Internal reporting, external reporting and public disclosure

1. Regulatory Concept & Core Standards

This video's topic is internal reporting, external reporting and public disclosure. By the end, you should be able to explain the differences between reporting routes and their conditions. We will connect the information available, the criterion guiding the decision and the action that must be recorded. Follow the case and compare your answer with the proposed response. The national regime has its own scope and conditions. An organisation may accept a broader range of concerns under its policy, but this does not mean that all of them automatically receive the same legal protection. The assessment distinguishes receiving information, following it up and respecting people's rights.

An internal report goes to the confidential person. An external report goes to the Ombudswoman and can be made directly. Article 12(4), added in 2025, extends protection to direct reports to the police or State Attorney’s Office within their competence. Public disclosure has separate Article 26 conditions.

Apply the following rule: The Ombudswoman is the competent external reporting authority and can be approached directly without prior internal reporting. The November 2025 amendment extends the same protection, subject to statutory conditions, to direct reports to the police or State Attorney’s Office within their competence. Where those bodies are informed of retaliation or its risk, they must forward the report to the Ombudswoman without delay. Do not generalise this rule to every direct report to any authority. Public disclosure has separate Article 26 conditions.

2. Practical Implementation & Procedure

Identify the recipient and competence. Do not require internal reporting first for access to the Ombudswoman. Assess direct reports to other bodies separately. A technology supplier running the organisation’s system does not thereby become the statutory external authority. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

An employee has reasonable grounds to fear retaliation if she reports internally. She intends to contact the competent authority. Another employee wants to publish documents on social media because he considers the process too slow. These routes require separate assessments; the second decision does not automatically follow from the first. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: Does hosting by a technology provider automatically make a platform an external reporting channel? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

No. It may remain the organisation's internal channel. External reporting is addressed to a legally competent authority. Public disclosure is a third route with its own requirements, which must be assessed separately.

One mistake to avoid is: teaching an obligatory sequence without exceptions from internal reporting to external reporting and public disclosure.

Now apply the national rule to a second decision. An advice page is presented as the sole destination for every report. What check is missing?

The recipient's powers and role must be confirmed. Advice, external receipt, investigation and protection may belong to different bodies. Also check the national conditions for the selected route. User information must help people find the correct procedure without requiring steps that do not exist in law.