1 Purpose and protection
This policy enables people working with or dealing with the Association to report fraud, corruption, abuse of beneficiaries, financial or regulatory breaches and data leaks. Retaliation for good-faith reporting or lawful cooperation with an investigation is prohibited. A breach need not ultimately be proven for internal protection to apply. (1)
2 Alternative channels
Compliance receives reports. Matters concerning management may be raised directly with the Board Chair; matters concerning the Chair may be raised with an independent member appointed by the Board. The Board approves a restricted institutional contact channel and announces it to the parties; no email address or number is invented without being actually designated. Anonymous reports are accepted where their substance can be examined, noting that lack of contact details may limit follow-up.
3 Registration and triage
A reference number, incident description, date, evidence and retaliation risks are recorded without distributing the reporter’s identity. Urgent risks to a child, person, funds or data are assessed and referred immediately to the emergency route or competent authority when needed. Acknowledgement within 3 working days is an internal target, using safe communication where contact details are available.
4 Independent investigation
The investigation’s scope, lead, evidence plan and authorised persons are defined after checking conflicts. Original evidence and chain of custody are preserved, and deletion prohibited. The subject may respond without unnecessary disclosure of the reporter’s identity. Absolute confidentiality must not be promised where it would prevent compliance with a legal order. Internal investigation must not obstruct an official reporting duty.
5 Outcome and action
The investigator provides a reasoned outcome distinguishing established and unresolved facts and recommendations. An independent competent authority makes the decision. An update to the reporter within 15 working days is a target, followed by updates according to progress, without disclosing protected data. Proven malicious reports are distinguished from unsubstantiated reports; mistakes or insufficient evidence alone are not punished.
6 Closure and follow-up
Implementation of corrections, restoration of rights and prevention of recurrence are verified. Retaliation risks are monitored after closure. The Board receives periodic anonymised reports on types, durations and overdue actions. Files remain restricted. The right to approach competent authorities remains, without requiring exhaustion of internal channels.
References in the approved document
- The Association’s approved 2026 Articles of Association, transparency and oversight requirements; conduct, conflicts-of-interest and data-protection policies. This document sets internal implementation controls without changing a higher-level legal requirement or competence.