Whistleblower hotline intake and triage, explained.

What whistleblower hotline intake and triage is: the hours between a report arriving and someone owning it

A speak-up report's path, from the first message to the case file

1. A concern is raisedBy phone, web form, email or a word to a manager, in any language, with or without a name.
2. Intake and triageRead, translate, label, link to earlier reports, mask what is not needed, keep conflicted people out, score, propose an owner and acknowledge. This step is what this guide is about.
3. A named person routes itThe intake lead confirms the owner, merges a duplicate, or sends a plain question to the helpdesk.
4. The investigationThe owner gathers evidence, interviews people and reaches a finding. Most of the calendar time is here.
5. Feedback and fixesThe reporter hears what happened as far as the law allows, and the company corrects what it found.

Later steps have their own guide, on compliance investigation case management.

Why a rising report count can be good news, and three more hotline surprises

Four hotline words used throughout this guide

Fourteen terms are defined in the summary at the end of this guide.

Where speak-up reports come from: phone now carries only a quarter of them

In short"Hotline" is the word people search for, and most reports no longer arrive by phone. Web forms and "other" channels, which include a conversation with a manager, now carry three quarters of reports, and the reports raised in person are the likeliest to be substantiated.

In NAVEX's 2026 benchmark, drawn from 4,052 organizations and 2.37 million reports received in 2025, phone calls fell to 25.4% of reports by frequency, from 34% in 2022. Web intake reached 33.8%. The "other" group, which covers open-door conversations, email, mail and walk-ins, reached 40.8%.4 In the 2026 study of fraud cases by the Association of Certified Fraud Examiners (ACFE), whistleblowers who used a formal mechanism also chose the phone least of the three: 46% used a web form, 34% email and 23% a telephone hotline.6

For intake, this has two consequences. The first is that a report raised with a manager has to be captured at all. Organizations that track every source record a median of 2.36 reports per 100 employees, more than twice the 1.06 at organizations tracking only web and hotline.4 Some of that gap may reflect how each group defines a report, but a manager's note that never reaches the log is a report nobody can count, link or defend.

The Office of Inspector General at the US Department of Health and Human Services (HHS-OIG) says all disclosures should be logged "regardless of how they are made".7

The second is that channels differ in what they deliver. A phone call becomes a transcript or an interviewer's notes. A web form may carry a screenshot. A conversation with a manager arrives filtered through that manager, who may be close to the person named.

NAVEX also reports that third parties, such as suppliers and customers, make up about 10% of reporters with an identified relationship, and raise a disproportionate share of accounting and business integrity concerns.4 In a drug company, that can mean a distributor's employee reporting something a sales team would never put in writing.

The rules that set the hotline's clocks, and what changed in 2025 and 2026

In shortEU law sets the acknowledgement and feedback limits. US law sets no hotline deadline, yet its 120-day windows reward speed when a reporter may also go outside. Japan's stricter law starts December 1, 2026, and a European Commission evaluation of the EU directive is due by the end of 2026.

The directive itself is under review. The Commission's July 2024 report regretted the "overall very late transposition", meaning that countries wrote it into national law late, and said it would assess how the directive functions by 2026.33 A tracker reported in September 2025 that the evaluation is due to be completed by the fourth quarter of 2026.12 The Commission's whistleblower page, read November 3, 2026, shows no result yet.34

The European Economic and Social Committee adopted its own report on June 18, 2026, calling for shared or sector-level channels for small firms and for better-funded national bodies.35 None of this has changed a deadline yet.

Enforcement of the Foreign Corrupt Practices Act (FCPA), the US law against bribing foreign officials, fell sharply: one law firm's tally counts eight actions in 2025, against 96 across 2021 to 2024, with none from the SEC, after an executive order of February 10, 2025 and new DOJ guidelines of June 9, 2025.36

The statute itself still stands, and the EU went the other way with its 2026 Anti-Corruption Directive, whose bribery fines reach 5% of worldwide turnover or 40 million euros.13 A hotline serving 60 countries cannot route on the assumption that one enforcer has gone quiet.

Five clocks on one report: counting 72 hours, 7 days, 3 months and 120 days from October 7

In shortOne web report received at 2:14 am on October 7, 2026 starts several counts at once. They run from different events, they apply to different kinds of report, and one of them belongs to the reporter.

Take the fictional report from the start of this guide, received on Wednesday, October 7, 2026, and add one assumption: suppose it also said that patient files were being passed around a chat group. Here is how each clock works out.

Three working lessons follow. Date the receipt from the moment the report reached your channel, including your provider's system, since a report that sat overnight has already spent part of its time. Treat "acknowledged" as a message the reporter can see, and keep proof of when it went. And give the 120 days to the person who owns the investigation, with counsel, from the first day. Most reports will never need that decision, but the ones that do will not announce themselves.

A global company can apply the EU's seven days and three months everywhere, as a policy, so that a report from Mexico and a report from Spain are treated alike. No rule we read requires that outside the EU. It does make the promise to reporters simple.

Anonymous reporters and indirect identity: what masking a name does not cover

In shortMore than half of reports carry no name, and national law decides whether a company must follow them up. Confidentiality reaches past the name to anything from which identity can be worked out, so an intake team has to read for clues as well as for names.

Article 6(2) of the EU directive leaves it to each member state to decide whether companies must accept and follow up anonymous reports. A reporter who was anonymous and is later identified keeps the protection against retaliation.5 Germany says its reporting offices "should" handle anonymous reports and that there is no duty to build a channel for them.38

In the US, DOJ's first question is whether the company has an anonymous mechanism, "and, if not, why not?"22, and HHS-OIG asks for at least one anonymous path independent of the business.7

Anonymity needs a way back. Providers give reporters a key to a portal, where they can read questions and answer. NAVEX's follow-up rate measures how many come back at least once: 31% at the median in 2025, a five-year high, and still below the 36% of 2019.4 So most anonymous reporters are never heard from again, and each question has to count.

The sentence that gives a reporter away

Article 16 of the directive protects the identity of the reporting person, and "any other information from which" it may be deduced, from anyone beyond authorized staff.15 That last part is hard in practice. "I am the sales representative in the south district, and I was on the agenda for that meeting" names nobody, and may identify exactly one person.

A translation can add to the problem. Portuguese "sou representante" says nothing about gender, while an English summary written by a person or a tool may say "her manager" and "her bonus". The Japanese amendment, effective December 1, 2026, goes further, and prohibits acts aimed at identifying a whistleblower without just cause.21,9

Good practice is to separate three things: what the reporter wrote, kept unchanged and seen by few; a fact summary for the investigator, with self-identifying detail removed or generalized; and what wider groups are told. HHS-OIG adds a caution for the reporter: the company should say plainly that identity may have to be revealed in some cases, such as when the government requires it.7 EU law says the same in narrower terms, with notice to the reporter first unless that would jeopardize the investigation.15

The same care applies to the data around a report. Article 17 says personal data "manifestly not relevant" to a report should not be collected, and should be deleted without undue delay if it was.16 A witness's medical leave is a good example: it explains why the witness cannot be reached, and nobody needs the diagnosis.

Records must be kept no longer than is necessary and proportionate.39 Germany sets three years after a case concludes, longer where necessary and proportionate.32 France's regulator revised its guidance in July 2023 and dropped both the two-month deletion rule and the systematic impact assessment found in older summaries, so check which version your policy quotes.40

Translating a speak-up report: why the original sentence stays the record

In shortNothing we read sets a translation standard for hotline reports, and there is no public figure for how often they are mistranslated. Published tests of machine translation in another setting show accuracy varying widely by language, so the reader must always be able to see the reporter's own words.

Where a company routes in one working language, often English, a report in another language waits for a translator, or goes through a machine, before anyone can label it. The directive's Article 9 sets the clock and says nothing about language, so the wait counts against the same seven days.1

The closest public test we found comes from a hospital setting, and a reader should weigh it as such. Researchers at a US medical center had native speakers score Google Translate on 400 translated discharge statements. Overall meaning survived in 82.5%, from 94% for Spanish to 55% for Armenian.41

The study was published in 2021, so the tool has changed since, and the text was short instructions, which is far from a frightened employee's account of a dinner. The finding worth keeping is the spread: a tool that does well in one language can do badly in another, and a team that tests only in Spanish will not see it.

Three kinds of phrase a hotline translation can lose

Five rules for handling a translated hotline report

1. Keep the original unchanged, and treat it as the record.
2. Show the original and the translation sentence by sentence, so a reader can check any line.
3. Mark an idiom or a phrase the translator is unsure of, and have someone who reads the language check it before a decision rests on it.
4. Reply in the reporter's language, with an English line for the team.
5. Sample a share of translations each quarter, in every language you receive, and have a native speaker score them.

What matters in the end is whether the same concern lands in the same place, which is the subject of the next section.

One issue list for every language: how hotline reports get classified, and why half land in Other

In shortThe issue type decides who owns a report. Over half of reports in NAVEX's data sit in catch-all types, and NAVEX itself raises the possibility of inconsistent classification. A short issue list with plain definitions, applied after the meaning is understood, is the fix.

NAVEX counts reports in 24 risk types, plus two extra categories added by its health care provider customers. Leave those two out, and three catch-all rows hold more than half of what remains: "Other Human Resources" at 26.9%, "Other Business Integrity" at 21.0% and "Other" at 4.55%.4 Some of that is honest, since people raise concerns that fit no box. Yet NAVEX notes that when a catch-all starts showing higher substantiation and heavier outcomes, as "Other" did in 2025, it may point to emerging risks "or inconsistencies in classification practices".4

A catch-all hides things from the people who should see them. If "a fee to a pharmacist" goes into a general business integrity row, it may never trigger the rule that tells Legal about a public official. If a report in Portuguese gets that row and the same story in English gets "bribery", the company is treating reporters differently by language, and an auditor comparing the two will find it. DOJ asks directly how the company "assessed the seriousness of the allegations it received".22

The issue types a drug or device company usually needs

One report often carries several types. A fee to a public-hospital pharmacist, a falsified attendance list and a threat about a bonus are three types in a few lines. Decide which is primary, since it sets the owner, and keep the rest, since each may tell someone else to act.

Classify from the meaning of the sentence, in one step with translating it where you can, so that nobody labels a report from a summary of a summary. And write down a definition for each type with two examples, in English and in your largest languages, so two reviewers can reach the same answer. Then measure whether they do.

Scoring severity with a reason for every point: a 95 of 100 worked through

In shortNo law gives a scoring formula. A simple additive score works if each point cites the sentence behind it, any factor can be challenged, and everyone remembers that the score sorts a queue and proves nothing.

A severity score answers one question: which report needs a senior person today? Here is one transparent method, using the fictional report from the start of this guide. The issue type gives a base, each factor found in the report adds points, and fixed lines mark the bands. In this method High starts at 60 and Medium at 35. Your weights will differ.

Add them: 20 + 15 + 20 + 10 + 15 + 10 + 5 = 95. Now test it. Suppose counsel decides that this pharmacist is not a public official. Take off 20, and the score is 75, still High, so the routing stands and only the note to Legal changes. Suppose the earlier report also turns out unrelated. The score is 65, still High. A score that stays in its band when you remove a doubtful factor is telling you the decision is sound.

A second fictional report shows the opposite: a tender offer scored 20 + 15 + 20 + 5 = 60, exactly on the line. Remove any one factor and it falls to Medium. That report deserves a person's careful look, whatever the band says.

Beware what scores can hide. A study of risk matrices found that typical ones can correctly compare fewer than 10% of random pairs of hazards, and can rate a smaller risk above a larger one.44 An additive score has its own weaknesses, chiefly that it treats unlike things as if they could be summed. A low-scoring report can still be urgent. So let a person override the score in either direction, record why, and review each quarter which reports were moved and whether the move was right.

Those closure times are the reason early scoring matters. A bribery case is slow by nature, so three days lost at the start look small against 68. Yet those are the days when documents and messages are easiest to preserve, and where DOJ's 120-day window applies, they come out of it.2

Who must be kept out of a report, and how retaliation shows up at intake

In shortBefore a report moves, someone must check who manages the person named and whom the reporter asked to exclude. Retaliation can appear inside the first report, and it gets close attention from prosecutors and from the law.

The org chart check before any routing

The directive requires an impartial person or department to follow up, and asks that the channel keep the identities of people named confidential too.1 In practice, this means answering three questions before a report leaves intake.

DOJ asks how a company ensures investigations are "independent, objective, appropriately conducted, and properly documented", and "who should conduct an investigation, and who makes that determination".22

Two things make this hard. HR data goes stale, so a recent reorganization can put the wrong person in the line or leave the right person out. And loyalty does not appear on any chart.

Retaliation inside the first report

Article 19 of the directive lists demotion, withheld promotion, changed hours, poor assessments and threats among prohibited retaliation.42 A remark that a bonus is "under review" after a question about a meeting belongs on that list, if it happened. NAVEX's data shows retaliation at about 1.2% of reports, with a median 35 days to close and 16% substantiated.4

NAVEX reads that gap as a warning: given how much fear of retaliation shapes reporting, it asks boards to ensure these allegations are examined with rigor, and adds that low reporting does not necessarily mean low risk.4 DOJ's questions go further, asking whether employees who reported internally are treated differently from others involved in misconduct who did not.22

Four things intake can do about retaliation

1. Flag every threat as a factor of its own, even when the report's main subject is something else.
2. Open a watch: no change to the reporter's pay, role or shifts without review, for a period your policy sets.
3. Take care with reassurance. A message promising "you will not face retaliation" is a promise the intake team cannot keep alone. A better sentence says that retaliation is prohibited, how to report it, and that the company will act on it.
4. Avoid any wording that discourages people from going outside. The SEC fined one company $130,000 in 2015 over a confidentiality statement used in internal investigation interviews, though no actual blocking was found.25,48

What goes wrong at hotline intake, and what it has cost on the public record

In shortIntake fails in a handful of predictable ways, most of them hand-offs. No public record ties a fine to a slow translator. Public settlements do show what the reports in a pharma hotline can be about, and how large the sums get.

Eight errors that an honest hotline review tends to find

The speaker meeting that never happened is on the public record

A speaker program is a company-sponsored event where a health care professional, usually paid, talks to other professionals about a drug or device.49 Allegations about sham speaker events are familiar to any pharma compliance team. HHS-OIG's 2020 alert lists suspect features of speaker programs, including programs with "little or no substantive information" and repeat attendance, and notes nearly $2 billion paid to health care professionals for speaker-related services over three years.49

In 2020, federal prosecutors announced a $678 million settlement with one drug maker, whose alleged conduct included "tens of thousands of sham educational events"; the company made factual admissions.50 In 2022, another agreed to pay $900 million over a whistleblower's allegations about speaker fees, training fees, consulting fees and meals; it denied them, and the settlement is no admission of liability or of any fact.51

In August 2026, a third resolved kickback and Open Payments matters for more than $46 million, with a five-year integrity agreement.52 Open Payments is the US public database of company payments to doctors and other covered recipients. That agreement requires a disclosure program, with anonymous reporting and a log entry within three days of receipt.27

These are public resolutions, cited for their scale. None of them turns on how a report was first read. They show what a report in your queue may be the first sign of.

How many speak-up reports to expect: benchmarks for 2025, and what has no public figure

In shortThe median is now 1.65 reports per 100 employees a year, a record. For a company of 48,000 that means about 792 reports, or three each working day. Nobody publishes pharma-only figures or translation error rates, so your own data has to fill the gaps.

The arithmetic for your own volume is simple: employees divided by 100, times 1.65. For a company of 48,000 people that is 792 reports a year, or about 3.2 per working day over 250 days.

A real company's number may be far from the median: the central half of organizations ran from 0.71 to 4.36.4 Companies that log every channel see more, at a median of 2.36.4 A low number is rarely good news, as it can mean people do not know the line exists or do not trust it. DOJ asks whether the company tests awareness and comfort with the hotline.22

Reporters also have busy routes outside the company. The SEC received about 27,000 whistleblower tips in fiscal 2025, about 12,000 of them from two individuals, and awarded more than $60 million to 48 people.54 A reporter who is ignored inside has other doors, and those doors pay.

Inside, the benefit may be real as well. In Stubben and Welch's sample, one standard deviation more use of the internal system went with 6.9% fewer pending lawsuits and 20.4% lower settlements over the next three years, and they frame that as an association.55 ACFE finds organizations with formal reporting mechanisms had a median loss of $100,000 and 11 months to detection, against $150,000 and 17 months without.6

What AI changes in hotline triage, and what DOJ and EU rules ask of it

In shortSoftware can read any language at any hour and search every record. It can also be confidently wrong, and it handles some of the most sensitive words a company holds. DOJ asks about AI directly. The EU's rules for high-risk AI apply from December 2027, and whether they reach hotline triage is a question for your counsel.

The fit is plain. Much of intake is reading, comparing and drafting, and reports arrive at 2 am in languages the team does not read. NAVEX makes the opposite point as well: AI steps with human validation may add procedural work that lengthens case timelines, and it offers this as a possibility.4 Whether automation saves time depends on how much of its output a person must redo.

Five limits to plan around in any automated hotline

The fifth limit is the one that matters most: a person must own the decision. Software proposes an issue and an owner. A named person routes the report and approves anything sent to a reporter. That is a sound design for accuracy, for accountability when an auditor asks, and for the reporter, who wrote to people.

How drug and device makers run hotline intake today: the people, the hand-offs and the three days

In shortA small intake team sits between a hotline provider and half a dozen possible owners. Reading a non-English report and getting it to its owner by hand can take about three days in one illustrative split, and most of that is waiting. No published time study exists.

Who touches a speak-up report before it has an owner

Three ways companies run speak-up intake

One Portuguese report, from a 2:14 am web form to a routed case the same morning

In shortDana Okafor, the hotline intake lead, opens a switchboard showing every report. Six AI agents, each a piece of software with one job, read report SU-2304 in one pass, score it High at 95 of 100 with a reason for each point, and propose Lena Ortiz in global investigations. Dana checks the facts and routes it, and the acknowledgement goes out in Portuguese a week before it is due.

1

The whole Speak Up line on one hotline switchboard

Dana's home screen is a flow, read left to right: channel, language, the one pass that reads each report, issue and severity, owner. A band's width is the number of reports. In the last 14 days there were 15 reports from four channels in 10 languages. Two are not read yet: SU-2304, a Portuguese web form received at 2:14 am, and SU-2310, an Arabic web form arriving now.

Below the flow, a panel lists the clocks running, led by a possible data breach on SU-2308 with 60 hours left.

2

Read, translated and classified in one pass

Dana clicks "Read, translate and classify". Sentence by sentence the screen fills in the Portuguese, the English, and what each sentence supports. Sentence 2 supports bribery, HCP inducement, money to an HCP (+15) and a manager named (+10). Sentence 6, on who decides the formulary, supports bribery and a public official (+20). Sentence 7, on the bonus, supports retaliation and a threat to the reporter (+15).

Because translating and labeling happen in the same step, the label comes from the sentence itself, against one issue list for every language.

3

The triage desk: every fact beside the sentence it came from

The report sits on the left with its English. In the middle, a summary lists the person named, who received money, what, when, where it is recorded and the witness, each with its sentence number. An amber panel says the records do not agree: 14 signatures on the attendance list, and a receipt for dinner for 2 in the manager's name the same evening. It tells the investigator to pull the attendance list first.

A health detail about the witness is masked in both languages. The agent writes "her manager" and "her bonus" for an anonymous reporter whose Portuguese gives no gender, and the summary keeps role and district. Part A explains why a careful intake lead reads for that before anything moves on.

4

95 of 100, with the reason for every point

Bribery and corruption gives 20. Six factors add 15, 20, 10, 15, 10 and 5, each with its sentence, for 95. High starts at 60. Dana can switch off any factor she disagrees with, and the proposal updates. A line lists the factors it did not find: a product quality concern, exposed personal data and conduct still going on.

The link finder returns event record EV-55102 at a 96% match, on the same date, hospital and amount, and SU-2271, a June report from the same district, at 87%. It also says what it checked and left out: IC-1042, about speaker programs in Atlanta, has the same product and different people. Links wait for a person.

5

Dana routes it, and the trail records who did what

Dana clicks "Route to Lena Ortiz". Case IC-1049 opens in case management. Ana Souza, regional compliance for Latin America, and Elena Novak in Legal are informed, the regional director stays out, and the acknowledgement goes out in Portuguese, seven days before the limit.

The activity tab shows the agents' proposals and Dana's decision in one list, each with its time.

Four details on SU-2304 that repay a closer look

An Arabic tender, a retaliation claim, a privacy clock and the board's numbers: the rest of the Speak Up line

In shortThe same desk handles every kind of report, each sent to a different owner by the same rules. The screens below show a live run in Arabic, reports that end up with investigators, privacy and regional compliance, the two-way messages with anonymous reporters, the dashboard and the settings.

Four more speak-up reports, four different owners

The queue, the anonymous reporter and the three-month letter

What the chief compliance officer sees, and what the intake lead can change

Six agents read and draft, and the intake lead routes every speak-up report

In shortEach agent does one job, and each has things it never does. No report is routed and no message is sent until a named person decides. Maker and checker, the agent that drafts and the person who approves, stay separate at every step that reaches a person outside intake.

Who decides what on a Cobbleford Pharma report

The sample company's people in these screens

Enterprise controls: roles for each person above, an audit trail of every agent proposal and human decision, EU reports stored and processed in the EU, and the original always kept unchanged. These are controls that support your compliance with the rules in Part A; your counsel decides how they apply. Botminds is SOC 2 Type II audited, with information security managed to ISO 27001.

What the triage desk reads, what it hands on, and the design targets set against the three-day baseline

In shortReports come in from your hotline provider, email and managers. A routed case, a reply and running clocks come out. The solution reads from your systems and writes only after a person decides. The numbers below are design targets, measured in the live solution.

Systems a hotline triage desk connects to

Design targets are goals, measured in the live solution on your own reports. The 3.1 days is the sample company's by-hand baseline, part of the fictional example. Time your own before you compare.

What late or wrong routing costs a drug company: the windows, the fines and the hours you can count

In shortMost of the cost of slow intake is hours you can measure. The serious cost is rarer and larger: a disclosure window spent, a reporter who goes outside, or a conflicted manager who reads the report. Nobody publishes a figure for what a late route costs, so build yours from your own files.

At NAVEX's 0.46%, about four of those 792 reports would be bribery and corruption, and about ten would be retaliation at 1.23%.4 Those few are where the cost sits, and you cannot tell which they are until someone has read them. That is the argument for reading every report early: the four need to surface on the first day.

Six hotline costs you can put a number on within a week

Hotline harms no calculator will count for you

Your return on 792 reports a year: intake hours, outside translation and fewer second routes

In shortThree levers are easy to count: time spent reading and routing, outside translation, and the rework when a report goes to the wrong owner. Enter your own numbers. Every default is an assumption, and the risk reduction is left out on purpose.

How ready your speak-up line is: channels, languages, one issue list, conflict data and the person who routes

In shortPick the answer closest to your team today. Eight questions score 0 to 2, and a ninth is for reflection. Your answers stay on this page.

What to ask any hotline triage vendor, including us, about translation, scoring, conflicts and identity

In shortA demonstration on a clean English report tells you little. Ask what happens with an idiom, a borderline score, a stale org chart and a reporter who gives themselves away. Ask us the same questions.

A 12-week hotline triage pilot: replay 200 past reports, then run one language group live

In shortMeasure your baseline, replay past reports with identities removed, then run live alongside your team, with a person routing everything. A pilot should be able to fail, so write down what would count as failing before you begin.

1. Time 20 reports and pull a year's export, so you know report-to-owner time by language, and how many reports changed owner.
2. Write the issue list and clocks on one page each, and have Legal, Privacy and any works council see them.
3. Replay 200 past reports, with identities removed, across your top languages, and compare labels, links and owners with what you now know.
4. Run one language group live and in parallel for four weeks, with your team routing as usual and comparing.
5. Decide on your written measures, and widen one region at a time.

What to measure in a hotline pilot, and what would count as failing

Whistleblower hotline questions people search for, answered

In shortTwelve questions, each answered on its own, as of November 2026. This is general information. Ask your counsel about your own situation.