When discussions about whistleblowing arise, organisations often focus on reporting channels, policies and speak-up programmes. Yet during S-RM's recent fireside chat with former Wirecard lawyer and whistleblower Pav Gill led by Associate Director Ana Pereu, a different theme emerged: trust is shaped less by how concerns are reported and more by what happens after they are raised.
Drawing on his experience investigating concerns at Wirecard before becoming a whistleblower himself, Pav shared practical lessons for organisations seeking to build investigative processes that are fair, independent and effective. From the first hours after an allegation is received to the growing role of AI in investigations, one message was clear: a credible investigation requires much more than a hotline.
Listen to the full conversation here.
Why organisations should focus on allegations, not motives
One of the strongest themes from the discussion was the importance of how organisations respond when concerns are first raised. As Pav explained, organisations focus their attention on the individual reporting a concern rather than the concern itself, "The knee-jerk reaction tends to be, who is this person and why are they reporting?" he said. "I think that's just the wrong initial question to ask."
While questions about motivation may naturally arise, investigators should first assess the substance of the allegation and the potential impact on the business if the concerns prove to be true. An excessive focus on the reporter can undermine trust from the outset and discourage engagement with the investigative process.
As Pav outlined, the experience of many whistleblowers is “like going to the police station trying to report a crime and suddenly you're the one being cross-examined."
For investigators, this reinforces the need for objectivity from the very beginning. Establishing the facts, rather than evaluating motives, creates the foundation for a fair and defensible process.
Wirecard: Lessons from inside the investigation
Pav's experience at Wirecard gave him a unique perspective on both sides of the investigative process. As Head of Legal for APAC, he became involved when a member of the finance team raised concerns about potentially illegal transactions. Those concerns ultimately formed part of the exposure of one of Europe's largest corporate frauds, with EUR 1.9 billion supposedly held in accounts in the Philippines revealed to be non-existent.
For Pav, the experience reinforced two priorities for investigators: protect the source and preserve their account quickly. He gave the whistleblower a gender-neutral code name and maintained it across internal conversations, while arranging for her to provide a detailed written statement to external counsel while the facts were fresh.
As Pav reflected, "The capture at the front end matters more than almost anything that happens later." His experience would ultimately see him move from investigating concerns within Wirecard to becoming a whistleblower himself, highlighting just how important the earliest decisions in an investigation can become as a case develops.
The first 48 hours set the tone for the entire investigation
A reporting channel may be the entry point into an investigation, but it is what happens next that determines whether confidence in the process is maintained. As S-RM Associate Director Ana noted, once a serious allegation has been raised, the challenge for investigators is to establish the facts, preserve the evidence and ensure a fair process for everyone involved, while acting quickly enough to protect the integrity of the investigation.
Pav highlighted the importance of what he described as the "48-hour rule", stressing the need to acknowledge reports quickly, establish communication and preserve key information before fear, uncertainty or disengagement affect a reporter's willingness to participate. "Initial capture is very important," he said. "You want to add the snapshot, get as much info as possible."
The early stages of an investigation are also where some of the most consequential decisions are made. Organisations must consider who has access to the information, what evidence needs to be preserved and whether specialist support is required.
Regulators are paying increasing attention to these questions, so organisations can no longer rely on the existence of a reporting mechanism alone. As Pav explained, "It's no longer sufficient to say I've got my hotline, my receiving channel webform or whatever". Instead, scrutiny is increasingly focused on how concerns are handled once they have been received.
This places greater importance on information governance, audit trails and defensible decision-making. As Pav noted, organisations should be able to demonstrate "who had access to what, when, and why" throughout the process.
The lesson for investigators is clear: having a robust process is just as important as the ultimate findings.
Independence matters as much as process
Even the most carefully designed investigative procedures can be undermined if employees do not trust the individuals responsible for handling concerns. Who's dealing with the report on the other side? For employees considering whether to raise concerns, the answer matters. They may not know how an investigation will unfold, but they can often form perceptions about whether those receiving allegations are genuinely independent and empowered to act.
This challenge is not limited to whistleblowing programmes. Investigators themselves can face organisational pressures, particularly when allegations involve senior individuals or commercially sensitive issues. In such circumstances, independence is not simply a governance consideration. It is essential to maintaining credibility with reporters, regulators and other stakeholders.
For organisations, this may strengthen the case for involving external advisers when complex or high-risk allegations arise.
Every report is a data point
There is often a concern among organisations that encouraging reporting will lead to an influx of trivial complaints. Pav took a different view. "Knowledge is power," he said. "It's better to get more than less."
Not every report needs to result in a major investigation to provide value. Individual reports may appear insignificant in isolation but become meaningful when viewed alongside wider patterns, trends or subsequent allegations. "What may appear as an obscure kind of report that's potentially got very little to work off on its own," Pav explained, "could be a missing piece to a wider puzzle down the line."
This reflects a broader shift in how organisations are using investigative and compliance data. Reports are increasingly treated as intelligence that can help identify cultural issues, emerging risks and organisational vulnerabilities before they escalate.
The webinar also highlighted the importance of distinguishing between different types of concerns. Several organisations, Pav observed, are introducing additional reporting categories alongside traditional whistleblowing channels to encourage employees to raise issues that may not involve serious misconduct but still warrant attention.
For investigators, every report provides an opportunity to better understand an organisation's risk landscape, whether or not wrongdoing is ultimately substantiated.
AI can support investigations, but human judgement remains critical
The discussion also explored how AI is beginning to reshape whistleblowing and investigations.
While technology can streamline reporting, assist with evidence review and support case management, both Pav and Ana emphasised the continued importance of human judgement.
Ana noted that many of the most important contextual insights emerge during interviews and conversations rather than through documentary evidence alone. Motivations, interpersonal dynamics and cultural issues are often difficult to identify without direct human engagement.
Pav agreed: "Good investigators are very instinct driven," he said. "They can read the room, they can sense the energies."
He cautioned that technology can sometimes diminish those instinctive advantages. Face-to-face interactions often reveal information that may not be apparent through written statements or remote interviews. "Being in the room face to face, for example, with a witness that you're questioning, versus doing it online, I think can be very different," he said.
The role of AI in investigations will undoubtedly continue to grow. However, the webinar reinforced a point that many investigators will recognise: technology can assist investigations, but accountability, judgement and empathy remain fundamentally human responsibilities.
What happens after an investigation closes?
The final theme of the discussion focused on a stage that often receives less attention: what happens once an investigation ends.
For many organisations, the conclusion of a case marks the end of the process. Findings are issued, recommendations are implemented and attention moves elsewhere. But Pav suggested that this may be a missed opportunity: "A lot of times we just file cases as closed and move on with our lives," he said.
Instead, organisations should consider how individuals experienced the process and whether lessons can be learned from their feedback.
This can include seeking feedback from those involved, identifying ways to improve investigative procedures and considering what support may be needed after particularly sensitive matters. The discussion highlighted practical measures ranging from counselling and employee assistance programmes to adjustments in working arrangements where appropriate.
Such steps are not only about employee wellbeing. They also provide organisations with valuable insights into whether investigative processes are functioning as intended, turning the end of one investigation into an opportunity to strengthen the next.
