These Rules of Procedure govern the process following the receipt of a report.
BDO regards the whistleblowing system as a means of identifying potential risks within its own business operations or supply chain.
The system complies with the requirements of the Whistleblower Protection Act (HinSchG), the Money Laundering Act (GwG), and the complaints procedure under the Supply Chain Due Diligence Act (LkSG).
The effectiveness of the complaints procedure is reviewed annually and whenever necessary. Where necessary, adjustments are made to the procedure or to the preventive and remedial measures taken.
Reports are handled by the internal reporting office. When carrying out its duties, the internal reporting office is impartial and independent, and is not subject to instructions. It is also obliged to maintain confidentiality and safeguard the rights of whistleblowers and other affected parties.
As a matter of principle, the investigation, discussion and examination of reports received are conducted in strict confidence. However, this does not apply if a report is made grossly negligently or deliberately, or if there are statutory obligations to provide information to the authorities or courts.
The digital whistleblowing system enables communication with whistleblowers via an anonymous mailbox. The system does not store technical data that could be used to identify whistleblowers (e.g. IP address, location data or device specifications). Personal data relating to whistleblowers is only collected if they provide this information via the digital whistleblowing system. If whistleblowers disclose their identity or name other individuals in their reports, this information will be treated confidentially during the further processing and investigation of the reports.
Once a report has been received, its receipt is documented in the digital whistleblowing system and forwarded to the internal reporting office.
Note: whistleblowers are shown a multi-digit code after submitting a report. This code must be kept safe, as it is required to log in to the digital whistleblowing system at a later date and view the feedback.
Whistleblowers will be informed of the receipt of their report immediately or within seven days at the latest.
The internal reporting office will examine the submitted report, clarify the facts of the matter, and where appropriate, take follow-up action.
The internal reporting office may take various follow-up measures, such as conducting internal investigations, contacting individuals and units, referring whistleblowers to other competent bodies, closing the case due to lack of evidence, or referring the matter to either a) a department responsible for internal investigations or b) a competent authority for further investigation.
If the internal reporting office concludes that a breach has occurred, a proposal for further action, including preventive and remedial measures, will be drawn up. Where possible and necessary, whistleblowers will be involved in this process.
Feedback will be provided to whistleblowers no later than three months after confirmation of receipt of the report. This feedback will include details of planned and implemented follow-up measures, and the reasons for them. Where applicable, it will also include a reasoned statement explaining why the matter is not being pursued.
Feedback to whistleblowers may only be provided if doing so will not interfere with internal enquiries or investigations, nor prejudice the rights of those who are the subject of, or named in, a report.
Once the procedure has been concluded, the whistleblowers will be informed accordingly.
The processing time for a procedure varies depending on the complexity of the matter and may therefore take from a few days to several months.