a report turns out to be unjustified after investigation, what must I do with it

Found to be unfounded, but the procedure continues

A report that appears unfounded after investigation must still be properly concluded like any other report: with an assessment, feedback to the reporting person and a record of what occurred. Unfounded does not mean the report never existed — it means the investigation did not confirm what was reported. That distinction is important, because the reporting person still has the right to information about the outcome, even if that outcome is that nothing was found. How that feedback looks and within what timeframe it must happen is described at when must I inform the reporting person about the assessment?

An unfounded report also requires careful attention in two directions. On the side of the reporting person: they remain protected against retaliation because of making the report itself, even if afterwards nothing turned out to be true — unless there is intentional falsehood, which is different from a report that simply could not be confirmed. What falls under that is described at what constitutes retaliation against a whistleblower? On the other hand, an unfounded report requires proper closure and documentation, so it is clear why it was decided that no further action would be taken. How that closing and documentation looks is described at how do I close a report and what do I record?

Basis in the internal reporting procedure and the record-keeping obligation

That a report — whether founded or not — is handled and concluded within the internal procedure follows from Article 2 of the Whistleblower Protection Act, which regulates the internal reporting procedure. That data about the report and its handling are kept, even when the outcome is unfounded, follows from Article 18 of Directive (EU) 2019/1937 on keeping records of reports.