Internal reporting, external reporting and public disclosure

1. Regulatory Concept & Core Standards

This video's topic is internal reporting, external reporting and public disclosure. By the end, you should be able to explain the differences between reporting routes and their conditions. We will connect the information available, the criterion guiding the decision and the action that must be recorded. Follow the case and compare your answer with the proposed response. ZZPri has its own protection and handling conditions. An organisation may receive a wider range of concerns, but not every concern automatically has the same legal status. Distinguish reporting, fact assessment and participants’ rights.

Internal reporting is addressed to the organisation, external reporting to a competent authority and public disclosure to the public. Direct external reporting is governed by article 13 and public disclosure by article 18 ZZPri. Protection for a social-media publication must not be assumed automatically.

Apply the following rule: Article 13 permits direct external reporting where the internal route is absent, would be ineffective, or the person believes there is a risk of retaliation. Choose the authority by the subject of the breach. KPK is not the sole authority for every matter; it also provides support and statutory protection functions. Public disclosure has separate article 18 conditions. Advice, statistical reporting and reporting a breach are different services.

2. Practical Implementation & Procedure

Identify the objective, risks and competent authority. Consult national conditions before explaining the choice of route. A channel hosted by a technology provider may still be internal. The distinction depends on who receives reports and makes decisions, not on where the channel is hosted. Public disclosure requires its own assessment, even where external reporting would have been admissible. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

An employee fears retaliation and wishes to contact a competent authority. A colleague wants to publish documents because the process seems slow. These are different decisions with different conditions. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: Does external hosting turn a platform into external reporting? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

No. It may still operate the organisation’s internal route. External reporting goes to a competent authority; public disclosure is assessed separately.

One mistake to avoid is: teaching an obligatory sequence without exceptions from internal reporting to external reporting and public disclosure.

Now apply the national rule to a second decision. An advice page is listed as the sole recipient of every report. What is missing?

A competence check. Select the authority by the breach and article 13 external-route conditions. KPK has support and other statutory duties but is not the only competent authority. Distinguish advice, reporting and public disclosure.