Organizations want concerns raised internally, where they can be addressed before they become enforcement matters. Award programs generally do not require internal reporting, so the organization must earn it.

Speed of response. Acknowledgment within days, and a substantive response within weeks. Reports that disappear teach the workforce to go elsewhere.

Visible outcomes. Without disclosing personnel details, telling reporters that the matter was investigated and addressed. Anonymous aggregate reporting to the workforce on the volume of reports and the actions taken.

No retaliation, demonstrated. A single visible instance of retaliation destroys the channel permanently.

Manager behavior. Most first reports go to a supervisor. Training managers to receive concerns without defensiveness, and to escalate rather than resolve them personally, is the highest-leverage intervention.

Access. Multiple channels including one outside the management chain and one to the board.

No impediments. Confidentiality agreements, codes of conduct and severance terms must not prohibit or discourage reporting to regulators. Enforcement authorities have penalized organizations for such provisions even without evidence that anyone was deterred.

Measurement. Report volume, time to closure, substantiation rate, and retaliation complaints — reported to the board.