WHISTLEBLOWING

The Authority for the Public Oversight of Statutory Audit Activity

On internal/external reporting of breaches of the law and whistleblower protection

Under Law No 361/2022 on the protection of whistleblowers, and in fulfilment of Articles 9 and 10 of that Law regarding the obligation to establish internal/external reporting channels and procedures for internal reporting and follow-up, ASPAAS is currently implementing the System procedure on internal/external reporting of breaches of the law and whistleblower protection.

Under the law, reporting persons who have obtained information on breaches of the law in a work-related context are protected, and the measures put in place by ASPAAS to this end are set out in its own Procedure.

To this end, one person has been designated to receive, register, examine, follow up and resolve internal reports, and another person to receive, register, examine, follow up and resolve external reports.

Reports are entered in a special register containing the date of receipt, the whistleblower’s name, surname and contact details, the subject of the report and how it was resolved.

The persons designated to resolve internal/external reports must not disclose the identity of the whistleblower or any information that would allow them to be identified directly or indirectly, except with their express consent and subject to the exceptions provided for by law.

The internal/external channels for submitting reports have also been established, namely:

A whistleblower may be any person who reports or publicly discloses information on breaches of the law obtained in a work-related context.

Under the law, a work-related context means current or past work activities of any kind, paid or unpaid, carried out within authorities, public institutions, other legal persons governed by public law or legal persons governed by private law, through which persons may obtain information on breaches of the law and may suffer retaliation if they report them.

Reporting persons who have obtained information on breaches of the law in a work-related context include at least the following:

  1. ASPAAS workers;
  2. self-employed persons within the meaning of Article 49 of the Treaty on the Functioning of the European Union;
  3. shareholders and members of the administrative, management or supervisory body of ASPAAS, including non-executive members, as well as volunteers and paid or unpaid trainees;
  4. any person working under the supervision and direction of contractors, subcontractors and suppliers of ASPAAS.

Acts constituting breaches of the law are acts or omissions that constitute non-compliance with legal provisions and concern areas such as:

  • public procurement;
  • financial services, products and markets, and prevention of money laundering and terrorist financing;
  • product safety and compliance;
  • transport safety; protection of the environment; radiation protection and nuclear safety;
  • food and feed safety, animal health and welfare; public health;
  • consumer protection;
  • protection of privacy and personal data, and security of network and information systems;
  • breaches affecting the financial interests of the European Union as referred to in Article 325 of the Treaty on the Functioning of the European Union and as further specified in relevant EU measures;
  • breaches relating to the internal market, as referred to in Article 26(2) of the Treaty on the Functioning of the European Union, including breaches of EU competition and State aid rules, and breaches relating to the internal market in relation to acts which breach the rules of corporate tax or arrangements the purpose of which is to obtain a tax advantage that defeats the object or purpose of the applicable corporate tax law, which constitute disciplinary breaches, contraventions or offences, or which defeat the object or purpose of the law;

Conditions for protection under Law No 361/2022:

Internal/external reporting within ASPAAS is made by the whistleblower in writing, on paper or electronically, through the ASPAAS reporting channels, or at a face-to-face meeting at the whistleblower’s request.

Content of reports:

In line with the Reporting Form, a report must include at least the following:

  • name and surname;
  • the whistleblower’s contact details;
  • the work-related context in which the information was obtained;
  • the person concerned, if known;
  • a description of the act likely to constitute a breach of the law within ASPAAS and, where applicable, evidence supporting the report;
  • date and signature, as applicable.

The Reporting Form is available on the ASPAAS website, here.

By way of exception, a report that does not include the whistleblower’s name, surname, contact details or signature is examined and resolved insofar as it contains indications of breaches of the law.

Further information:

The statement setting out the conditions under which whistleblowers are protected from liability for breach of confidentiality can be accessed here.

ASPAAS processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.

In accordance with the law and with Order No 693 of 17 January 2025 on the submission of statistical data under Law No 361/2022, as amended and supplemented, issued by the National Integrity Agency (ANI), ASPAAS submits annually to the National Integrity Agency statistical data on reports received through external reporting channels.

Legislation:

Law No 361/2022 on the protection of whistleblowers, updated as at 12 April 2023

LAW No 161/2003 on measures to ensure transparency in the exercise of public office and in the business environment, and on the prevention and punishment of corruption

Law No 78/2000 on the prevention, detection and punishment of corruption, as amended and supplemented

Anti-Bribery Convention:

Please also refer to the information in the main section/button Anti-Bribery Convention  on the obligations and regulations applicable to statutory auditors and audit firms regarding the reporting of suspected bribery of foreign public officials under the OECD Convention.