Building a speak-up culture: The view from the boardroom is not the whole picture

Guest post by our Romanian partner Denisa Simion on the risks organisations miss, why employees stay silent, and how prevention, independent expertise and effective reporting can help close the gap.

Whistlelink recently welcomed Denisa Simion as a partner in Romania. With a background in corporate forensics and years of experience training organisations on ethics and integrity, she sees first-hand the gap between what leadership believes is happening and what employees experience. We asked her about the risks organisations miss, why people stay silent, and what makes a reporting system work in practice.

From your perspective, what is the biggest blind spot organisations have when it comes to ethics and integrity?

Senior management and boards make decisions based on the information available to them. The difficulty is that this information does not always reflect what happens throughout the organisation.

Employees working close to daily operations may witness inappropriate conduct, recurring non-compliance or practices that bypass internal controls. Yet these issues do not necessarily reach decision-makers. Information can be filtered through management layers, concerns can be minimised, and employees may decide that speaking up is not worth the risk.

The Association of Certified Fraud Examiners (ACFE) notes that Certified Fraud Examiners estimate that organisations lose around 5% of their annual revenue to occupational fraud. Its 2026 Report to the Nations, analysing 2,402 investigated cases across 143 countries and territories, found a median loss of $104,000 per case, while 20% of cases involved losses exceeding $1 million.

These figures concern occupational fraud, not every type of misconduct or compliance failure. Nevertheless, they illustrate why organisations cannot afford to rely exclusively on the information that reaches senior management through formal reporting lines. The absence of reported problems is not proof that problems do not exist.

How can organisations prevent misconduct and create an environment where people recognise and report concerns?

Prevention starts with helping people understand what ethics and integrity mean in their actual working environment. Training is important, but it should go beyond explaining policies or legal obligations. Employees need to recognise potential conflicts of interest, fraud indicators, inappropriate conduct and procedural breaches, and understand how to respond.

Managers need targeted training too. Their reactions to questions, mistakes and uncomfortable information can either encourage openness or teach people to remain silent.

The ACFE’s 2026 report found that organisations providing fraud awareness training to both employees and managers had median fraud losses of $84,000 per case, compared with $150,000 among organisations that provided training to neither group. It also found more than twice as many employee tips in cases involving employees who had received fraud awareness training.

These are associations observed in the cases analysed, rather than proof that training alone causes lower losses. They nevertheless reinforce the value of awareness as part of a broader prevention and detection framework. Training must be supported by clear procedures, effective controls and reporting mechanisms people trust.

Why do employees remain silent even when reporting channels are available?

Because having a speak-up channel and trusting it are two different things.

Ethisphere’s 2024 Ethical Culture Report, drawing on around two million employee responses collected between April 2020 and March 2024, found that 93% of employees said they would report misconduct if they witnessed it. Yet only 50% of employees who had actually observed misconduct reported it. Among those who did not report perceived misconduct, 48% cited fear of retaliation and 48% said they did not believe corrective action would be taken.

These findings reveal two distinct barriers: fear of personal consequences and a lack of confidence in the organisation’s response.

There is also a structural problem. Employees may believe that certain practices are already known to management, that nothing will change or that challenging an influential individual could damage their careers. Meanwhile, senior leadership may interpret the absence of reports as evidence that the organisation is functioning well.

A low reporting volume should therefore be interpreted carefully. The important question is whether employees trust the process enough to use it and whether the organisation responds meaningfully when they do.

What makes an effective whistleblowing system, and where do organisations struggle with implementation?

An effective system needs to work end to end: from receiving and acknowledging a report, through initial assessment, triage and investigation where necessary, to communication, corrective action and follow-up.

A dedicated platform can support secure communication, controlled access and traceable case management. However, technology alone cannot ensure that a report is assessed impartially, that conflicts of interest are managed or that appropriate action follows.

In Romania, Law 361/2022, which transposes the EU Whistleblower Protection Directive, establishes requirements for internal reporting channels and the protection of reporting persons for organisations within its scope. In practice, organisations may have the required policies and channels without having sufficiently clear arrangements for handling sensitive cases, particularly those involving senior management or influential individuals.

The real challenge is ensuring that responsibilities, escalation routes, confidentiality safeguards and decision-making authority are defined before a report arrives. Organisations should also examine whether their procedures work in practice, rather than simply whether the required documents exist.

When should an organisation involve an external compliance or integrity specialist?

External expertise can be particularly valuable when a matter is sensitive, complex or difficult to assess objectively from within the organisation.

People working inside a business naturally develop familiarity with its routines, relationships and established ways of doing things. This operational knowledge is valuable, but it can also create blind spots. Practices that have become normal over time may no longer be questioned, and individuals may find it difficult to challenge decisions made by colleagues or senior leaders.

An external specialist can bring distance, an independent perspective and specific expertise in assessing risks, reviewing processes and determining appropriate responses. This does not mean that internal teams lack competence or integrity. It means that independence and specialist judgement can be particularly important when the organisation’s own interests, relationships or reporting lines may affect the assessment.

External support may involve reviewing compliance arrangements, strengthening controls, redesigning reporting procedures or managing a sensitive investigation. The objective is to help the organisation establish the facts, address weaknesses and make decisions based on evidence rather than assumptions or internal pressure.

How can organisations tell whether their compliance training and speak-up culture are actually working?

They need to look beyond training attendance, policy acknowledgements and the number of reports received.

Training should help employees recognise risks and understand their responsibilities. Managers should know how to respond when someone raises a concern, while those handling reports need appropriate skills in assessment, confidentiality, conflicts of interest and case management.

Organisations can evaluate effectiveness through scenario-based exercises, employee feedback, knowledge assessments and reviews of how reports are handled. They should also examine recurring issues, delays in follow-up, the implementation of corrective actions and whether internal controls are operating as intended.

The ACFE’s 2026 report found that tips were the initial detection method in 43% of the occupational fraud cases examined, with more than half of those tips coming from employees. Tips were the most frequently reported detection method in the study, reinforcing the importance of making reporting accessible and credible.

An increase in reports does not necessarily mean that misconduct is increasing; it may indicate greater awareness and trust. Equally, a low reporting volume does not automatically indicate a healthy culture.

If an organisation could take one step this year to strengthen its approach to ethics and integrity, what would you recommend?

I would recommend testing the gap between what leadership believes is happening and what employees experience in practice.

Ask what information might not be reaching decision-makers, where employees may be reluctant to raise concerns and whether existing procedures would work if a report involved a senior executive or a recurring operational breach. Then review the relevant training, controls, reporting arrangements and escalation procedures against those scenarios.

This exercise can help identify weaknesses before they become more serious problems. It can also clarify where the organisation needs better training, stronger procedures, independent expertise or more effective follow-up.

Leaders cannot be expected to know everything happening throughout a complex organisation. They are, however, responsible for creating conditions in which relevant information can reach them and for ensuring that the organisation can respond appropriately.

The greatest risk is not always the problem that reaches the boardroom. Sometimes, it is the problem that never gets there.

About Denisa Simion

Denisa Simion is a senior compliance and integrity professional with extensive experience in corporate governance, compliance frameworks, risk management and organisational process improvement. She specialises in ethics and integrity training, corporate fraud prevention, and the development and implementation of effective compliance policies, internal controls and whistleblowing systems.

Combining strategic insight with a practical understanding of how organisations operate, she helps businesses strengthen accountability, embed ethical standards into everyday decision-making and translate compliance requirements into effective, sustainable practices.

To learn more about her services, from forensic reviews and anti-fraud advisory to integrity programmes and training in Romanian and English, visit denisasimion.ro.