For compliance officers evaluating whistleblowing solutions for the first time – or considering a move from manual processes to dedicated whistleblower case management software – understanding what case management software actually does, and how it fits into the broader reporting framework, is a practical starting point.
This resource walks through the core components of a whistleblower case management platform, from the moment a concern is raised through to case closure and programme-level reporting.
The Reporting Layer: How Concerns Enter the System
Case management software sits behind the reporting channels that employees and other stakeholders use to raise concerns. These channels typically include a secure online portal, a dedicate
d telephone hotline, and in some cases email or postal intake. The platform’s role is to receive reports from all available channels and consolidate them into a single, structured environment for management.
When a reporter submits a concern through an online portal, they typically complete a guided form that captures the nature of the concern, the individuals involved, when and where the matter occurred, and any supporting evidence. The form may offer the option to report anonymously or to provide contact details for follow-up. The completed submission is encrypted, logged with a unique case reference and timestamp, and made available to the designated case handler.
Telephone reports follow a different path but arrive at the same destination. A call handler receives the report verbally, asks clarifying questions in real time, and enters a structured written summary into the system. The quality of this summary depends heavily on the call handler’s skill and experience. Where call handlers have professional backgrounds in investigative interviewing – such as Safecall’s team of former UK police officers, each with over 25 years’ experience – the resulting report is typically more detailed, better structured and more immediately actionable than one captured by a general call centre operative.
Regardless of channel, each report enters the case management platform as a new case, ready for the next stage.
Triage and Assignment
Once a case is created, the compliance officer or designated case manager reviews the report and makes an initial assessment. The platform supports this through configurable fields for categorisation: the type of concern (fraud, harassment, health and safety, regulatory breach, conflicts of interest), its assessed severity and the appropriate response pathway.
Based on this categorisation, the system can route the case automatically. A report alleging financial fraud in a specific business unit might be assigned directly to the head of internal audit, while a workplace harassment concern could be routed to a specialist HR investigator. High-severity cases can trigger immediate escalation notifications to senior management or legal counsel. This routing is configurable by the organisation – the software provides the framework, but the business rules reflect the organisation’s own governance structure and reporting lines.
At this stage, the system also begins tracking regulatory deadlines. Under the EU Whistleblowing Directive, receipt must be acknowledged within seven days. The platform calculates this deadline automatically and sends alerts as it approaches.
Investigation Management
For cases that proceed to investigation, the platform provides a structured workspace. Core capabilities at this stage include:
- Evidence storage: Documents, photographs, email correspondence and interview notes can be uploaded to the case file. Each item is time-stamped, linked to the specific case, and accessible only to authorised personnel.
- Task management: Investigators can create and assign tasks within the case – scheduling interviews, requesting documents, setting review milestones – with deadlines and status tracking visible on a centralised dashboard.
- Secure communication: Many platforms include two-way messaging features that allow the case handler to communicate with the reporter without revealing the reporter’s identity. This is particularly valuable when additional information is needed to progress the investigation.
- Access controls: Role-based permissions ensure that only those directly involved in the investigation can view case materials. Audit logs record every access event, creating an accountability trail.
- Activity log: Every action taken on a case – from a status change to a document upload to a note added by an investigator – is automatically recorded with a timestamp and user identifier. This creates the contemporaneous record that is essential for both regulatory compliance and legal defensibility.
Resolution and Closure
When an investigation concludes, the case handler records the outcome within the platform: substantiated, unsubstantiated, partially substantiated, or referred for further action. The EU Whistleblowing Directive requires that feedback on actions taken or planned is provided to the reporter within three months – the platform tracks this deadline in the same way it tracks the initial acknowledgement requirement.
Closure triggers the data retention phase. Configurable retention schedules determine how long the case file is retained based on its outcome. Reports that were assessed and closed without investigation are typically retained for a shorter period than substantiated cases that led to disciplinary or legal proceedings. When the retention period expires, the platform can flag the case for review or, depending on configuration, automatically archive or delete the data in line with GDPR storage limitation requirements.
Programme-Level Reporting and Oversight
Beyond individual case management, the platform aggregates data across all cases to provide programme-level intelligence. Reporting dashboards typically present:
- Total report volumes by period, channel and category
- Average time from receipt to acknowledgement, and from receipt to closure
- Deadline compliance rates (percentage of cases meeting seven-day and three-month obligations)
- Case outcomes by category and department
- Trend analysis showing changes in reporting patterns over time
This data serves multiple audiences. The compliance officer uses it to monitor programme performance and identify operational improvements. Senior leadership and the board use it to assess whether the whistleblowing programme is functioning effectively as part of the organisation’s broader governance framework. Where an organisation is subject to regulatory oversight – from the FCA, for example, or an EU supervisory authority – the ability to produce comprehensive programme data on demand demonstrates a mature, well-managed compliance function.
What Sits Beneath: Security and Infrastructure
All of the above depends on a secure, reliable infrastructure. Core requirements include end-to-end encryption for data in transit and at rest, hosting within a jurisdiction that meets the organisation’s data residency obligations, information security accreditation (ISO 27001 is the widely recognised standard), and the operational resilience to guarantee availability around the clock. For multinational organisations, the platform must also support multiple languages and accommodate the regulatory variations of different jurisdictions without requiring separate installations.
The infrastructure is largely invisible to the end user, but it underpins every interaction with the system. A platform that is technically sound but insecure – or secure but unavailable when a reporter needs it – fails to deliver on its fundamental purpose.
Related Resources
- Whistleblowing Technology & Channels Hub – Overview of reporting channels and technology selection.
- How Can Case Management Software Help with Workplace Investigations? – Supporting investigation processes in detail.
- How Can Digital Case Management Streamline Investigations? – Efficiency gains from moving to a digital platform.
- How Can Case Management Software Support Legal Compliance? – Mapping platform capabilities to regulatory requirements.
How Safecall Can Help
Safecall’s integrated whistleblowing service combines a secure case management platform with the multi-channel reporting infrastructure and professional expertise that organisations need to manage concerns effectively. Every report – whether received through our 24/7 telephone hotline, staffed by former UK police officers with over 25 years’ interview experience each, or through our secure online portal – enters a single system designed for compliant, efficient case handling. ISO 27001 certified, GDPR compliant, hosted on UK-resident servers and serving organisations across over 150 countries in 175 languages, Safecall delivers the complete service behind the software.
To see how Safecall’s case management works in practice, contact our team or call +44 (0) 191 516 7720.
Sources and Further Reading
- EU Directive 2019/1937 on the Protection of Persons Who Report Breaches of Union Law, Articles 9, 11 – eur-lex.europa.eu
- EU General Data Protection Regulation (GDPR), Articles 5, 25, 32 – gdpr-info.eu
- Gartner, Whistleblowing Software Reviews 2025 – gartner.com
- European Data Protection Supervisor (EDPS), Guidelines on Processing Personal Information within a Whistleblowing Procedure (2019) – edps.europa.eu