Whistleblower policy

Introduction

Eika Boligkreditt AS (EBK) believes that openness and good communication in the organisation promote its work culture. It therefore wants to lay the basis for a corporate culture where irregularities are raised, discussed and resolved.

Whistleblowing helps to support an open culture, where trust and dialogue prevail between employees and managers.  In this way, breaches of fundamental human rights and decent working conditions can be exposed. EBK therefore recognises the risk that its ethical policies may be breached, and is dependent on employees notifying irregularities so that the company can maintain a high ethical standard.

Whistleblowing involves speaking out about conditions in the workplace which are or could be in conflict with legislation and statutory regulations, the company’s policies or a general perception of what is acceptable or ethical.

Examples of conditions which should be notified include

• breaches of the law
• breaches of the company’s policies
• corruption or other financial criminality
• breaches of fundamental human rights and decent working conditions
• harassment or bullying, discrimination and racism, a poor working environment
• erroneous reporting or manipulation of information
• breaches of tax rules
• threats to life and health
• threats to the climate or the environment
• insider dealing
• breaches of the safety of personal data
• abuse of authority
• suspicion of the above conditions.

  The list is not exhaustive.
  

  This document comprises an overall policy on notifying irregularities, as well as a procedure for receiving such notifications and a form for notifying irregularities.

  Purpose and SCOPE of application

  An employee has the right to notify irregularities in the business pursuant to section A-1 of the Working Environment Act. Retaliation against whistleblowers exercising their right are prohibited.

  In some cases, the employee has a duty to notify. Pursuant to section 2-3(2) of the Working Environment Act, the employee must always report harassment, discrimination, and faults and deficiencies which could pose a threat to life and health.

  Reporting conditions which relate solely to the employee’s own terms of employment is not considered notification of irregularities pursuant to section 2-A of the Working Environment Act. This means that personal conflicts or disagreements concerning implementation of the contract of employment, for example, are not covered by the whistleblowing policy.

  This policy will lay the basis for employees of EBK to notify irregularities in an acceptable way and in line with the regulations, and help to strengthen genuine freedom of speech in labour relations.

  Whistleblowing channels

  At work, as elsewhere, the main rule is that people raise what they believe to be irregularities with the person concerned. If that does not yield results, or if the person believes that the case must be raised with others in order to be dealt with, they can blow the whistle.

  Employees in EBK have the following whistleblowing channels:

• immediate superior
• superior’s manager
• union officials
• safety representative
• head of risk and compliance
• legal department.

The employee themself must assess, in the specific case, what would be the right channel in the given circumstances. Problems will normally be raised with the immediate superior, or possibly the CEO or the chair if the issue concerns the CEO. Issues can also be raised with union officials, the safety representative, the head of risk and compliance, or the legal department.

If the employee is not confident that internal notification will result in action, they have the right to turn to the supervisory authorities or other public agencies. These could include the police, the National Authority for Investigation and Prosecution of Economic and Environmental Crime (Økokrim), the Norwegian Tax Administration, the Norwegian Labour Inspection Authority, the Financial Supervisory Authority or the Norwegian Data Protection Authority.

Acceptable procedure when whistleblowing

An employee must also take responsibility for their statements when whistleblowing. What is acceptable will depend on a specific overall assessment of whether the employee has an acceptable basis for their claims and has taken due account of the reasonable interests of the  employer and the enterprise in the way they make their notification.

Notifying the supervisory authorities or other public agencies without having first pursued internal channels is not normally considered acceptable. That applies particularly to direct notification of the media.

The employee must not make clearly inaccurate claims in order to damage the employer or one or more colleagues. Information which is of only personal or internal interest should not be made the subject of discussion in the public arena, since this could unnecessarily damage the working environment and the reputation of the enterprise.

Where a condition is perceived to involve a duty to notify, notification must be made as soon as the condition has been detected. Otherwise, determining whether and when to notify irregularities is a matter for the employee themself.

The Labour Inspection Authority has produced a guide (in Norwegian only) on acceptable whistleblowing behaviour.[1] This advises that the whistleblower should ask themself:

• do I have grounds for my criticism?
• how should I proceed?
• who should I notify?

The whistleblower’s identity is confidential to the person who receives the notification.

In the continued follow-up of the case, confidentiality and anonymity will apply as far as is possible given the nature and content of the notification. The main rule is that as few people as possible should know the whistleblower’s identity.

The whistleblower must be made aware of who may need to be informed of their identity in order to conduct a more detailed investigation of the issue. Such information may be provided in conformity with other legislation – if a police investigation follows, for example, or a legal process.

Whistleblowing cases must be kept in personal files in a sealed envelope and a locked archive in the human resources department. The latter will only open the case if this is considered necessary in connection with the assessment of a later personnel issue. The department has a duty of confidentiality concerning all personnel issues.

Recipients of notifications have a duty to keep the identity of the whistleblower confidential. When supervisory authorities or other government agencies receive an external notification of irregularities, everybody doing work or providing services for the recipient of the notification is duty-bound to prevent others from learning the identity of the whistleblower. This applies both to their name and to other information which could reveal their identity, and must ensure genuine protection of the whistleblower. The duty of confidentiality lasts as long as the case is under consideration by the supervisory authorities or other government agencies. 

Employees in EBK have the right to notify irregularities anonymously. With anonymous notification, the whistleblower must appreciate that the recipient cannot give feedback on the case or determine if the notification has been made in good faith. Furthermore, an investigation could prove difficult if the information cannot be tested or checked, and if the person following up the notification is unable to secure further information from the whistleblower.

The whistleblower should assess whether using the safety representative, the head of risk and compliance or the legal department can ensure sufficient anonymity.

The decision on which information is released lies with the whistleblower. In order to ensure sufficient information for EBK to take adequate follow-up measures, however, the notification should be as detailed as possible and, if available, supported by documentation/proofs.

A whistleblower who does not notify anonymously will, as far as is acceptable and advisable, receive feedback within a reasonable time on the consideration and outcome of the case.

It is also important that the whistleblower receives feedback if it transpires that they have been mistaken about the conditions notified. In such circumstances, it is important that the position is explained in a proper manner to the whistleblower, so that the latter can understand and accept that the case does not need further follow-up.

The person criticised will, as far as is acceptable and advisable, be given an opportunity to respond to the criticism.

The other party will normally be made aware of the accusations and the information provided about the case. They must be allowed to provide their own version. When consideration of the case has been concluded, the person criticised must be informed of the outcome.

It is also important that the person criticised receives feedback if it transpires that the whistleblower has been wrong about the conditions complained of. It can be a heavy burden to know that groundless accusations have been made.

Whistleblowing must be treated in accordance with the applicable procedure for receiving and following up such notification. It is not acceptable to react negatively to employees who raise, or who indicate in other ways that they are considering raising, irregularities in an acceptable manner. That also applies if it turns out that the whistleblower is mistaken about the conditions they have notified. Examples of unacceptable negative reactions include:

• passing them over for work assignments or pay increases
• threats, harassment, unfair differential treatment, social exclusion or other inappropriate behaviour
• warnings, changes to work duties, redeployment or demotion
• suspension, discharging, summary dismissal or disciplinary measures.

  This list is not exhaustive.

  Reprisals against an employee who raises, or who indicates in other ways that they are considering raising, irregularities is illegal. The employee must nevertheless tolerate objective arguments or evidence which run counter to the alleged irregularities.

  The company’s management is responsible for ensuring that the whistleblower is not subject to negative reactions from either managers or colleagues.

  Redress and compensation if the ban on reprisals is breached

  Should the ban on reprisals be breached, the employee may claim redress and compensation without regard to the company’s culpability.

  The redress will be determined by what is reasonable in relation to the relationship between the parties, the nature of the reprisal, the level of seriousness and other circumstances. Compensation must cover any financial loss resulting from the reprisal.

  Procedure for receiving notifications

  Introduction

  The person receiving a notification of irregularities must always ensure that the whistleblower is treated in a good and acceptable manner. It is important to ensure confidentiality and professionalism throughout the process.

  EBK applies the following basic principles for dealing with whistleblowing:

• all notifications are treated seriously
• they must be followed up equitably, openly and objectively
• anonymous whistleblowers must be protected
• the duty of confidentiality and information security must be maintained throughout the process
• whistleblowers acting in good faith must not be subject to reprisals
• whistleblowers will receive quick feedback and information on the process.

  Assessment of notifications received

  The recipient of a notification must make an initial evaluation to determine whether it qualifies as a case which must be dealt with in accordance with the whistleblowing process.

  This initial evaluation must include an assessment of the notification’s content and a risk assessment of the case. The case must also be logged. As part of this evaluation, the recipient of the notification must assess whether the case notified falls within their own area of competence and/or who can provide supporting competence if necessary.

  Follow-up questions and anonymity considerations must be identified and form the basis for further consideration of the case. All whistleblowing cases and information related to them must be treated as confidential, and handled with great caution.
  
  If the whistleblower wants to be anonymous, responsibility for preserving anonymity rests on the recipient of the notification. This involves not revealing the whistleblower’s identity to others, including their immediate superior, unless the whistleblower gives their explicit consent.
  
  The risk assessment will assume that the content of the notification is correct. On that basis, an assessment will be made of the risk to EBK.

  EBK bases its handling of whistleblowing on the following main principles:

• generally speaking, the problem should be resolved by the line organisation
• the safety representative, the head of risk and compliance or the legal department will request a meeting with the CEO, or possibly the chair as required, which considers the notified case
• if the case concerns legal issues, legal advisers should be consulted
• if the case concerns personnel issues, the HR department should be contacted
• ·other relevant people with expertise in the area concerned should be contacted.

  The person responsible for the notified case must assess a suitable procedure for investigating what has actually happened. This will often be through a meeting with the whistleblower and with the person notified about. The latter must be given an opportunity to put their side of the story to the extent that this is acceptable and appropriate.

  Feedback to the whistleblower

  Ensuring that the whistleblower receives adequate feedback is important. As soon as possible and without delay, they must receive confirmation that the recipient has received the notification. The whistleblower must be informed about which people are involved in a more detailed investigation of the case before the whistleblower’s identity is passed to, for example:

• the other party (the person notified about)
• their superior, the CEO or the chair
• ·other people asked to give support on the basis of their competence in the relevant case.

As far as possible, the whistleblower must be informed about the outcome when the case has been closed. No information will be given on the specific action taken, but confirmation provided that the case has been considered and closed.

Both the whistleblower and the individual who the case concerns can submit a written complaint to the board about the process and the treatment of the case.

If the initial evaluation of the notification indicates that it involves a medium or high level of risk, or concerns a possible breach of EBK’s policies or of applicable legislation and statutory regulations, the case must be investigated and followed up.

If further investigation is required, such as interviews or securing and analysing electronic evidence like e-mails, the board must be informed and will normally take responsibility for dealing with the case. Line management alone should not initiate formal investigations or engage external investigators.

When the safety representative, head of risk and compliance or legal department receives a notification, they are responsible for following up the whistleblower’s interests until reasonable solutions in relation to the notification are found.

Once the case has been closed, it is important that both the whistleblower and the person notified about receive feedback on the outcome. This must be done without communicating confidential information. The person notified about must, as far as is possible and expedient, be given an opportunity to respond to the criticism. When consideration of the case has been finalised, the person notified about must be informed of the outcome. This is particularly important if it transpires that the whistleblower has been wrong about the conditions they have notified,

If the recipient needs guidance on dealing with the notification, the HR department can be contacted for practical support. The whistleblower must be informed if it becomes necessary to reveal their identity in connection with seeking support.

Everyone involved in dealing with a notification is duty-bound to treat personal data in accordance with the Data Protection Act and its associated statutory regulations.

All sensitive information, except the final report, must be deleted as soon as the case is closed, and within the deadlines set by the Data Protection Act and its associated statutory regulations.

Documents and information from whistleblowing cases must not be entered in personal files or other filing/case management systems. Only details of the measures taken and decisions made as a result of the notification, as well as the final report, are filed in accordance with EBK’s normal procedures.

The log, initial evaluation, risk assessment and report must be stored electronically with restricted access in the computer system and otherwise maintained in a secure and confidential manner pursuant to applicable legislation and statutory regulations. If the case is subject to subsequent processes (such as legal action and disciplinary measures), the documentation must be stored until the case is finally closed.

The person notified about has the right to access all personal data held about them in connection with the whistleblowing case. Exceptions to the right to information and access are regulated by section 16 of the Norwegian Personal Data Act. Exceptions must be assessed on a case-by-case basis.

This policy was approved by the Eika Boligkreditt board on 22 June 2022 and came into force on the same date. It will be updated as and when required. 

The CAO is responsible for initiating necessary revisions of this document.