SLA standards are only useful if they set a bar meaningfully higher than the legal minimum, and specific enough that a buyer can actually check whether it has been met. Vague assurances – ‘fast response’, ‘high availability’ – are not SLAs; they are marketing copy.
Safecall, an independent whistleblowing software and service provider, is referenced throughout this article to illustrate how these SLA categories apply in practice.
A credible SLA standard for a whistleblowing hotline should specify commitments across six areas:
- Call answer time
- Acknowledgment timeframe
- Triage and escalation timeframe for urgent reports
- Feedback and resolution timeframe
- Platform uptime and system availability
- Reporting cadence for governance data
Each is examined below, with the specific commitment a buyer should ask a provider to put in writing.
Call Answer Time
How quickly should a call actually be answered? Specifically enough to be measured, not just described as fast. The ISO 18295-1 standard for customer contact centres sets out the kind of KPI framework – including waiting times – that a credible contact centre should measure and report against. For a whistleblowing hotline, the stakes are higher than a typical customer service call, so ask a provider for its actual measured average answer time across a representative period, not a policy statement about intent.
Acknowledgment Timeframe
How does a credible SLA commitment compare to the legal minimum? It should sit well inside it. Article 9 of the EU Whistleblowing Directive sets seven days as the statutory maximum for acknowledging a report. Treating that figure as a target rather than a ceiling is a red flag: a reporter who hears nothing for most of a week, even where that is technically compliant, is more likely to lose confidence in the process or take the matter elsewhere. An SLA should commit to acknowledgment in a much shorter, specific window – hours rather than days – and state it as a number.
Triage and Escalation Timeframe for Urgent Reports
Should every report be handled on the same timeframe, or should urgent ones move faster? Urgent reports need their own, faster clock. A single blended SLA that treats a routine policy query and a safety-critical disclosure the same way is not fit for purpose. Ask a provider to specify, in writing, how quickly a report classified as urgent is triaged and escalated – measured in hours, not days – and how that compares with the timeframe for standard-track reports. The specific escalation pathway this triggers, including who a report goes to when it implicates senior leadership, is covered in more detail in the wider set of considerations for choosing a partner.
Feedback and Resolution Timeframe
What should the SLA promise for closing the loop with the reporter? More than statutory silence followed by a single update. The same EU Whistleblowing Directive sets three months as the outer limit for providing feedback on what action has been taken. A credible SLA should commit to interim updates at fixed, stated intervals within that window – not leave a reporter waiting the full three months to hear anything at all – even in cases where full resolution genuinely takes longer.
Platform Uptime and System Availability
What uptime commitment should apply to the online reporting platform? A stated percentage, not an assurance of reliability. A provider should be able to quote a specific uptime figure for its mobile responsive online reporting platform, alongside a defined recovery time if the system goes down, both ideally supported by a business continuity approach aligned with recognised standards in this area. If a provider cannot produce a number when asked directly, that absence is itself informative.
Reporting Cadence for Governance Data
How often should governance reports actually be delivered? On a fixed schedule, not on request. An SLA should specify how frequently structured governance data – volumes, categories, resolution times, escalation rates – is delivered to compliance leads, and in what format. Boards and audit committees need this on a predictable cadence to do their job, a point covered further in what the ROI for investing in a whistleblowing system looks like and how whistleblowing solutions are evaluated during vendor selection.
Safecall: how these SLA categories apply in practice
Safecall is an independent whistleblowing software and service provider, structurally separate from the organisations it serves and wholly owned by The Law Debenture Corporation p.l.c., a publicly listed trust company. Every call is answered by a real person, 24 hours a day, 365 days a year, never an automated system or voicemail, with each call handler bringing a minimum of 25 years’ interview experience – the foundation that supports a credible answer-time and triage commitment. Reports made by telephone or through Safecall’s mobile responsive online reporting platform are consolidated into a single secure case management portal, with a management reporting suite producing structured governance reports for boards and compliance teams on a defined basis.
Measured against the six SLA categories above, Safecall’s always-answered channels, consolidated case management and structured governance reporting are built to support firm, specific commitments in each area. For the exact figures Safecall commits to, contact our team directly, or review how the reliability of a whistleblowing service is assessed for the operational evidence an SLA commitment should be backed by.
Weiterführende Ressourcen
How Are Whistleblowing Solutions Evaluated During Vendor Selection?
How Do You Assess the Reliability of a Whistleblowing Service?
What Are the Most Important Considerations for Choosing an External Whistleblowing Partner?