Whistleblowing Training and the Speak-Up Culture: A Nordic Guide

Most organisations above fifty employees in Finland and Sweden now have a whistleblowing channel. They bought one because the law required it, they published a link on the intranet, and a meaningful proportion of them have received almost nothing through it since.

That silence is usually read as good news. It is more often a measurement failure. People are still raising concerns, they are raising them to their line manager in a corridor, and whether anything happens next depends entirely on how that manager reacts in the first ninety seconds. If the manager reassures them it is probably nothing, the report never enters any system, the organisation never learns, and the legal protections that attach to a formal report never engage.

This is why whistleblowing training cannot be a single course. The channel is the easy part and it is already bought. The failure points are distributed across three completely different populations who need three completely different things.

Three audiences, three curricula

Everyone needs the shortest curriculum: that the channel exists and where it is, what kinds of concern belong there, that they do not need proof and are protected if they report in good faith on reasonable grounds, that retaliation is unlawful, and that they may report anonymously where your system permits it. Fifteen minutes, repeated, is enough. What matters is recall under stress months later.

Managers need the largest and most neglected curriculum, because they receive most first reports without any of the formality that would tell them a report is happening. They need to recognise that a corridor conversation is a report, to understand that their knowledge becomes the organisation’s knowledge, to know what they can honestly promise about confidentiality, to know they must not investigate it themselves, and to know that any adverse decision affecting that person from that moment carries risk. This is a skills module, not an awareness module, and it needs scenarios and practice.

Case handlers need procedural competence: intake, acknowledgement and feedback deadlines, independence, confidentiality of the reporter’s identity, evidence handling, data protection obligations, when to escalate, and how to close. They also need enough independence in fact, not merely in the org chart, to handle a report about a member of the executive team.

A vendor selling you one course for all three has sold you the first curriculum and left the two that actually fail unaddressed.

What the law requires, country by country

The EU Whistleblowing Directive is the common ancestor, but nobody complies with it directly. Each Nordic country transposed it separately, and the differences are operational rather than cosmetic.

Finland. The whistleblower protection act, 1171/2022, entered into force on 1 January 2023. Internal channels were required within three months, with organisations of 50 to 249 employees given until 17 December 2023. Finland operates a centralised external reporting channel at the Office of the Chancellor of Justice, which routes reports onward to the competent authority. That centralisation is distinctive and useful: a Finnish employee who does not trust the internal route has one obvious external destination rather than a list to navigate.

Sweden. Visselblåsarlagen (2021:890) entered into force on 17 December 2021. Internal channels were required for employers with at least 250 employees from 17 July 2022, and for those with 50 to 249 from 17 December 2023. Arbetsmiljöverket supervises whether employers have established channels at all, and also acts as the catch-all external authority for areas not allocated to another competent authority. The external side is distributed across a set of designated authorities by subject area rather than centralised.

Norway. Norway sits outside the directive’s threshold logic entirely. Under chapter 2A of the working environment act, undertakings with as few as five employees must have whistleblowing routines. A forty-person Norwegian subsidiary of a Finnish group therefore needs routines that the same-sized Finnish entity does not.

Denmark. The Danish whistleblower act applies the fifty-employee threshold with the same phasing for smaller employers, with an external scheme operated at national level.

For a Nordic group the consequence is direct: there is no single threshold rule, no single external authority, and no single set of routines that satisfies all four countries. Confirm the Norwegian and Danish positions with local counsel before relying on them, as these are the two most often summarised incorrectly in English-language material.

The deadlines that follow a report are more consistent, and are the operational numbers your case handlers must know: acknowledgement within seven days of receipt, and feedback to the reporter within three months.

What managers get wrong in the first conversation

Four errors account for most of the damage, and all four are trainable.

Promising confidentiality that cannot be delivered. A manager who says this stays between us has made a promise the organisation cannot keep and will be blamed for breaking. The honest formulation is that the reporter’s identity is protected and will be shared only with those who need it to handle the matter, and that the manager must pass the concern on.

Investigating it themselves. Well-intentioned managers start asking around. This contaminates evidence, alerts the subject, and exposes the reporter.

Doing nothing while they think about it. The duty is triggered by knowledge. A manager who sits on a concern for a fortnight has consumed the organisation’s response time and created a record of inaction.

Writing nothing, or writing badly. Notes should be contemporaneous and factual, and they should be written in the knowledge that the person concerned may eventually read them.

Teach the first conversation as a script: listen, do not promise confidentiality, do not investigate, thank them, tell them exactly what happens next, write it down, escalate the same day.

Confidentiality, anonymity, and the small-country problem

This is where Nordic practice diverges most from the international literature, and where being honest builds more trust than reassurance does.

In a Finnish or Swedish company of two hundred people, the details of a report frequently identify the reporter regardless of technical anonymity. If a concern relates to a specific contract, a specific site visit or a specific meeting, the population of people who could have known is small enough to be enumerated. Telling employees that their anonymity is guaranteed is a promise the physics of a small organisation cannot keep, and the first time it visibly fails, the channel dies.

The credible position is to distinguish clearly between confidentiality, which you can control and are legally required to maintain, and anonymity in substance, which you cannot always guarantee. Then explain what you do about it: independent intake through a third party, case handling outside the local entity where the report concerns local management, careful control of how much detail circulates, and above all, a serious anti-retaliation process. Employees weigh whether it is safe to report based on what they have seen happen to previous reporters, not on the wording of the policy.

There is a second Nordic cultural factor. Consensus-oriented workplaces with flat hierarchies produce a strong instinct to resolve things informally with the person concerned. That is often healthy. It also means the formal channel sees only the cases that informal resolution failed, which makes low volumes even less informative than they look.

Measuring whether it works

The metric that matters is usage, and boards routinely read it backwards.

A rise in reports after training is almost always a success signal. It indicates that people know the channel exists, understand what belongs in it, and believe using it is safe. A board that responds to an increase by asking what has gone wrong with the culture is punishing exactly the outcome the programme was designed to produce, and compliance functions should pre-empt that reading before the numbers are presented.

More useful indicators than volume alone: the proportion of reports that come through the channel versus reaching compliance by other routes, time from receipt to acknowledgement and to feedback, the proportion of reports substantiated, and whether reports come from across the organisation or from one function. Reports arriving from only one site usually means the other sites do not trust it rather than that the other sites are clean.

Building the programme

Deliver the all-staff module at onboarding and refresh it annually, and make the refresh short. Deliver the manager module as scenario-based training and refresh it when managers are promoted rather than only on a calendar. Deliver case handler training with real procedural depth, and make sure at least two people are trained so that one can be conflicted out.

Localise properly. Finnish and Swedish employees should be trained on their own national act, their own thresholds and their own external authority, not on the EU directive with a translated interface. Norwegian entities need their own version because their threshold and framework are genuinely different.

Then close the loop. Publish, at an aggregate level and without identifying anyone, that reports were received and acted on. Nothing else you do will build trust in the channel as quickly as visible evidence that using it produces consequences.

Frequently asked questions