reporting sexual harassment or discrimination in the workplace, and only employees may file such reports.

It is also common to allow anonymous reporting, although this may vary depending on the organization and the nature of the complaint. In some cases, complainants may be required to provide additional information to enable a proper investigation.

In any case, it is essential that the organization establishes clear and consistent policies on the use of the complaints channel and communicates these to all employees and stakeholders clearly and effectively.

Beneficiaries of a complaints channel

A complaints channel benefits multiple stakeholders

• The organization: A complaints channel enables the organization to quickly and effectively detect and address potential violations, irregularities, or unethical behavior, which can help prevent legal and reputational risks. In addition, an open and transparent complaints culture can enhance the trust of the organization's employees, customers, and partners.
• Employees: A complaints channel can be a valuable tool for employees who want to report inappropriate practices or illegal behavior within the company. It can improve the working environment and increase job security.
• Third parties: A complaints channel can enable customers, suppliers, and stakeholders to report possible illegal or inappropriate practices of the organization, which can help protect consumer rights, improve the quality of products and services, and protect the economy and society.

Those harmed by a complaints channel

A priori, creating a complaints channel should not harm anyone if appropriately implemented and promotes a culture of transparency and business ethics. However, some individuals or groups may feel uncomfortable or resentful about the existence of a complaints channel, especially if they believe that the organization is trying to control or police its employees or partners. Any individual or group that benefits from unethical or illegal practices within the organization may feel aggrieved by the existence of a complaints channel.

It is important to remember that a well-designed and managed complaints channel does not seek to accuse or punish anyone but to identify and prevent inappropriate practices and protect all stakeholders from potential legal and reputational risks.

The complaints channel and confidentiality

A complaints channel can implement several measures to protect the confidentiality of the complaints it handles, which is essential to encourage complainants to make a report in good faith without fear of retaliation. Some of these measures include: anonymity, restricted access to the account - so that only staff assigned to the complaint channel can access the information - and decrypting and encrypting communications between the complainant and the organization to protect the credibility of the system and provide confidential complaint handling and resolution.

The complaints channel and the EU General Data Protection Regulation GDPR

Implementing a complaints channel involves processing the complainer's data, subject to the EU General Data Protection Regulation (GDPR). Below are some measures that a complainers channel can implement to comply with the requirements of the GDPR:

• Complainer consent: before collecting, processing, or storing personal data, the complainer must give explicit and informed consent for that purpose.
• Complainer rights: The complainer channel must inform complainers of their rights under the GDPR, such as the right to access, rectify or delete their data. complainers should also be told they have the right to complain to a data protection authority if they believe their rights are not respected.
• Data security: The complaint channel must take technical and organizational measures to ensure the safety of complainants' data. This may include encryption of data, restriction of access to data, and staff training on data security.
• Protection of sensitive data: If sensitive data, such as information on health or religious convictions, is handled, the complaints channel must take additional measures to ensure its protection and comply with the GDPR rules for this type of data.
• Retention period: Personal data must be retained by the complaints channel for the time necessary to fulfill the purpose for which it was collected and per the provisions of the GDPR.

Complaints channel and document management

Is it possible to create a complaints channel with document management software?

Yes, it is possible, and if you do not have one, it is highly recommended to get one. Document management systems such as OpenKM enable efficient management of an organization's documents and information, including records of complaints.

A complaints channel created with OpenKM document management software would allow the receipt, tracking, and management of complaints in a centralized and online manner, with functions such as:

• Registration and tracking of complaints: OpenKM can enable the registration of complaints received, their classification, assignment, and monitoring.
• Notification of updates: OpenKM's document management software sends messages to stakeholders on the status of complaints, ongoing investigations, and resolutions.
• Security and confidentiality: OpenKM's document management system provides high levels of security and privacy, ensuring the confidentiality of complaints and protecting complainants.
• Recording and tracking actions: OpenKM can enable the management of actions taken in response to complaints and the documentation of actions taken.

The document management software must be configured appropriately to comply with data protection and privacy regulations and to ensure the integrity and confidentiality of the reports received. If you need to include a complaints channel in your organization, please do not hesitate to contact us.