Whistleblowing based on the three lines model

Directive 1937/2019 on the protection of persons who report breaches of Union law became effective very recently. However, Directive 1937/2019 lacks sufficient guidance on the implementation or governance of whistleblowing frameworks. In addition, the existing literature lacks a definition of whistleblowing and whistleblowing frameworks that is appropriate for internal audit and fraud prevention. The purpose of this paper is to address the lack of a definition of whistleblowing and whistleblowing framework appropriate for internal auditing and to guide the roles and responsibilities within an organization to apply and maintain a robust whistleblowing framework. To this effect, the Three Lines Model is used, one of the most recognized theoretical models in effective risk governance and internal audit.