Setting up an ethics hotline: where must anonymity be enforced?

An ethics hotline has a single measure of success: whether employees dare to use it. A technically flawless channel that nobody trusts is no different from having none — arguably worse, because it gives the company the feeling that the problem is solved.

Anonymity cannot be left to the client

This is the module's most critical technical decision, and most implementations get it wrong.

The common mistake looks like this: the form has a "send anonymously" checkbox, and when it is ticked the browser doesn't send the identity. The problem is that the decision was taken in the browser. A bug, an update or a different code path can still send the identity; the record is assumed to be anonymous while it carries a name.

In a correct design anonymity is enforced server-side: just before the record is written, if "anonymous" is set, the identity field is cleared at the database level. What the client sends is never trusted. This is the sharpest example of why hiding in the interface is not enough — our security approach is built on that distinction.

Who must not see it is also a design decision

The second question is who can view a report. Ethics records must not leak into anything open to the whole organisation — search results, the AI assistant's knowledge base, reports, digital signage.

This shouldn't be left as "a detail to remember". Making the records visible only to the authorised role belongs in the data layer, so that when a new feature is added the default behaviour is "invisible".

Categories: few but clear

Too many report categories make submission harder. Five or six are enough for most companies: harassment and bullying, discrimination, corruption and bribery, safety violations, conflict of interest, other.

Having an "other" category matters; nobody should give up because their report doesn't fit a box.

The review process

The line should not be opened without a process to see and decide on reports. At minimum, define:

1. Who reviews? Usually the HR director and/or an independent ethics committee. If a report concerns one of those people, the alternative route must be defined in advance.
2. Within what period? A target for the first assessment, for example five working days.
3. What are the outcomes? Status stages: new, under review, closed.

Feedback on an anonymous report is difficult but not impossible: giving the report a tracking code lets the person follow its status without revealing who they are.

Retaliation risk

The number one reason ethics lines go unused is fear of retaliation. What reduces it is organisational rather than technical: a written non-retaliation policy, communicated by senior management and enforced when breached.

The technical side only supports that: clarity about who will see a report, and an anonymous option that is genuinely anonymous.

Evidence

What compliance expects is being able to show that the process works: how many reports arrived, how many days on average to first handling, how many were concluded. These statistics must be reportable without exposing report contents.

An unalterable record is also expected; a log that can be edited afterwards carries no evidential value. We cover the topic in our compliance article.

Publicising it: the hardest part

Most hotlines go unused because they were never publicised. Three practices that work: a clear announcement from senior management, an introduction during onboarding, and visibility in shared areas. Explaining plainly how anonymity is achieved also raises use markedly — people trust a mechanism they understand.

Which channel should reports come through?

An ethics line that exists only inside the intranet is sometimes insufficient. A former employee, a supplier or someone whose access has been revoked cannot report. That is why many companies keep a second channel: an independent email address or phone line.

The advantage of the in-intranet channel is traceability: the report becomes a record, its status is followed and the duration is measured. Where both channels exist, reports arriving through the external one must be entered into the same record — otherwise the statistics don't reflect reality.

Measurement: zero reports is not good news

A common misreading is that no reports means no problems. In practice it usually signals distrust. A healthy line receives regular but low-volume reports, and some of them turn out to be unfounded — that is normal.

Numbers to watch: report volume and trend, average handling time, and the ratio of anonymous to named reports. The last is a trust indicator: if the share of named reports rises over time, the line is earning trust.

You'll find rollout order and content ownership in our operations article.