Objective
The objective of this procedure is to describe the desirable way, according to the EU Directive and the WEA, of handling cases submitted to the Visma Whistleblowing Channel and the procedures regarding the handling and solving of such cases, while at all times ensuring the protection of the notifier (person who reports a breach of EU/EEA or local law).
The output of this process is that the reported case is handled with discretion and closed, with necessary actions taken.
This procedure is owned by Visma Group Legal and was last updated in October 2021.
Who can report
Any employee, former or existing, or self-employed person in Visma, a shareholder, or someone from outside of Visma, e.g Visma’s suppliers and customers with a need to notify of a breach or a potential breach of the local or EU/EEA law or any of Visma’s internal rules/policies, such as Visma’s Code of Conduct, can report. This procedure also applies to third persons who are connected with the notifier, and who could suffer retaliation in a work-related context, such as colleagues or relatives of the notifier.
What can be reported
All reports shall be based on justifiable grounds of suspicion. Evidence is not necessary, but reporting must not be made with the intention to cause harm or with the knowledge that the accusation is false.
Whistleblowing that fulfils this criteria shall be treated as a “Qualified Reporting” and handled in accordance with the Visma Whistleblowing Procedure.
What cannot be reported
Types of cases other than those listed above should not be reported. Such cases that do not fulfil the criteria will be treated as “Non-qualified reporting”. A non-qualified reporting will not be handled within the Visma Whistleblowing Procedure.
Examples of cases that should not be reported through the Visma Whistleblowing Channel are:
- General opinions on how the business is run
- General opinions on salary, leadership or other personnel matters
Such cases shall be handled by reporting to the relevant manager or any other relevant person within the management of the company in question.
How the reporting should be done
Reporting is made by submitting a form either anonymously or with a full name. Using a full name will enable Visma to get back to the reporting person and request more information if necessary. This will usually increase the chance of resolving the reported case. Visma therefore encourages the notifier to report the case with his or her full name, but respects, however, if the notifier wishes to uphold his or her status as anonymous.
If you are reporting anonymously please make sure that you put down as much information about the matter as possible and at least the following:
- The Visma company connected with the misconduct/breach of local/EU/EEA law
- If the case is closed or still ongoing
- Description of the misconduct/breach and who’s involved
- Facts, evidence or proof of the misconduct/breach
- Name of people that may provide more information regarding the suspicion
If reporting is done through a different channel
If a notification is received through a different channel, the recipient shall use the Visma Whistleblowing Channel to register the case and the same steps shall be used in handling the case.
The process
Overview of process:
Notification
When Visma receives a report submitted through the Whistleblowing Channel, the Visma Whistleblowing Council (the “Council”) will immediately receive a notification for processing. The Visma Whistleblowing Council consists of:
CEO, Merete Hverven
CFO, Stian Grindheim
Chief Risk Officer, Lars Martin Ottersen
Head of Legal Benelux, Hjalmar Florijn
Exception
For Visma companies with more than 250 employees, the notifier can choose to have the local company handle the case further. The Whistleblowing Council will in these cases hand over the case to the board of directors for the specific company.
An exception will also apply to all Visma companies that are regulated by a financial supervisory authority and required by any specific regulations other than the EU Directive referred to above to provide for a whistleblowing channel. In such cases the notification will be sent to the board of directors for the specific company and the case will be handled by the board, according to this process and the local specific regulation. The board may at any time involve The Whistleblowing Council and is obliged to inform the Council when the case is handled and closed.
Qualified or Non-Qualified report
The first decision by the Visma Whistleblowing Council will be to decide whether the reporting is to be treated as Qualified or Non-Qualified Whistleblowing. If the Visma Whistleblowing Council resolves that it is a Non-Qualified Whistleblowing, the case is immediately closed with no further actions.
If the whistleblowing is considered to be Qualified, the Visma Whistleblowing Council will be obliged to start the investigation process.
Initiation
If the report is not submitted anonymously, the notifier will be invited to a meeting to discuss the content of the report and to provide more background information regarding the relationship and / or discussion of further handling of the case. In this meeting, agreements shall be made on how to communicate in the further course of the case, including consideration to immediately inform the relevant Visma Company's Board and/or the Visma Group Board.
If the report is submitted anonymously the Council shall make its best effort to investigate the matter.
The Council shall send a receipt of the report to the notifier within seven business days after the report has been submitted through the Whistleblowing Channel.
Research
Investigation and decision on how to proceed
- Describe what is the issue that needs solving
- Decide what is the best way to solve this issue
- Acknowledgment of receipt of the report to the notifier within seven days
- Further handling should be based upon the nature of the case and its content, not how it is presented by the notifier
Handling
- Obtain external assistance depending on the degree of impartiality and persons involved (e.g. the management)
- The method should be adapted to the nature of the problem, the content and the persons involved. Methods that may be used:
- Document analysis
- Conversations
- Use of experts
- Consultation with immediate contradiction (gather both parties in one room - get the facts on the table)
- Interviews with key persons that may have information regarding the suspicion or the case
- Review of documents, e.g. accounting, project implementation
- Keep the notifier informed
- His/her manager shall ensure that any retaliation is prevented
- Employers/managers must assess the need for measures continuously
- Work capacity and adaptations
- Legal aid
- Health care (often necessary)
Follow-up
- This communication plan flow should be followed
- Work ability must be assessed and followed up
- Depending on the severity, the Visma Whistleblowing Council will consider contacting the local National Authority for Investigation and Prosecution of Economic and Environmental Crime
- Appropriate measures should be taken (mitigation or/and prevention regarding future similar cases)
- Suitable feedback to the notifier regarding the investigation and handling of the case and the result
- The recipient must prepare a reasonable timeframe to provide feedback, not exceeding three months from the acknowledgment of receipt
Documentation
All activities related to the case must be documented. Necessary documentation must be gathered and the Visma Whistleblowing Council/the Board of the Visma company shall document everything during the process. A code name for the case shall be made and all case information shall be stored in a restricted folder in Google Drive. Personnel data will be processed in accordance with the Visma Privacy Statement.