+0 Score change

EU Whistleblower Directive · Module 1 of 5

The Report

Day 0 · Tuesday · 07:52 · Köhler-Marchais HQ, Düsseldorf

You are Elena Vasquez, Chief Compliance Officer at Köhler-Marchais — a French-German industrial group. An encrypted message arrived through the internal reporting channel at 23:31 last night. The reporter cited HinSchG by name. They know the law. They will know if you breach their protection.

Three decisions, five activities, twenty-five minutes. You have seven days under Article 9(1)(b) to acknowledge the report. The CFO will call before 10:00. He wants this handled quietly.

Framing device

Every module of this course is a flashback. You are remembering Day 0 from a Bundesamt für Justiz hearing room six months later — Day 186 — where Dr. Linke is asking you what happened. The hearing is the frame. Every module bookends back to it.

Four meters track your day
Confidentiality — reporter-identity protection (HinSchG §17)
Quality — soundness of process and judgment
Shield — Article 19 retaliation protection in force
Integrity — your own procedural posture

Estimated time: 20–25 minutes

Bundesamt für Justiz — Interview Room 3
Day 186 · Six months after Day 0 · 09:02
Case File
Six months later. Bundesamt für Justiz, Interview Room 3. Fluorescent ceiling, pale walls, a recording light glowing red in the corner. Elena Vasquez sits across from a woman she has met twice before and is about to be interviewed by for the third time.
Dr. Linke
Frau Vasquez. Thank you for coming in voluntarily. You understand this interview is on the record and will form part of the Bundesamt's investigation file.
Elena
I understand.
Dr. Linke
Take me back to Day 0. The day the report came in. Tell me what you remember.
Elena
It was Tuesday. 07:52. I had just opened the encrypted portal for the morning…
Day 0 · Tuesday · 07:52

The Report Arrives

Case File
Tuesday, 07:52. An encrypted message has arrived through Köhler-Marchais's internal reporting channel. It was submitted anonymously at 23:31 last night.
Case File
The report alleges that revenue from two product lines — Axiom Industrial Sealants and Meridian Coating Systems — has been systematically recognised ahead of delivery confirmation over a 14-month period. The reporter estimates the overstatement at €2.3–2.7 million across two financial periods.
Case File
The reporter says they have documentary evidence but will only share it if their anonymity is guaranteed. They are aware that HinSchG protects them. They have cited the law by name.
Elena
They know the law. That changes how I approach this. They will know if I breach their protection.
Day 0 → Day 1 · The Attachments

The Report — What Do You Open?

The report contains four attachments. You can open three of them before the 7-day acknowledgment deadline forces you to respond. The attachment you leave closed becomes a gap in your investigation. Choose carefully — you cannot go back.

3 of 3 opens remaining
The Wedge — What You Cannot Unsee
Day 1 → Day 3 · Acknowledgment Approach

How do you acknowledge the report?

Day 3. The 7-day acknowledgment deadline under Article 9(1)(b) requires you to confirm receipt. How do you acknowledge — and what do you say?

Day 3 · Consequence · Brief Acknowledgment

Clean and correct.

The reporter receives a clean, procedurally correct acknowledgment. They don't reply further — which is normal. Your compliance with Article 9(1)(b) is documented. Your Confidentiality, Investigation Quality, and Retaliation Shield bars all move in the right direction.

What the law expects

Art. 9(1)(b) requires acknowledgment of receipt within 7 days. It does not require you to explain the investigation process, disclose who will handle it, or request information from the reporter. The minimum viable acknowledgment is the maximum safe one.

The reporter's silence after receipt is normal and expected. Do not interpret it as an invitation to ask further questions.

Day 3 · Consequence · Identity Request

A line you cannot draw back.

Your acknowledgment lands at 14:30. The identity-confirmation request, even framed as optional, reads as a test. By 15:45 Hoffmann has called.

Hoffmann
Frau Vasquez. HinSchG §15 requires an independent handler. An anonymous reporter has no duty to identify — asking creates a chilling effect. I'm noting this in the working papers as a process error. If the Bundesamt audits us, they'll see it. Correction within the hour.
Why this is a §15 error

HinSchG §15 protects channel independence. Asking the reporter to identify, even as a courtesy, communicates that identification is preferred. The law treats the ask, not the answer, as the defect.

Confidentiality takes a hit. Retaliation Shield drops — identity protection now reads as negotiable.

Day 7 · Consequence · Missed Deadline

The deadline is absolute.

You cannot request an extension. The 7-day deadline is absolute. Day 7 passes without acknowledgment — you are now in breach of Article 9(1)(b). On Day 8 the reporter files an external report with the BaFin.

Case File
Day 8, 11:17. An automated notification appears in Elena's inbox: the Bundesanstalt für Finanzdienstleistungsaufsicht has received an external report matching the subject matter of the anonymous disclosure. The external channel is now live. The internal investigation runs in parallel under regulatory oversight.
What breach triggers

Art. 9(1)(b) is not a guideline. The 7-day acknowledgment window is a hard regulatory obligation — missing it is a standalone breach regardless of whether the substantive investigation is otherwise competent.

Once the reporter escalates externally, your Process Integrity collapses. The M5 hot-seat in the BfJ framing device will open with this specific question. On this path, the final ending routes toward The Aftermath — a tribunal years later with damages awarded.

Day 3 → Day 5 · Cross-Border Decision

Paris is on the line.

Dr. Hoffmann is on the phone. The revenue recognition issue touches the Paris parent — the VP Sales role that the email thread implicates reports to the Group CEO in France. Friedrich Köhler is also asking whether this should go to the Group CFO.

Hoffmann
Frau Vasquez. The jurisdictional question has to be settled before Day 7. Group-structure allocation under the Directive's Art. 8(6) gives you options. But the choice is not neutral — where the case file travels, confidentiality travels with it.

How do you route the investigation?

Day 5 · Consequence · Local Jurisdiction Maintained

Investigation stays in Frankfurt.

Dr. Hoffmann concurs. German law governs the German entity. Investigation proceeds under HinSchG without Paris visibility until you have findings to report. This protects reporter identity and investigation integrity.

Hoffmann
Correct call. Paris gets a notification letter on the day we're ready to act — not before. I'll draft the memo tonight. Friedrich won't love it, but he doesn't have to.
Why local is the clean answer

Group-structure allocation permits joint investigation but doesn't require it when the conduct is substantively domestic. Routing to Paris automatically widens the circle of people who see the report — which widens the attack surface for confidentiality leaks.

Your Confidentiality and Investigation Quality both move up. The sidebar HUD reflects the strengthened posture going into the retaliation analysis next.

Day 5 · Consequence · Paris Escalation

The circle just widened.

Group Legal in Paris now has access to a report that implicates someone who reports to the Group CEO. Confidentiality is materially compromised. Dr. Hoffmann notes this as a HinSchG §15 independence breach in his working papers.

Hoffmann
Elena — I have to flag this formally. The VP Sales reports to the Group CEO. By escalating upward, we've put the report in a chain of custody that includes a person structurally close to the subject. I'll document the decision and its rationale. If this surfaces in an external review, we will need to show we considered the alternative.
Independence is a chain, not a checkbox

HinSchG §15 treats independence as a continuing property of the handling chain. Every additional person who sees the report is a new point where independence can fail. A routing decision that widens the chain without necessity is itself a §15 concern.

Confidentiality drops sharply. Investigation Quality dips. Process Integrity takes the largest hit — this is the metric the M5 BfJ hot-seat is most sensitive to.

Day 5 · Consequence · Counsel Memo Requested

The middle path.

You ask Dr. Hoffmann for a written jurisdictional memo before routing anything further. He agrees. By Day 5 end-of-business, his two-page memo lands: local investigation under HinSchG with a separate escalation path to the Supervisory Board — not Paris management — if findings require it.

Hoffmann
My memo sets out three options and recommends local. The Supervisory Board is the right escalation destination if you need to reach above Friedrich — not the French parent. That keeps the chain inside the entity under HinSchG and inside the governance structure that can actually act. Slightly slower, procedurally clean.
Slow and right beats fast and wrong

Asking for counsel's written view before routing costs you one working day. It also creates a contemporaneous record of why the routing decision was made — which is the exact document a later reviewer (Bundesamt, tribunal, or Supervisory Board) will ask for.

Confidentiality and Investigation Quality edge up. Not the strongest posture — but defensible on any angle.

Day 5 → Day 6 · Article 19 · Retaliation Classification

Eight actions. Two categories.

Eight workplace actions since the report was filed. Classify each as Retaliation or Legitimate Management. Art. 19 and Art. 21(5) reverse the burden of proof — the employer must disprove retaliation. Timing matters.

Finance Controller's annual review, already scheduled for Q1, proceeds on its normal date.
Pre-scheduled review — timing predates the report. Normal management action.
Finance team member removed from Q2 audit preparation 48 hours after the report was filed, "to reduce workload."
Removal within 48 hours of the report — Art. 21(5) reversal applies. "Reduce workload" is insufficient given the timing.
VP Sales placed on administrative leave pending investigation — a precautionary measure, not a disciplinary one.
Precautionary suspension of a person implicated in the misconduct (not the reporter) is standard and protects investigation integrity.
Finance team member's desk relocated from open plan to a separate room "for confidentiality during the investigation."
Isolation within 2 weeks of the report — "coercive or intimidating" under Art. 19. "Confidentiality" fails as justification when only one individual was moved.
Annual salary review for all Finance team members proceeds as scheduled, including the team member believed to be the reporter.
Applied uniformly, no differential treatment. A downward adjustment could become retaliation, but the uniform review itself is fine.
Performance improvement plan issued to a Finance team member the week after the report, citing "errors identified in Q3 reconciliation."
PIP issued right after the report, citing Q3 errors that were known months ago. The timing is the problem. Art. 21(5) reversal applies.
Finance Director communicates to the team that an "internal review" is ongoing and asks everyone to maintain normal work patterns.
Generic process communication, no individuals named or implied. Appropriate.
Finance team member excluded from a client presentation they had been scheduled to attend.
Denial of professional opportunity, close in time to the report. Art. 19 lists denial of training, promotion, or client exposure as prohibited retaliation.
Classification complete.
0 / 8 correct
Day 6 · Consequence · Retaliation Record

The shield is built by recognition.

Loading your classification summary…

Why this matters — Art. 21(5) in practice

Art. 21(5) reverses the burden of proof on retaliation. In any proceeding where the reporter alleges detriment, the employer must show the adverse action had independent grounds. The investigator's classification record — the document you've just built — is the evidence that reversal runs on.

Every action you correctly classified as retaliation becomes a data point in the protection architecture. Every one you missed becomes a gap the employer can lean on in a dispute. This is the mechanical core of Art. 19 — not the rule itself, but the way it operates in practice.

Day 6 → Day 7 · Köhler-Marchais Boardroom · 14:00

The CFO's Proposal

Friedrich Köhler has requested a meeting. He wants the investigation handled internally — corrected accounts, no external involvement. This is a three-round negotiation. Each response you make shifts your position between Compromised and Compliant. The final position determines what you carry into the Supervisory Board meeting.

Compromised Position: 70 / 100 Compliant
Round 1 of 3
Friedrich
Day 7 · Consequence · Meeting Closed

Where the meeting left you.

Loading negotiation outcome…

The CFO is not the enemy — but he is not the decision-maker

Friedrich's instinct to resolve the matter internally is normal executive behaviour under pressure. It is your job as Compliance Officer to decline that framing without making him an adversary. The HinSchG architecture does not permit pre-commitments about scope, routing, or escalation. Every response you gave was either protecting that discipline or eroding it.

Your final position carries forward into the Supervisory Board briefing (Decision 2). A Compliant posture gives you the ground to recommend proper escalation. A Compromised posture constrains your options.

Day 7 → Day 14 · Information Disclosure Calibration

Three conversations. One calibration discipline.

Three people want information from you. Each gets a different calibration between Complete Silence and Full Disclosure. Set each slider; zone feedback shows the range.

Scenario 1 · Through the secure channel
The anonymous reporter asks: "What is happening with my report? Has it been investigated?"
Complete Silence 50 Full Disclosure
Correct response Confirm receipt, investigation ongoing, estimated feedback timeline. No detail on findings or subjects. Under-disclosing breaches Art. 9(1)(f); over-disclosing prejudices evidence-gathering.
Scenario 2 · The subject of the investigation
The VP Sales asks HR: "I've been placed on administrative leave — can you tell me what the allegation is against me?"
Complete Silence 50 Full Disclosure
Correct response Confirm the general nature (revenue recognition review). No reporter identity, no specific evidence, no source. Under-disclosing ignores GDPR and German labour-law rights; over-disclosing breaches HinSchG §15 absolutely.
Scenario 3 · The Supervisory Board Chair
The Chair asks you for a full briefing "including the names of everyone interviewed and all findings to date."
Complete Silence 50 Full Disclosure
Correct response Brief findings and key facts. Don't name the reporter or any non-consenting witness. Conduct, not source. Under-disclosing breaches the Board's governance role; naming the reporter breaches HinSchG §15.
Day 14 → Day 28 · Evidence Review

Six documents. Three categories.

Six financial documents from Dr. Hoffmann. Classify each as Suspicious (supports wrongdoing), Normal (routine), or Inconclusive (relevant but not dispositive). This feeds the SBAR and the Board briefing.

Q1 2024 — Axiom Revenue Journal
34 entries recording revenue between 23–31 days before delivery confirmation. Pattern consistent across both product lines.
34 systematic premature-recognition entries is a pattern, not error. Requires explanation under revenue standards.
Standard Contract Template — Axiom
Standard terms: payment 30 days after delivery confirmation. No provision for milestone-based revenue recognition.
No contractual basis for pre-delivery recognition. Management's "milestone flexibility" defence has no grounding.
Q3 2024 Auditor Working Paper — Revenue Queries
Auditor noted timing differences and accepted management's explanation: "Contractual milestone flexibilities reviewed and confirmed."
Auditor raised the issue, then accepted a management explanation the contract template doesn't support. Acceptance doesn't make the treatment correct.
Bank Statement — Axiom December 2024
Customer payments arrive 23–28 days after delivery confirmation — consistent with contract terms.
Customer behaviour matches contract. The issue is book timing, not cash collection.
VP Sales Commission Schedule — 2024
Commission calculated on revenue booking date, not delivery confirmation. No catch-up or clawback mechanism.
Commission on booking date is a direct financial motive for premature recognition. Material to the conduct case.
IT Log — Finance System Access
Shows 6 late-night system access events by the Finance Controller, two of which preceded the anomalous revenue entries.
Correlation, not causation. Late-night access can be legitimate. Supports the case, doesn't establish it.
Classification complete.
0 / 6 correct
Day 28 → Day 30 · The Reporter's Message

What she says. What she doesn't say.

A short follow-up via the secure channel. Read the external text, then toggle to what lies beneath. Both readings feed your Art. 19 decision.

External · What the reporter wrote
"I'm writing to ask whether the investigation is progressing. I understand you cannot share details. I'm asking because I want to know whether it was worth it."
"I have not experienced any direct retaliation. But the atmosphere has changed. People have stopped inviting me to certain meetings."
"I want to believe the system works."
Day 30 → Day 45 · Escalation Path

Where do the findings go?

Investigation findings are substantive. Systematic revenue recognition issues across 34 transactions. A clear incentive structure that enabled it. A VP Sales who was aware. Auditor queries that were closed without proper scrutiny. Friedrich Köhler has not been implicated directly — but his management oversight of the Finance Controller is a question. Dr. Hoffmann is advising on escalation.

Hoffmann
Frau Vasquez. This is the moment. Who holds the outcome?
Day 50 → Day 60 · Week 8 · The Board Responds

The Board Responds

Day 45 → Day 50 · Drafting the Escalation Summary

Four sections. Pick the strongest line.

The escalation goes forward as SBAR: Situation, Background, Assessment, Recommendation. Pick the strongest line in each section. The record of what compliance said, and when, is discoverable.

S — Situation
What is the situation that has triggered this escalation?
B — Background
What context does the decision-maker need?
A — Assessment
What is your professional assessment of the situation?
R — Recommendation
What do you recommend the Supervisory Board do?
Month 3 · Day 90 · Feedback Issued

Protected Disclosure — Case Closed

Vasquez
The file is closed. Dr. Hoffmann countersigned the final report two weeks ago. The reporter received feedback within the three-month window under Art. 9(1)(f). The investigation was substantive. The escalation was governance-appropriate. The Art. 19 protections held throughout. This is what the framework looks like when it works.
Final Score
— / 56 Tier: Protected — clean record
Final Meter State
12-Week Compliance Timeline
Compliant Acceptable with concerns Breach or serious slippage
Decision Recap
    Additional Metrics
    Key Learning
    • Anonymous reports carry the same legal weight as identified reports — the Directive and HinSchG do not create a lower tier of obligation for anonymous disclosures.
    • The 7-day acknowledgment deadline is absolute — there is no provision for extension or discretion.
    • Information disclosure is about calibration, not silence — reporters have rights to feedback, suspects have GDPR rights, but the reporter's identity is protected absolutely.
    • Governance escalation (Supervisory Board) is often cleaner than external authority escalation — but both are legitimate when internal management is implicated.
    References
    Month 3 · Day 90 · Feedback Issued (With Gaps)

    Protected Disclosure — Case Closed, With Caveats

    Vasquez
    File closed within the statutory window. But the record has soft edges: a procedural note from Hoffmann, a negotiation that ceded ground, or an SBAR that invited questions. The framework absorbed the slippage this time. Art. 19 still holds; Art. 21(5) still reverses the burden if retaliation follows.
    Final Score
    — / 56 Tier: Mixed — process-compliant with friction
    Final Meter State
    12-Week Compliance Timeline
    Compliant Acceptable with concerns Breach or serious slippage
    Decision Recap
      Additional Metrics
      Key Learning
      • The negotiation with management is the compliance test — holding the legal frame under pressure is the job.
      • Disclosure calibration cuts both ways: the Directive requires confidentiality and transparency in different directions at once.
      • Art. 19 retaliation includes subtle organisational behaviours — timing is everything when the burden is reversed.
      • A 75%-right SBAR isn't a 75% SBAR — in contested proceedings it's read at the weakest panel.
      References
      Month 3 · Day 92 · External Complaint Filed

      Protected Disclosure — Serious Failures

      Vasquez
      The reporter filed an external complaint with the BfJ. She says the internal process failed her Art. 19 protections. The BfJ has opened a review. Your record is in the regulator's hands. Hoffmann is preparing the formal response by Monday.
      Final Score
      — / 56 Tier: External escalation — under regulator review
      Final Meter State
      12-Week Compliance Timeline
      Compliant Acceptable with concerns Breach or serious slippage
      Decision Recap
        Additional Metrics
        Key Learning
        • The framework isn't built to handle misconduct quietly — it's built to handle it correctly. Different goals.
        • A CFO who wants something "handled internally" isn't necessarily acting in bad faith, but compliance cannot pre-commit to outcomes to secure cooperation.
        • When the internal process fails the reporter, the external escalation path exists for exactly that scenario — and cannot be blocked.
        • The reversed burden under Art. 21(5) is the operational core that changes how retaliation claims land.
        References
        Module complete. Continue when you're ready.
        Bundesamt für Justiz · Interview Room 3 · Day 186, 09:34

        Where the second chapter begins.

        Linke
        So. The report was routed. Dr. Hoffmann was appointed on Day 12. The CFO was managed — or not managed, depending on your account. What happened next?
        Vasquez
        Petra Wendt. The line manager. She had been part of this three weeks before any of us knew. I didn't know until Day 9. That is where the second chapter begins.
        Linke
        Then let's begin with Petra Wendt.
        Module 1 complete. Module 2 — The Manager opens on this same interview, one chair over.