Internal reporting, external reporting and public disclosure

1. Regulatory Concept & Core Standards

This video's topic is internal reporting, external reporting and public disclosure. By the end, you should be able to explain the differences between reporting routes and their conditions. We will connect the information available, the criterion guiding the decision and the action that must be recorded. Follow the case and compare your answer with the proposed response. Whistleblower protection has its own scope and conditions. An organisation may accept a wider range of concerns under its internal policy, but that does not mean they all automatically receive statutory protection. Keep this distinction when assessing the examples.

Internal reporting goes to the organisation's channel. External reporting goes to a competent authority. Public disclosure makes information available to the public and has separate conditions. The law allows direct external reporting in situations such as no internal channel, retaliation risk or certain offences. There is no universal duty to exhaust internal reporting first, nor unrestricted freedom to disclose publicly with automatic protection.

National rule: External reporting is subject to article 7 of Law No 93/2021. The competent authority depends on the subject. Acknowledgement of an internal report includes clear, accessible information about the requirements, authorities, method and admissibility of external reporting.

2. Practical Implementation & Procedure

First identify the purpose, risks and authority competent for the subject. Consult article 7 before explaining the choice of route. An internal channel using software from an outside supplier does not become an external reporting channel. The distinction depends on the recipient and legal regime, not on who hosts the technology. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

An employee has reasonable grounds to fear retaliation if she reports internally. She intends to contact the competent authority. Another employee wants to publish documents on social media because he considers the process too slow. These routes require separate assessments; the second decision does not automatically follow from the first. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: Does hosting by a technology provider automatically make a platform an external reporting channel? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

No. It may remain the organisation's internal channel. External reporting is addressed to a legally competent authority. Public disclosure is a third route with its own requirements, which must be assessed separately.

One mistake to avoid is: teaching an obligatory sequence without exceptions from internal reporting to external reporting and public disclosure.

An advice page is presented as the sole destination for every report. What check is missing?

The recipient's powers and role must be confirmed. Advice, external receipt, investigation and protection may belong to different bodies. Also check the national conditions for the selected route. User information must help people find the correct procedure without requiring steps that do not exist in law.