Compliance officers know that internal reports are the fuel upon which your compliance program runs – the more reports you receive, the better you understand the compliance issues within your organization and the faster you can address them.
This means your internal reporting system should include reports employees make to their managers, rather than to your hotline directly – but how does one do that, exactly? What steps should the chief compliance officer take to ensure that you do hear about all those complaints going to managers? It’s certainly a question worth answering.
As documented in the NAVEX 2025 Whistleblowing & Incident Management Benchmark report, organizations that track all methods of internal reporting receive an average of about 1.2 more reports per 100 employees than organizations that only track reports received via telephone hotline and web channels. See Figure 1, below.
In one sense, Figure 1 is obvious: if you track more intake channels, of course you’ll end up counting more reports. On the other hand, consider the implications of those additional 1.2 reports per 100 employees at scale.
In a business of, say, 40,000 employees, that’s the difference between getting 884 reports (an average of 2.21 reports when including reports to managers) versus only 416 (an average of 1.04 reports counting hotline and web submissions only). Including employee reports to managers would more than double the total number of reports you could capture, analyze, and address.
Don’t you want to know those other reports might tell you? More bluntly, do you want to tell your board and regulators you’re not capturing that information?
So that’s why your internal reporting system should capture reports to managers. Now let’s get back to the original question of how to do so.
Start with training
One challenge is that managers might not understand when they’ve received an employee report. We in the compliance community use the word “report” as if all reports come in a standard structure. In the real world, they don’t.
Some employees might come into their manager’s office talking about some other issue, afraid to say what’s really on their minds. Others might launch into a rapid-fire commentary about so many things you can barely catch when they raise a serious issue. Still more might come with only a fragment of a complaint, where managers would need to coax out the full story; and others might arrive with a box of evidence, only half of it relevant.
Managers have to deal with all of that – and while managers are crucial to a strong speak-up culture, that doesn’t mean they have an easy job. They need help, and one form of such help, is training.
Specifically, managers (first-time managers especially!) need training to understand both what a misconduct issue is and how an employee might raise it. They need to distinguish between issues that truly are within their purview (“Someone keeps cooking fish in the office microwave!”) versus those that must be passed along to compliance for your attention (“It’s not fair that our vendor only takes Bill out to the luxury suite at the baseball stadium!”).
Give managers an easy reporting method
This might seem self-evident, but you do need to give managers an easy way to communicate reports they hear to your internal reporting system/investigators. For example, you could have managers use a dedicated online reporting tool, or perhaps even the hotline itself, with certain special fields to denote “this is a report first received by a manager.”
Or if all else fails, let the managers call you or your team to pass along the issue they’ve heard.
Use other compliance levers
We can’t ignore the scenario where a manager does hear a misconduct complaint, recognizes that’s what it is, and chooses not to report the matter to compliance anyway. The challenge here is how to structure incentives so that managers will elevate and report issues.
One way to do this is to use other parts of your compliance program as levers, driving managers to see the wisdom in working with compliance rather than trying to keep an issue quiet and handled locally.
For example, you could adopt a policy for managers stating, “Whenever an employee brings a complaint of harassment to you, you must report it to compliance or HR.” You could then amplify that policy for managers through a training and awareness campaign for employees: “If you’re experiencing harassment, you can always bring your concern directly to us.”
Suppose an employee reports harassment to their manager, who then sits on that report; and ultimately the employee brings the matter to you directly. You can now have a stern conversation with the manager who violated policy, perhaps with a written warning to underline your point: managers must report misconduct allegations they hear.
Another benefit to this approach is an employee might also say, “I just didn’t feel comfortable reporting this to my manager at all.” That’s a valuable insight too! You can unpack why that happened, and whether the manager needs more training.
Remember: integrity matters
Another scenario is that the manager receives a report but doesn’t report it because they’re afraid to speak up. After all, we talk constantly about how employees are afraid to report because they fear retaliation. Managers who receive unwelcome news might fear that they’d suffer the same fate.
So, to a great extent, your effort to bring middle managers into the internal reporting process only succeeds when senior management affirms – to middle managers specifically, and ideally to the whole enterprise – that conveying “bad news” up the chain of command is a good thing. However, this only succeeds when senior management emphasizes a culture of integrity, honesty, feedback, and excellence.
If you get this piece of your organization’s culture right, and configure the various parts of your compliance program to amplify each other, you can capture those reports to managers and get a clearer sense of your company’s true compliance risks. Then you’ll be in far better shape to address them.
An all-in-one report intake and investigation management platform
Let’s face it – managing report intake, investigations and outcomes is a complex feat – whether your business has 100 employees or 100,000. NAVEX One Whistleblowing & Incident Management solutions enable better reporting experiences, investigations documentation and so much more. But wait, there’s more! Our Ethics & Compliance Training solutions also equip your managers with what they need to recognize when reports need to be elevated and how to do so properly.
