As compliance and ethics professionals in large, multinational organizations, staying ahead of whistleblowing and incident management trends is critical to fostering a culture of integrity and mitigating risks. NAVEX’s 2025 Regional Whistleblowing & Incident Management Benchmark Report offers a comprehensive analysis of over 2.15 million anonymized reports from 4,077 organizations worldwide, representing 69 million employees. I’ve finally had a chance to dive in and take a closer look at the data. This article summarizes the report’s key findings, providing actionable insights to enhance your internal investigations and whistleblower hotline programs. This guide covers regional trends, risk categories, and best practices for compliance officers in 2025.
Why the NAVEX Report Matters for Compliance Teams
The NAVEX report ultimately offers a goldmine of benchmark data for corporate compliance practitioners. The report offers granular data and key metrics, sorted by a number of different variables. In addition to the usual geographical breakdown—North America, Europe, Asia Pacific (APAC), and South America—the 2025 report also includes insights on company ownership (private vs. public) and third-party reporting. By analyzing data from each year, compliance officers compare their whistleblowing and reporting programs against peers, identify potential gaps, tailor their yearly compliance plans, and ultimately further strengthen ethical cultures. These reports are a vital resource for tailoring compliance strategies to diverse operational contexts.
The NAVEX report, along with others in the industry, should be a staple for all compliance officers. It provides excellent comparative metrics to measure your specific program. That said, it’s important to remember that these benchmarks should be helpful guidance, not mandatory objectives. All programs are unique and every company is at a different point in its compliance journey. That said, look closely for useful nuggets to help guide your future efforts. If reporting rates are significantly lower than benchmarks, it may be time to focus on an awareness campaign that involves updating or creating new posters, communications, trainings, or other methods. If you’re seeing higher volumes of retaliation, especially if that’s coupled with a higher substantiation rate, then you may have a deep, cultural issue that needs immediate attention.
Top Findings from the 2025 NAVEX Report
1. Report Volume Varies Significantly by Region
The median Reports per 100 Employees highlights stark regional differences in hotline activity:
- South America: 2.97 reports per 100 employees, the highest globally, though influenced by a smaller dataset.
- North America: 1.75 reports, reflecting a robust reporting culture.
- APAC: 0.78 reports, indicating lower reporting rates.
- Europe: 0.67 reports, but with a notable increase from 0.49 in 2023, suggesting growing awareness.
I would have thought North America would have been at the top in terms of reporting. In my experience, and this is admittedly anecdotal, North American companies have truly embraced hotline reporting and most of my clients continue to strive to increase awareness through communications, trainings, and town hall meetings with compliance. That said, the report suggests that the high number in South America could be influenced by a smaller dataset. That said, it is good to see a high reporting rate in South America since it does tend to be one of the riskier geographies in many ways.
I’m not overly surprised by the low numbers in Europe. I’m sure they are pulled down by many Eastern European countries. I have frequently seen extremely low reporting numbers in those regions as there exists a type of latent “don’t snitch” culture. While it could be a culture remnant from the Soviet era. Regardless, many companies find that their workforces in these countries fail to embrace these hotlines.
There is no perfect number of reports that should be coming into the hotline. Receiving few or zero reports can typically be a huge concern—it usually means that employees are not aware of the hotline or that there are significant retaliation concerns. I recall conducting a compliance audit for a company at their South America business, specifically seeking answers as to why the local staff rarely used the hotline. As it turns out, the regional president would always interrupt the compliance team during presentations to joke how those hotline reports come to a phone on his desk. Turns out most of the staff actually believed him, or at least didn’t want to take the risk that he was telling the truth.
With that said, you should typically compare the volume of reports against substantiation rates. This can give you a better picture about the quality of the reports you’re receiving. If you have a high volume of reports against a very low substantiation rate, for example, then there may be an issue. It could be that the reports you’re receiving may be low quality or made in bad faith, so some training or education about the hotline may be helpful. It could also mean there are issues in the investigations that are leading to poor substantiation. On the flipside, if you have a low volume of reports but a high substantiation rate, you may not be receiving enough reports. The reports you receive are only for the obvious issues, and you may be missing some suspicions or allegations that could ultimately lead to uncovering large misconduct earlier. It’s a balancing act and you’ll need to look at things holistically.
Actionable Insight: Compare reporting rates amongst the different jurisdictions in your organization. Focus your efforts on raising volumes from the lagging regions with targeted training or communications. You may need to work through any local cultural issues that could be hindering reports. Finally, take culture surveys or host local town halls to identify any potential retaliation concerns that need to be addressed.
2. Case Closure Times Show Regional Disparities
Efficient investigations build trust, but closure times vary greatly across jurisdictions:
- North America: 19 days, the fastest globally.
- Europe: 69 days, potentially due to higher anonymous reporting.
- APAC: 56 days, reflecting similar challenges.
Case closure time is one metric that all organizations should keep a close eye on. You should be tracking it year over year and striving to ensure investigations continue to be conducted as efficiently as possible while ensuring completeness. Again, while all organizations can be different and investigations can present all types of challenges, I suggest most organizations should at least strive to reach a 45-day case closure average. Many of the best compliance programs reach closer to a 30-day average.
I find that case closure time is one area that almost all companies I work with can improve upon. However, pushing to meet a benchmark like this should never compromise investigation quality and thoroughness. There are all sorts of investigations that will inevitably require a significantly longer time frame. Investigations pursuant to a government inquiry, for example, or those that involve senior officers, may naturally take longer to complete. However, if you find that those types of serious investigations are constantly pulling the average to the longer end, you probably have larger cultural problems.
That said, most run-of-the-mill hotline reports can—and should—be completed relatively quickly. I recall a risk assessment I conducted for a client where we learned that a senior vice president had been the subject of an investigation that had been open for two years by that point. We obviously assumed the worst, but when we asked more about it, it turns out that it was mainly due to this individual throwing out some personal trash in the company dumpsters. Now there were some unique circumstances here owing to the company’s highly regulated industry; however, two years was still overkill in a big way. This investigation was draining resources and hurting morale for those involved. No surprise, we also found the company had very low reporting rate relative to its peers, likely due to its slow and ineffective investigation protocols. No one, even those that who had legitimate concerns and grievances, wanted to be dragged into one of those cases.
Actionable Insight: Balance thoroughness with timeliness. In Europe and APAC, streamline anonymous report investigations using advanced case management tools to reduce closure times without compromising quality. Create templates and other resources—such as outlines, standardized questions, communications, etc.—to ensure your investigation team can move quickly.
3. Workplace Conduct Still Dominates Risk Categories
Globally, Workplace Conduct accounts for 54% of reports, covering issues like harassment, discrimination, retaliation, and workplace civility. This category is a critical indicator of organizational culture:
- North America: 53.8% of reports, with a slight dip in workplace civility reports.
- Europe: 43% substantiation rate for Workplace Conduct, lower than the global 47%.
- APAC: 44% substantiation rate, with consistent growth in civility concerns.
This is normal and has been the case for several years now. There has been a notable rise in reports related to insider trading and political activity. The latter is probably not all that surprising considering how polarizing politics has become over the last few years. Regardless, of the type of concern, it’s important to treat them all with the same level of concern and quality. Furthermore, many seemingly small workplace conduct concerns can lead to larger issues down the line. First, workplace conduct issues can set the foundation for larger compliance issues, such as retaliation. Second, unhappy employees may either look the other way when larger misconduct does happen or, even worse, participate in it.
Finally, set up a proper triage protocol from the outset to ensure that the right team is engaged to investigate the proper allegations. Investigations can be a major “turf war” between HR and Compliance when the boundaries should be determined and set at the outset. Improper protocols here can lead to information silos and compliance could be caught off guard in the future when the data was right there all along.
Actionable Insight: Don’t dismiss Workplace Conduct reports as “HR issues.” Track these cases rigorously, as they signal cultural health. Implement anti-retaliation policies and monitor civility trends to prevent escalation of misconduct. Develop triage protocols so that these types of concerns are routed to the appropriate team for handling.
4. Retaliation: A Persistent Challenge
Retaliation remains a significant barrier to effective whistleblowing programs. Key regional differences include:
- North America: Highest retaliation reporting frequency (1.16%), but lowest substantiation rate (17%).
- Europe: 0.87% frequency, with a 32% substantiation rate, nearly double North America’s.
- APAC: 28% substantiation rate for retaliation reports.
Retaliation is a significant issue and needs to be addressed whenever it arises. If your company states that it has a “zero tolerance policy” towards retaliation, then it really needs to be zero tolerance. The best way to undermine compliance culture is to look the other way when a high performer or a senior leader is caught red handed retaliating against another employee.
I also like to suggest periodic culture surveys or town hall visits throughout the various factories, warehouses, offices, and locations that your company operates in. Get out on the ground floor and meet your employees and hear what they have to say. Set up small focus groups where employees can feel free to speak candidly, you may be surprised at what you hear. I can go back to my prior story about the manager that kept joking that the reporting hotline routed to a phone on his desk. Employees thought he was serious! We were only able to find that out by sitting down with staff at the foreign office and having a conversation.
Actionable Insight: Reinforce anti-retaliation policies through regular training and clear communication. In North America, invest in thorough retaliation investigations to improve substantiation rates, building trust in the reporting system.
5. Differences in Private vs. Public Companies
For the first year, NAVEX also aggregated the data by company ownership type, showing trends between public and private companies, as well as government entities and education institutions. The report’s new analysis of company ownership reveals some notable differences:
- Reports per 100 Employees: Private companies report more frequently (e.g., 2.12 in North America vs. 1.27 for public).
- Private Companies: Higher substantiation rates across all regions (e.g., 50% in Europe, 49% in North America).
- Public Companies: Lower substantiation rates (e.g., 45% in Europe, 42% in North America).
The notable difference in reporting is not too surprising for me to see. The private companies I have had as clients tended to have a more familial atmosphere and most employees felt completely comfortable with raising concerns, many times by just walking in to see their direct manager. That ultimately led to fewer reports on the hotline, though it would be available if needed. Also interesting, though maybe unsurprising, is that most of those hotline reports tended towards anonymity.
The additional data here provides further useful benchmarks for your respective companies. This can help you take a broader look at your speak-up culture to see if employees feel comfortable enough to raise concerns, regardless of which route you choose.
Actionable Insight: Private organizations may have more familial organizations, which helps with speak up culture. Public companies should review any cultural issues and continue to encourage reporting.
6. Third-Party Reporting: A Growing Trend
Third-party reports (e.g., vendors, contractors) are significant, ranging from 7.2% to 10.2% globally, with higher rates in Europe and North America. In APAC, third-party reports have a higher substantiation rate (50%) than employee reports.
This is great change to see. There are certain industries that can be dominated by contractors and other third parties, such as the oil and gas industry. These individuals should absolutely have access to the hotline and should also, as a best practice, receive training and communications on the use of it. In general, you want your frontline workers to be the eyes and ears of compliance, whether they are traditional employees, contractors, vendors, or otherwise. The goal is to identify misconduct before it grows to be a large issue, and you want everyone you can to be empowered to report allegations.
Actionable Insight: Empower third parties to access your whistleblower hotline. Ensure reporting channels are inclusive and promote awareness among external stakeholders.
Key Actions for Compliance Professionals in 2025
Based on the NAVEX report, here are seven actionable steps to strengthen your whistleblowing and incident management programs:
- Tailor Regional Communications: Customize training and awareness campaigns to address regional reporting trends, especially in low-reporting areas like Europe and APAC.
- Offer Multiple Reporting Channels: Ensure your hotline supports web, phone, and in-person reporting, with a focus on user-friendly web interfaces.
- Reinforce Anti-Retaliation Policies: Build trust through clear policies and training to reduce fear of reprisal, particularly in North America. Zero tolerance must mean zero tolerance!
- Empower Third-Party Reporting: Extend hotline access to vendors and contractors, promoting inclusivity.
- Track Workplace Conduct Reports: Monitor these reports as cultural indicators, integrating them into compliance risk assessments.
- Optimize Case Closure Times: Streamline investigations by improving investigation protocols and utilizing technology, especially for anonymous reports in Europe and APAC.
- Leverage Benchmarking Data: Compare your program’s metrics against NAVEX’s regional benchmarks to identify improvement areas.