Policy and rules of procedure · Cenedril Handbuch

The whistleblower protection policy and the rules of procedure of the reporting office are generated in the Documents step of the setup from the details of steps 1 to 3. The policy informs reporting persons, appears in the reporting portal and applies with the management’s signature. The rules of procedure govern the work of the reporting office and apply once they are approved under Documentation → Policies & Procedures.

Generate the documents

Open the Documents step

In the setup overview open the step Documents. Choose the language you work in with the flags at the top. Below are two cards, each with a sentence on its purpose: Whistleblower Protection Policy and Rules of Procedure of the Reporting Office.

Generate and review the text

Expand a card and click Generate Document. Cenedril produces the text from the country, employer, operating model, staffing, channels and user circle, including the external reporting offices of the country. Read the text and adjust it in the editor where your organisation wants to be more specific. Save Draft keeps the state in the setup.

Complete and approve the rules of procedure

In the card Rules of Procedure of the Reporting Office click Complete. The version appears under Documentation → Policies & Procedures in the Whistleblower Protection area and waits for approval there. With the management’s approval the reporting office receives the powers the rules of procedure describe.

Send the policy for signature

In the card Whistleblower Protection Policy click Complete. Every language version with text is then ready for signature. In the section Signature of the policy by the management enter Name, Role and E-mail address of the signer and click Send for signature. The person receives an email with a personal link, confirms their identity with a code and signs in the browser. For the other language switch with Switch to the English version or Switch to the German version and send a request of its own.

The policy card after signing: for each language version, when and by whom it was signed.

Find the approved documents

View the signed policy

After signing, the policy is listed under Documentation → Policies & Procedures with the status Approved and the confidentiality PUBLIC – Public. Below the text the document page shows the block Signed by with signature and seal, name, role, date and the check value of the version, followed by the eIDAS verification and the audit trail of the signature. The reporting portal shows the same seal under the policy.

The management's signature under the policy, with seal, date and the check value of the version.

Approve and re-approve the rules of procedure

Open the rules of procedure under Documentation → Policies & Procedures and approve them. The header names Approved on, Valid until and the retention date. Before the validity ends, Re-approve confirms that the same version stays in force; a changed version needs a new version from step 4.

The approved rules of procedure with their validity. “Re-approve” extends the same version.

Renew the signature

Request the renewal

The management’s signature gives the policy a validity, usually one year. The section Signature of the policy by the management names for each language version until when it is valid and points out the end 30 days before; Cenedril also reminds you with a notification. Click Request renewal. The request goes to the person who signed. On their page they choose Renew existing signature, confirm their identity with a code and renew the signature from today. Text, version and signature stay the same, so a handwritten signature looks the same every year. With Sign again the person can sign once more instead.

Request a new signature

If the management changes, for example the managing director, and the text stays the same, click Request new signature. Enter Name, Role and E-mail address of the new person and click Send for signature. Their signature creates a new version that replaces the previous one.

After changes to the setup

Spot an outdated text and regenerate

If after approval you change a detail that appears in the text, such as the phone number or the operating model, the notice The setup has changed since this text was generated. appears above the card in step 4 with the affected details. Click Regenerate and confirm Yes, regenerate; then complete the text, and it goes to approval or signature again.

Result: The setup overview shows in the row Documents that the policy is signed and the rules of procedure are approved. The policy is available in the reporting portal, the rules of procedure are an approved internal document among the documents.

Frequently asked questions

How do the policy and the rules of procedure differ?

The policy is written for reporting persons: who can report, through which channels, how the reporting office proceeds and which external reporting offices are open. It is public, appears in the reporting portal and applies with the management's signature. The rules of procedure govern the work of the reporting office, record the established duty and the designated persons, and give the reporting office the powers they describe once approved. They stay internal.

Why does the policy not name the people of the reporting office?

So that it stays valid when the reporting office changes. Reporting persons reach the office through the portal, the phone number and the meeting; who staffs the office is recorded in the rules of procedure.

What happens if I change the setup after approval?

Above the affected card in step 4 the notice “The setup has changed since this text was generated.” appears with the changed details, for example how reporting persons reach the office. “Regenerate” produces the text from today's state. The rules of procedure then go to approval again, the policy to signature again; Cenedril revokes an open signature request as soon as a changed text is completed.

Is every language version signed separately?

Yes. The German and the English policy are two documents. Each language version goes out with its own signature request, so the signer signs exactly the text they have read.

Does the management have to sign the policy again every year?

No. Before the validity ends, request the renewal in step 4. The person who signed renews their existing signature; text, version and signature stay the same. A new signature is needed only for a changed text or when another person is to sign.