Nuggets From Navex on Internal Reporting

Compliance software vendor Navex released its 2025 Whistleblower Benchmarking Report last week, a document always worth reading for its analysis of trends in internal reporting and what those trends might mean for your compliance program. Let’s take a look, shall we? 

The Navex report is useful because it’s so expansive, this year crunching 2.15 million hotline reports from more than 4,000 businesses around the world; and so detailed, tracking reports across five major types of risk and 24 specific issues. Navex has also been publishing this whistleblower analysis for nearly 15 years, so we have plenty of historical trends to ponder as well. 

Among the most notable findings from this year’s report… 

• Employee use of the hotline has leveled off in recent years, but leveled off at a high level compared to the pre-pandemic era. Navex measures reporting volume by number of reports per 100 employees to normalize across large and small organizations. That figure was 1.57 reports this year, same as it was last year and in 2023. That compares to an average of around 1.40 reports in the 2010s, and a low of 1.26 in 2021. Such differences might seem small in absolute numbers, but in relative terms going from a median of 1.26 to 1.57 is a big spike — and apparently that spike is not an aberration. 
• Substantiation rates are higher than ever. The overall substantiation rate for all internal reports was 46 percent, the highest Navex has ever recorded and well above the low 40s that Navex tracked throughout most of the 2010s and early 2020s. This could mean the quality of hotline reports is improving (good) or compliance teams’ investigative abilities are improving (also good). 
• Follow-up rates for anonymous reports are headed down, from a high of 36 percent in 2019 to only 26 percent this year. That is not something compliance officers want to see. Anonymous reporters who follow up on their case (which modern internal reporting systems allow you to do) can provide more intelligence, or perhaps even be “flipped” into named reporters. People who don’t follow up on their reports either don’t care what happens, or don’t trust that you’ll treat them properly. Neither idea is one you want to take root in your organization.
• The mix of reports companies receive has evolved slowly for years. Navex tracks 24 specific types of incident reports, grouped under five major categories. The mix of those categories has changed marginally since 2021: away from accounting fraud and EHS concerns, toward business integrity and workplace civility issues. See Figure 1, below.

One disclosure before we go any further: Navex does pay me to write guest blog posts from time to time and to assist with other private projects. The whistleblower benchmarking report was not one of them. Nor did Navex pay me to write this post, or get to see the copy in advance. 

Reporting Trends in Context

The findings in the report point to a few fundamentals that compliance officers should keep in mind, but none of the findings are all that surprising, to be honest.

For example, internal reporting teams still need a wide range of reporting channels (phone, email, web forms) to make your hotline as accessible as possible. This was the first year that web submissions surpassed phone calls as the primary intake method, but not by much (see Figure 2, at right); you certainly still need a robust intake structure that focuses on accessibility of the hotline to employees, rather than simplicity or low cost for you.

Ditto for retaliation complaints. As much as compliance professionals talk about the scourge of whistleblower retaliation — because we talk about it all the time — actual reports of retaliation are rare (only about 3 percent of all reports at the average company), and the substantiation rate for retaliation complaints is low too (18 percent versus 46 percent for all). Still, you always need to worry about retaliation because it can have such a corrosive effect on corporate culture; once your workforce believes that retaliation is a problem within your organization, good luck getting them to trust you or your reporting system ever again. 

The upward trend in substantiation rates is interesting because it can mean a few things. First, it could mean that employees are bringing you better intel and more comprehensive complaints. That’s good; it makes your job of investigating the report easier. So you’d want to be sure that your hotline system allows for such comprehensive submissions — and that’s more likely to happen via web or email channels (where employees can append documents and other evidence) than it is over a phone line.

It could also be that your investigations team is getting better at finding facts and determining violations more promptly. Or that the mix of complaints you receive are more easily verified. Or (most likely) some blend of all these factors. If I were a CCO I’d want to understand trends in my own organization’s substantiation rate at a deep level, since that knowledge consequently helps me understand my needs for risk assessment, disciplinary action, budgetary resources, and more.

The other striking thing to me is the relative stability of the mix of complaints year after year, as seen in Figure 1 above. Sure, that mix is evolving over time, but it’s evolving over a relatively long period of time. Moreover, the solid majority of complaints are right in the ethics and compliance wheelhouse: workplace behavior and business integrity. 

Perhaps that’s the final point, then: no matter how internal reporting trends are changing over time, compliance teams still have plenty of raw material arriving from the hotline to keep you busy. That’s not likely to change any time soon.