Why Whistleblowing Systems Go Underused at Japanese Companies: NAVEX Japan's Naoaki Mitsuya on What It Takes to Build an Organization Where People Can Speak Up

NAVEX is headquartered in Portland, Oregon, in the United States, and provides products for managing and strengthening governance, risk and compliance. In Japan, its core business is a global internal reporting (whistleblowing) solution. Some 13,000 companies worldwide use the company's services, and Mitsuya drew on this customer data to explain the situation at Japanese companies.

According to Mitsuya, one report per 100 employees per year is often cited as a healthy level of internal reporting. NAVEX's data puts this figure at 0.4 in Japan and 1.57 globally. As the interviewer noted at the outset, more reports are not necessarily better. Even so, Mitsuya says Japan's figure is low both compared with the global average and compared with the target of one.

The major reason Mitsuya points to is the culture of lifetime employment. Although young people have recently become quicker to change jobs, the culture of graduating from university and working at one company for a long time remains deeply rooted. As a result, even when people notice a problem, they worry that the person who spoke up, or the person reported, will find it hard to stay at the company, and they tend to try to resolve things among themselves before it becomes a big deal. To put it negatively, speaking up is perceived as "telling on" or "snitching." Mitsuya believes this is a major factor and said that this is in fact how he understands the situation.

Asked whether Japanese temperament plays a role, Mitsuya agreed and shared an example from a client company. That company encourages reporting across the organization in an effort to build a speak-up culture. When a report came in about one department and headquarters informed the department's general manager, the manager apologized, saying, "It's finally come from my department too. I'm sorry."

Headquarters reportedly replied that receiving a report was evidence that a speak-up culture was taking root and was not a bad thing. Mitsuya recalls finding the story striking. The person's account suggests that the feeling that a report is something shameful for a company or department, or a sign that something is wrong, still runs strong.

Asked whether there are simply fewer issues worth reporting in Japan, Mitsuya said he believes the issues do exist. The real problem, he said, is that in many cases employees do not know a reporting hotline exists.

Because of his work, Mitsuya sometimes visits various companies' speak-up websites. He says there are cases where the page is in a very hard-to-find place, or where it is unclear how to file a report. Mitsuya sees insufficient awareness as another contributor to the low number of reports.

As for how widespread these systems are, Mitsuya offered a rough estimate: since companies with 300 or more employees are required to set up a hotline, perhaps around 70 to 80 percent of listed companies have one.

Even with a system in place, some companies see it used and others do not. Mitsuya cited the differences as, first, whether the hotline is known, and second, whether anonymity is protected. One can report under a free email address to hide one's name, but the worry remains that one's identity could be inferred from the email address or other details. And the biggest factor, he says, is whether the company will take one's report seriously.

When asked, client companies that managed to increase their number of reports described efforts that were all steady and unglamorous. One is for senior management to communicate the importance of a speak-up culture. Another is to show internally what happened as a result of reports—for example, sharing within the company that someone was demoted for harassment. Mitsuya believes a key point is demonstrating in this way that the appropriate departments, such as compliance, are properly handling reports.

On what the amended Whistleblower Protection Act requires of companies, Mitsuya says that on the ground, the biggest concern is how to ensure anonymity and protect whistleblowers. The aspects of NAVEX's products that customers value, he says, are likewise its global coverage and whether it provides a mechanism that lets people report anonymously and with peace of mind.

Asked whether one can judge from the outside if a company has adequate whistleblower protections and response systems in place, Mitsuya said it is difficult to tell. However, companies that reach out with inquiries because they want to take action tend to be relatively well prepared.

Mitsuya also touched on a contradictory reaction. Some companies worry that introducing NAVEX's system and expanding anonymous hotlines will cause reports to surge. The concern is that with only three or five people handling reports, a doubling or tripling of cases would be a problem. So when he asks, "What will you do if reports increase?" the responses divide. Mitsuya sees companies that answer that they will push upper management for more staff or use the system to improve efficiency as examples of those that take a proactive approach and succeed. Conversely, with companies that respond negatively, saying it would be hard to staff up if reports increased, he gets the impression that they will not adopt a system for the time being unless something detrimental happens to them.

In recent years, there have been a string of reports about internal whistleblowing reports not being handled properly at private companies and government agencies. Asked about the downsides of such improper handling beyond penalties, Mitsuya answered that it is "entirely reputational risk."

The biggest, he says, is being covered by major media outlets and facing a backlash. Mitsuya also referred to the example of a large company where accounting fraud came to light under the immense power of an owner-executive. When that happens, it leads to the perception, including among business partners, of "Is this company okay?" For consumer goods rather than B2B, and especially for products like food, the anxiety spreads to the products themselves: "Is this really safe?" For this reason, Mitsuya believes that getting compliance right at the root has an impact that goes beyond how much a fine might be.

Asked where companies should start to improve their soundness, Mitsuya prefaced his answer by saying it is "something very basic," and named education. Citing examples of part-time workers posting inappropriate images on social media and the company taking a major hit, he said that the root of it all is education.

However, simply handing out a code of conduct or behavioral guidelines to employees and having them read it is not enough. He says efforts such as online video training and regular tests to check comprehension are necessary. Mitsuya himself has undergone such training at each of his previous employers. The content was much the same every year and mostly things he already knew, and he took the courses wondering why they were made to do so much of it. Even so, Mitsuya says the most important thing is that repetition gradually changes employees' awareness. Systems can detect suspicious activity or track behavior to prevent problems before they occur. But because it is humans who use the systems, Mitsuya's view is that things will be tough unless people's awareness changes first.

On how much AI and digital tools can handle, Mitsuya said NAVEX is incorporating AI in various ways. At the same time, he said internal whistleblowing is a field where humanity and human connection remain essential to the very end, and AI is positioned strictly as something that supports the work.

Mitsuya first explained the reality of reports. Both from what client companies say and from NAVEX's data, 40 to 50 percent of reports stem from HR matters or interpersonal relationships. There are also many cases where people regarded as low performers, or people who have been encouraged to resign, file reports. In addition, some reports lack the "5W1H" (who, what, when, where, why and how), making their credibility questionable.

Here Mitsuya described, as something a little further in the future, a use in which AI analyzes report content and, if information is missing, sends it back to the reporter for follow-up exchanges. The flow would be to vet the information to some degree before handing it over as a case for humans to handle.

On the other hand, Mitsuya stresses that responding to reporters should be done by people. In Japan, people have very few occasions to blow the whistle, and if someone has summoned the courage to speak up, saying "This is really not okay," responding with something like a chatbot reply would be emotionally problematic. If the staff member shows empathy and the reporter feels they are being listened to by someone who is thinking about them, a person who reported anonymously may eventually reveal their name and tell the truth. Mitsuya said this is something that remains as a result of people engaging sincerely.

As AI features already implemented, he cited a function that classifies reports into issue categories, and a function that uses machine learning to convert reports received in English, German, French and other languages into Japanese or English. Mitsuya also sees AI agents beginning to enter this field to some extent. The service currently covers 70 countries, and its telephone intake (telephony) supports 150 languages, which Mitsuya said covers nearly all major languages.

Given that some reports are driven by grudges and resentment, what proportion of reports should companies act on? Mitsuya explained that every client gives the same answer: 100 percent of reports that come in must be addressed. There are cases where the same person reports three or four times, but once a report is filed, it is addressed.

How far to go in addressing it, however, is a separate question. Some degree of line-drawing is needed regarding whether something truly qualifies as a whistleblowing report or is simply a complaint. The challenge, he says, is deciding where to draw the line rather than continuing exchanges indefinitely. No one turns reports away outright, but cases may be closed if requests for additional information go unanswered. Even so, each company reportedly says that, as a rule, it handles reports sincerely.

On whether report content differs by country, Mitsuya presented a NAVEX data sheet. Reporting categories include accounting and financial reporting; business integrity; HR, diversity and workplace respect; environment, health and safety; misuse or misappropriation of corporate assets; and other.

What Mitsuya found "interesting" was that the proportions and rankings of the categories were nearly the same in Japan, Asia and worldwide. HR, diversity and workplace respect accounts for 48.3 percent in Japan, 44 percent in Asia and 54.5 percent worldwide. This means interpersonal issues, such as being subjected to offensive language or verbal abuse, make up about half. The interviewer had thought this might be a tendency peculiar to Japan, with its emphasis on interpersonal relationships, but according to Mitsuya, while there are some differences, the trend is nearly the same in every region, and this category stands out everywhere.

On success stories from companies that have put internal whistleblowing systems in place, Mitsuya first noted that the reports received are a mixed bag, including grudges and resentment. He then said that, on rare occasions, they include reports that could harm not just one department but the entire company. When such a report is found, staff reportedly say they feel their work is meaningful to the company. Mitsuya considers it a major benefit that companywide problems can be reported in advance, preventing harm to the company.

At the same time, he touched on the burden on staff. Listening to grudges and resentment is mentally similar in some ways to call center work and requires toughness. He says he has also heard of cases where staff behaved high-handedly toward reporters, and those staff members were in turn reported themselves.

On institutional outreach to small and medium-sized enterprises and private companies, Mitsuya explained that currently it is treated as a best-effort obligation, with only the 300-employee threshold in place. He then expressed the view that the key will be raising awareness through revisions to the whistleblower protection system and coverage by the mass media.

Asked about the line requiring companies with 300 or more employees to implement such systems, Mitsuya said it is appropriate. In an organization of 10, 20 or 100 people, reports become a matter among insiders, and even if anonymous, it is immediately obvious who said what. In the case of bullying, there are people who saw it, so if it happened there, people can guess that a certain person must have been the one who reported it. Even if someone in procurement were doing something like taking bribes, only a handful of people would know about it. Mitsuya's assessment is that at a scale of around 300 people, it becomes difficult to hunt for the culprit—though such hunting is undesirable—and it becomes a size at which people may feel they can make a bit of an effort and try reporting anonymously.

Mitsuya entered the world of GRC and risk management around 2008, a time when Japan's version of the SOX Act (J-SOX) tightened regulations on accounting audits. Back then, saying "GRC" meant nothing to anyone. When he proposed making risks visible to listed companies, he was even told to his face that it would be a problem to have things made visible because they were doing various things with procurement and so on. After that, each time scandals at major companies came to light, the word "compliance" (often shortened to "konpura" in Japanese) became widespread even among the general public.

Acknowledging that the term "speak up" is still unfamiliar today, Mitsuya offered his personal outlook that in five or ten years, not only at large companies, people may come to say things like, "If you do that, someone's going to speak up about you." He says the current situation resembles the period more than a decade ago when he felt a culture of compliance was gradually spreading.

Finally, asked what can be done now to change organizational culture, Mitsuya cited the involvement of senior management. Everyone knows the word compliance, but Mitsuya sees relatively few companies where top executives go as far as issuing a video message. Even when a code of conduct is issued in the name of the president or the head of compliance, if you ask staff, "Have you read your company's code of conduct?" the response is often something like, "Well, we do have a link to it," and the content is often not really read.

For this reason, Mitsuya said that, as a preventive measure, it is important to set up a compliance month, or for management including executives to focus on compliance and risk management at a frequency such as once a year or once a quarter. In the end it comes back to education, but paying more attention to it can be a means of preventing major harm before it happens. Even if the company is seen as somewhat nagging, having such a culture gives each individual a reason to stop and think when they are about to do something inappropriate. Mitsuya closed the interview by saying he wants executives and businesspeople to engage more actively in education.