The whistleblower complaint that was 'resolved internally' with no record anyone outside the department ever saw

This is a composite, illustrative scenario, not an account of a named client. The company's whistleblower register, maintained as required under the vigil mechanism policy, showed zero complaints logged for the year. A routine review of HR exit interview notes for employees who had left during the year — performed as a secondary source check rather than relying on the register alone — turned up one departing employee's interview record mentioning that they had raised a concern about a billing irregularity with their department head eight months earlier, which the department head had told them would be 'handled internally' and which never appeared in the whistleblower register, was never escalated to the audit committee, and had no documented resolution anywhere.

Why the register alone could not be relied on

A whistleblower register is only as complete as the discipline of the people who are supposed to log complaints into it — and it structurally cannot show what was never entered. Checking the register for completeness against itself proves nothing; the only way to test whether complaints are actually reaching the register is to look for evidence of complaints from a source that doesn't depend on the same people who might have an incentive to keep something quiet — exit interviews, HR grievance logs, email escalations to a department head that went no further, or direct enquiry of employees who have since left.

What the follow-up established

1. 01Obtained the exit interview record and spoke directly with the former employee, with their consentThey described raising a specific concern about invoices being processed for services they believed had not actually been rendered, and being told by their department head that it would be looked into.
2. 02Asked the department head directly whether this had been raised and how it was handledThe department head confirmed the conversation had happened, said they had looked into it personally, and found nothing requiring escalation — with no written record of what was reviewed or on what basis that conclusion was reached.
3. 03Checked whether the billing pattern described matched anything found independently in this audit's own testingA sample of invoices from that department did not surface the specific issue described, but the sample had not been designed around this particular allegation and was not sufficient on its own to rule it out.
4. 04Escalated the gap in the vigil mechanism itself to the audit committeeIndependent of whether the underlying billing concern turned out to be substantiated, a complaint that never reached the register or the audit committee, and was closed by the very department it concerned, is a vigil mechanism failure in its own right.

What went into the file

• The exit interview record and the account from the former employee, documented as the source of the finding.
• The department head's own account of how the complaint was handled, including the absence of any written record of what was actually reviewed.
• A targeted substantive test on the specific billing concern described, scoped to that allegation rather than relying on the earlier general sample.
• The escalation to the audit committee on the vigil mechanism gap, and a recommendation that exit interviews be reviewed as a standing secondary source in future vigil mechanism assessments.