Who is allowed to read a report about the boss?
In short
A conflict of interest in a whistleblowing case is about who can read and assess a report without having an interest in the outcome. The question has to be settled before anyone opens the report, not afterwards.
When a report lands, the first question is not what it says. It is who is allowed to read it.
The order matters. Once a report has been read by the wrong person it cannot be undone, and the rest of the case carries that with it.
Three situations where the question arises
The report may be about the unit’s own manager. It may be about the unit’s own department. And it may be about a colleague the reader works with every day.
The last of those is the one that gets underestimated, and there are three reasons why it is serious.
You cannot neutrally assess whether someone you depend on day to day has done something wrong. It does not have to be deliberate to be skewed.
Nor can you hide it. You were in a meeting with them yesterday, you will be again on Thursday, and your behaviour changes once you have read an allegation about them. That is a leak in itself, and it lands on someone who has not been informed and may never have deserved suspicion.
And it is the one that cannot be defended afterwards. If the case goes wrong, the question is not whether you were partial. It is whether someone on the outside could think you were.
All three point the same way. Conflicts have to be settled before reading, not after.
What has to be in place before a case arrives
The assessment has to be systematic and written, and there has to be an agreed escalation route for the situation where the unit itself is conflicted. That route has to be decided in advance rather than invented on the day.
It also takes a willingness to recognise your own conflict and step back. That is hard, which is precisely why it belongs in a procedure rather than resting on how somebody feels that morning.
If reports go straight to the internal unit, the conflict is a latent risk every single time. That is not an argument against an internal unit, but it is an argument for having decided in advance what happens when it arises.
Why an external step solves that particular problem
Someone outside the organisation can make the initial assessment without any risk of a conflict. That is one of two things that are hard to secure from within.
The other is experience. A Danish organisation rarely sees enough cases to build it, and it cannot be read up on.
This is a point about roles, not a recommendation of any particular arrangement. An internal unit with a written escalation route and a willingness to step back can do the same thing.
Three questions that can be answered at a meeting now
Who may read a report about the chief executive. Who takes over if the unit is conflicted. And when the person reported on is informed.
All three can be answered in peacetime. None of them can be answered in the middle of a case.
Questions we get
- Who takes over if the whistleblowing unit is itself conflicted?
- That has to be decided in advance. An agreed escalation route, written down, naming who steps in. Invent it in the moment and it will be decided by someone who has already read the case, and by then the damage is done.
- Is it enough that the person believes they can be objective?
- No. The question is not whether you were partial. It is whether someone on the outside could think you were. If the case goes wrong, that is the test that will be applied.
- What about a colleague you work closely with every day?
- That is the situation people underestimate most. You cannot neutrally assess whether someone you depend on has done something wrong, and it does not have to be deliberate to be skewed. You also cannot hide it. Your behaviour changes once you have read an allegation about someone you are meeting on Thursday, and that is a leak in itself, aimed at a person who has not yet been informed and may never have deserved suspicion.
- Does the assessment have to be written down?
- Yes. An assessment that is not documented does not exist when somebody asks about it two years later. And that is exactly the decision they will ask about.
Sources
- Guidance of the Danish Data Protection Authority on whistleblowing schemes at private workplaces, 16 December 2021
- Timbed's own practice. Ken Graversen built the whistleblowing scheme at Danfoss, one of the first private schemes in Denmark, and has personally handled more than 1,100 cases across organisations since 2008, 24 September 2026
Last updated 24 September 2026