When a report comes in, you don't need to immediately assess whether the report is correct. The first step is practical: you confirm that you have received the report, you record what has been reported and you appoint a handler. The substantive assessment comes only after that.
For that confirmation of receipt, a deadline of seven days applies. For information about the assessment of the report, a deadline of three months applies. Both deadlines run automatically from the moment the report is made, even if you don't yet know in those first few days how you will handle the report.
First register, then assess
A common reaction in the first few days is that a handler immediately tries to determine whether the report is serious, whether it is correct, or who is involved. That is understandable, but the procedure asks something different of you at this stage. First you register the report: what has been reported, when, and through which channel. Then you confirm receipt to the person making the report, without saying anything about the content at that point. The substantive assessment, with possible investigation, follows in the period after that. Whoever reverses this sequence risks jumping to conclusions before the facts are available.
Who may see the report
From the very first moment, it is important that only the designated handler or handlers have access to the report. This also applies if you don't yet know whether the report is substantiated. Colleagues who are not involved in the handling should not hear a name or content at this time. In how data from a report is protected you will read how this is implemented in practice, also if the report comes in via an internal system instead of via a separate platform.
The two deadlines that run from day one
The seven days for confirmation of receipt and the three months for feedback begin to run as soon as the report is made, not when you get to it. This means that the first week is mainly about organising: who handles the report, what steps follow, and when do you communicate again with the person making the report. In the knowledge base with the complete step-by-step plan per phase you can see how these two deadlines relate to each other and what is and isn't expected of you within that timeframe.
If the report is anonymous
Even with an anonymous report, the sequence doesn't change. You register and confirm receipt, only not to a name but via the case code by which the person making the report can return later. The fact that the person making the report is anonymous doesn't mean you need to be less careful in registering; it simply means that identification is not part of the first step.
Record from the start
What you record in the first few days, you will use again later: when providing feedback after three months, and when closing the report. A clear file from the start prevents you from having to reconstruct afterwards exactly what happened and when. If you're not yet sure whether your organisation is subject to the reporting obligation, or which steps are involved, then the free check in a few questions provides an initial indication.
If you want to organise the handling of reports in a structured way, with a dedicated environment for the handler and deadlines that run automatically, you can register with a business account. If you would first like to read quietly how the first period after a report looks in practice, then check the knowledge base or do the free quick-scan.