CMI Whistleblowing Policy
Aim of the policy
The aim of this Policy is to encourage employees, partners, and others who have serious concerns about any aspect of CMI as an institution or CMI’s work to come forward and voice those concerns, so that measures can be taken.
To achieve this, CMI will make it possible for employees at all levels, including short term staff, to notify internally of such concerns without any fear of retaliation. CMI will also make it possible for partners or any other third party to report their concerns.
What can be notified?
All types of blameworthy circumstances, such as:
- breach of legislation,
- financial default, corruption,
- breach of CMI's internal rules or ethical guidelines,
- improper behavior (e.g. sexual harassment, bullying, discrimination)
- violation of ethical standards that have broad support in society.
Who should be notified?
For CMI employees, notification of concerns or blameworthy circumstances must be made to the nearest line manager, unless the case relates to this manager, in which case his/her immediate superior should be notified. Concerns can also be raised with the safety representative or union representative. Where the employee's notification is not followed up by the person who is notified, the employee may notify this person’s superior. If concerns are to be raised with external authorities, the relevant inspection authorities should be contacted.
Non-employees may raise their concerns by contacting the dedicated email address whistleblowing@cmi.no which is managed confidentially by CMI’s dedicated HR person.
How to notify?
Notifications are preferably made in writing, describing the case with critical details (e.g. what, where, how, who), in order to facilitate the investigation. CMI wishes to encourage the whistleblower to identify who he/she is. This makes it easier to follow up on a concern and to keep the whistleblower informed of how his/her case is being handled.
If the whistleblower does not wish to appear in name, it is better to notify anonymously than not notify at all.
Responsibility for the person who receives notice
Anyone who is notified of blameworthy circumstances are obliged to inform the whistleblower of how the matter is being handled, and to strive and ensure confidentiality. Such feedback should be given as soon as possible. The notification must be addressed within two weeks, and measures must be taken. Feedback should also be given in cases where the manager/safety representative decides not to bring the matter forward.
The person who receives a notification about blameworthy circumstances has a responsibility to help ensure that this does not have any negative consequences for the whistleblower. Notifications are treated confidentially.
Where the notice is given orally, the person receiving it is responsible for registering the notification in writing.
Whistleblowing cases must be filed in confidential HR archives.
Link to AML § 2A: https://www.arbeidstilsynet.no/regelverk/lover/arbeidsmiljoloven/2a/
Details of duty to inquire and follow-up
Follow-up of notification
- In order to assess a case, information must be obtained on the following: who is involved in the matter, who has already been informed of the matter, and who must be informed about it.
- The responsible manager decides where in the organization the case is to be processed and informs the whistleblower about this.
- The whistleblower shall be given the opportunity to present his/her view to the person/persons who will handle the case, preferably in a meeting from which a written report is written. The report should provide information such as description and time of the event (s), name of persons and their affiliation with the Institute.
- Furthermore, an assessment must be made of which regulatory framework may be considered as broken in connection with the reported incident.
- If a notice involves charges against employees or students at CMI, the responsible manager shall first examine whether the statements in the notification may be deemed to be correct. Incorrect statements may be due to the fact that the whistleblower has reported in good faith but has mistaken the facts or other essential circumstances.
- When investigated, the individual who has been reported must be informed of this, of which information is provided, and be given the opportunity to give his/her version of the case. If CMI collects information in connection with the case the individual should be kept informed. This does not apply to cases where, for the sake of possible police investigation, it is important that the person concerned is not informed of the notification.
- Anonymous alerts should be investigated as far as possible. If the facts of the case turn out to be correct, the fact that the notification was anonymous should be described and added to the case.
- The guidelines establish that notification matters must be treated confidentially. Confidentiality implies in this context that the identity of the person(s) involved is not to be disclosed to others than necessary for the further processing of the case.
- There is a duty of confidentiality regarding someone's personal circumstances. Personal circumstances include information about physical and mental health, character, emotional life, social or personal issues.
Processing of the case must be documented in writing, by reporting of the notification’s warning content, summary of investigations, minutes of meetings and any other conversations, as well as report on findings and conclusions. Documentation is particularly important in matters that can result in liability for individuals.
- If the person being notified about is requesting access to the case, he/she can generally demand to be informed of the identity of the whistleblower.
Completion of whistleblowing cases
- When the case has been processed, the whistleblower and, if applicable, the person who is notified about, shall receive feedback, regardless of the outcome of the investigation.
- Final report is written and archived.
- If the case obviously is not a notification case, this must be justified and added to the casefile. The notifier in the case receives feedback on the outcome.
- If the case is not a warning but should be followed upon, the case will be terminated as a warning but followed upon where it belongs.
In accordance with section 28 of the Personal Information Act (https://lovdata.no/EN/lov/2000-04- 14-31/§28) personal data shall not be stored longer than is necessary for the purpose of the treatment.
Updated: September 2019