Whistleblower hotline intake and triage that routes every report, in any language, within hours
Every report, in any language, routed to the right investigator within hours.
See one case, screen by screen ↓It is the step between a speak-up report arriving and an investigator owning it: reading the report, translating it, deciding what kind of concern it is and how serious, checking for related reports and conflicts, and acknowledging the reporter. Whistleblower Hotline Intake & Triage gives that step to six agents and leaves the routing decision with the intake lead.
How to choose AI solutions for life sciences →
Updated
Reports reach the Speak Up line by hotline call, web form, email and through managers, in a dozen languages. A Portuguese web report sent at 2 a.m. is not read until someone has it translated; then whoever is on intake summarises the English, guesses an issue type and an owner, searches the case history for anything related and checks who must not see it. Meanwhile the EU Whistleblowing Directive's 7-day acknowledgement clock is running.
The risk sits in the inconsistency. Classified on a translation by whoever is on duty, the same concern can be labelled one way in English and another way in Portuguese, and routed differently — exactly what an auditor or regulator finds. A fee to a public-hospital pharmacist reaches Legal days late, a manager in the named person's line sees a report about his own team, and samples kept for weeks in a hot car, mentioned in passing, wait in a hotline queue before Global quality hears of them.
Estimated split for one non-English report at a large drug maker, by hand and with the solution; the 3.1-day total by hand is the sample company's baseline shown in the working solution.
Six specialist agents read, translate and classify, link, guard and score every report and draft the reply; the intake lead decides who owns it.
Northwind Bio runs its Speak Up line for 48,000 people in 62 countries. Overnight, an anonymous sales representative in São Paulo writes in Portuguese about a speaker fee for a meeting that never happened. Here is what happens next, screen by screen, in the working solution.
Dana's home screen shows 15 reports in 14 days flowing from four channels and 10 languages to an issue, a severity and an owner. Two are not read yet: SU-2304, a Portuguese web form received Oct 7 at 02:14, and SU-2310, an Arabic web form arriving now. Beside the flow, the clocks: a possible data breach on SU-2308 and three acknowledgements coming due.
“Privacy · possible data breach — SU-2308 · 72-hour assessment ends Oct 9 21:10 · 60 h left.”
Dana clicks “Read, translate and classify”. Sentence by sentence, the original Portuguese, the English and what each sentence supports fill in: Rafael M., the district manager, paid R$ 18,000 to a pharmacist at Vila Aurora Municipal Hospital as “consulting” for a Corventa speaker meeting booked for September 12 that never took place. The pharmacist decides the hospital's formulary — a public official, +20. Her bonus was put “under review” when she asked — threat to the reporter, +15.
“Same route from another language: SU-2303 · Spanish (Mexico) — ‘Facilitation payment’ asked to clear customs → Bribery & corruption → Lena Ortiz.”
SU-2304's band now runs from Web form through Portuguese to Bribery & corruption · High and on to Global investigations. It lands on the same issue list as any English report, so it is routed the same way. The proposal reads High, 95 of 100, for Lena Ortiz in Global investigations — for Dana to confirm.
The report sits beside its English, sentence by sentence. The summary lists the person named, who received money, what, when, where it is recorded and the witness, each with its sentence number. The agents also read the receipt photo: Churrascaria Ponte Alta, 12 September at 21:47, 2 people, R$ 1,284.00, in Rafael M.'s name — and set it against the events system's attendance list with 14 signatures.
“A meeting of 14 and a dinner for 2 on the same night — the investigator should pull the attendance list first.”
Bribery & corruption is the primary issue, with HCP inducement, retaliation and fraud & falsified records as secondary. The score adds the issue type's 20 to six factors, each with its sentence: money to a healthcare professional, a public hospital, a manager named, a threat to the reporter, related reports and the receipt. The link finder found event record EV-55102 at a 96% match — same date, hospital and amount — and SU-2271, a June report from the same district, at 87%.
“Switch a factor off if you disagree — the proposal updates.”
The acknowledgement thanks the reporter, says the report will be reviewed confidentially by an independent team and that she will not face retaliation for raising a concern in good faith. Four open follow-up questions ask who signed the attendance list, when the bonus remark was made, what happened in June and whether other speaker meetings in the district did not take place. Each has an English line under it for the team.
“Open, non-leading questions. They never ask who the reporter is or say what others reported.”
Dana checks who is kept out — the regional director, Brazil South, who is in the manager's reporting line and whom the reporter asked not to be told — and the masked health detail about the witness. She clicks “Route to Lena Ortiz”. Case IC-1049 opens in case management, Ana Souza (regional compliance, Latin America) and Elena Novak (Legal, under privilege) are informed, and the acknowledgement is sent in Portuguese, a week before it is due.
“Routed to Lena Ortiz · acknowledgement sent in Portuguese (Brazil) · case IC-1049 opened.”
SU-2310 is four sentences in Arabic from the market access team in Dubai: a distributor's agent offered a government hospital's procurement officer a paid trip to a conference in Vienna as a “thank you” if the company won the oncology tender, which closes on October 20. Run triage, and it lands on Bribery & corruption, proposed for Lena Ortiz, with Luca Bianchi and Legal informed, third-party file TP-0418 linked and the distributor relationship manager, Gulf, kept out.
“SU-2310 read in 7 s — your decision.”
On SU-2298, the Warsaw cold-room temperature logs, the anonymous reporter answered in Polish: the instruction started about September 1, and the night-shift storekeeper, Tomasz, also saw it. The agents pick out both as facts to add to the case, and draft a short reply in Polish with its English line. Nothing goes until Dana approves and sends it.
“Reporter identity stays in the portal — we never see it.”
The same report, seen by the five people it reaches — what their week looked like, and what it looks like now.
Six specialist agents read, translate and classify, link, guard and score every report and draft the reply; the intake lead decides who owns it.
Reads each new report from the hotline vendor — call transcript, web form, email or manager note — and its attachments, including text in photos and PDFs, and marks anything that looks like a personal-data breach, a product quality concern or an imminent threat.
In one pass, writes the English beside every original sentence and classifies the meaning: who, what, where and when, allegation or question, and the issue types — flagging public officials, product quality concerns and personal data.
Searches the case history, open investigations, the events system and the third-party register for the same people, places or pattern, returns matches above 70% with the evidence, and says what was checked and not linked.
Masks health details and personal data that are not needed, looks up the named person in the HR org chart and keeps their management line — and anyone the reporter asked to exclude — out of the case, and starts the privacy clock and the 1-day product quality clock.
Scores severity from the issue type and the factors present, applies the routing by issue type and the always-inform rules, and proposes the owner and who else to inform, with the reason for each.
Drafts the acknowledgement, open follow-up questions and the 3-month feedback in the reporter's language, with an English line under each, for a person to approve.
Routes each report, approves every reply. The agents propose; a named person decides.
Ask in plain words about a report, a clock or an owner. Every answer points to the sentence it came from.
Is SU-2304 linked to anything we already have?
Yes — two links. The events system holds EV-55102: a Corventa speaker meeting at Vila Aurora on Sep 12 for R$ 18,000 with 14 signed attendees — the same date, hospital and amount. And SU-2271 (June, same district) described “consulting” and meals for staff at another hospital; it closed for lack of information because that reporter never came back. The receipt shows a dinner for 2 on the night of a meeting of 14.
How was the severity scored?
SU-2304 scores 95 of 100 — High. The issue type (bribery & corruption) adds 20; then money to a healthcare professional, a public-hospital pharmacist who decides the formulary, a manager named, a threat to the reporter, a June pattern and a receipt photo. High starts at 60. You can switch any factor off on the triage desk, and change the weights in Settings.
Who is kept out of the case, and why?
For SU-2304 the guard keeps the regional director, Brazil South out of the case: he is in the manager's reporting line, and the reporter asked that he is not told. The investigator never sees the reporter's identity; only intake does, and for SU-2304 nobody does — the reporter is anonymous.
Which clocks run out this week?
Privacy, 72 hours: SU-2308, patient files in a messaging group — Oct 9 21:10, 60 hours left. Acknowledge, 7 days: SU-2305, overtime in Mannheim — Oct 10. 3-month feedback: SU-2251, expense claims in Raleigh — Oct 12, letter drafted. Acknowledge, 7 days: SU-2306, off-label claims in Chicago — Oct 12. Routing a report sends its acknowledgement at once, so clearing the decision queue clears most of these.
13 screens from the working solution, on its sample data. Pick one to see it large.
Routing, severity, clocks and privacy are settings — the agents follow them, and a person always decides.
| Setting | Default | Choose from |
|---|---|---|
| Bribery & corruption goes to | Global investigations · Lena Ortiz | Regional compliance (by country) · Global investigations · HR employee relations · Privacy office · Global quality · Ask Compliance helpdesk |
| HCP inducement goes to | Regional compliance (by country) — High severity goes to Global investigations | The same six owners, per issue type |
| Public official or public hospital | Also inform Legal, who advises under privilege | On · Off |
| Threat or harm to the reporter | Off | On opens a retaliation watch with HR employee relations — no change to the reporter's pay, role or shifts for 6 months without review |
| Severity | High from 60 · Medium from 35 | Each factor adds 0 to +30 points, in steps of 5 |
| Acknowledge the reporter — reminder | 2 days before the 7-day deadline | 2 days before · 1 day before · On the day — the clock itself cannot be switched off |
| Mask health details of people other than the person named | On | On · Off — switching it off is recorded on the audit trail |
| Never store caller numbers or IP addresses | On | Locked — set by the hotline vendor contract |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample hotline data · “target” = the design goal, measured in the live solution · “estimated” = our estimate (the split of days; the 3.1-day total is the sample company's by-hand baseline) · “typical” = published figures (EU Whistleblower Directive 2019/1937 — 7-day acknowledgement and 3-month feedback, Art. 9; reporter confidentiality, Art. 16; data minimisation, Art. 17). People, companies, hospitals, products and reports named on this page are fictional — characters and sample data in the working solution.
It is the step between a speak-up report arriving and an investigator owning it: reading the report, translating it, deciding what kind of concern it is and how serious, checking for related reports and conflicts, and acknowledging the reporter. Whistleblower Hotline Intake & Triage gives that step to six agents and leaves the routing decision with the intake lead.
The translator & classifier writes the English beside every original sentence and classifies the meaning in the same pass, against one issue list for every language. A Portuguese report about bribery lands where an English one would. Questions and replies to reporters are written in their language, with an English line kept for the team.
Each issue type adds a base, and factors found in the report add points: money to a healthcare professional, a public official or public hospital, a manager named, a threat to the reporter, patients or product quality at risk, related reports, exposed personal data, evidence supplied, conduct still going on. Each factor cites its sentence; High starts at 60 and Medium at 35. The weights are settings, and any factor can be switched off on the triage desk.
Yes. The privacy & conflict guard looks up the person named in the HR org chart and keeps their management line, and anyone the reporter asked to exclude, out of the case. The proposed owner is never in that line.
It keeps the clocks: the 7-day acknowledgement and 3-month feedback, plus the 72-hour privacy assessment and the 1-day product quality check. Routing a report sends its drafted acknowledgement, the statutory clocks cannot be switched off, and reminders go to the owner and the intake lead.
Global quality is told within 1 business day so it can check the product, whoever owns the report. In the working solution, a samples report from Toronto says extra samples are kept in reps' cars for weeks in the summer heat; the samples concern went to regional compliance, North America, and Global quality was informed when it was routed.
Yes. The agents propose; the intake lead routes, changes the owner, merges or redirects. Links between reports are proposals a person confirms, and nothing is sent to a reporter until a person approves it.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your Speak Up policy, issue types, routing rules and a sample of past reports — and it goes live once every quality gate has passed. We will walk you through it on your own reports first.
Every speaker program scored on the OIG's red flags, before and after it runs.
1-min demoOpen Payments Recipient ValidationEvery recipient matched to the right NPI and licence, with the evidence
1-min demoThird-Party Due DiligenceEvery third party risk-tiered before the contract is signed, from its real owners.
1-min demoWe'll run Whistleblower Hotline Intake & Triage on a sample of your own past hotline reports.