How internal reporting data can strengthen governance and risk oversight

Recent regulatory changes are adding momentum to efforts to strengthen ‘speak-up’ cultures in Japan. Risk leaders are now asking how the resulting data can be used to identify emerging risks and improve oversight, says NAVEX’s Nick Mitsuya Nick Mitsuya, NAVEXFor many organisations, whistleblowing remains something of a compliance necessity: a reporting channel designed to meet regulatory expectations and demonstrate good governance. But internal reporting data has the potential to play a much broader role.As Japan enters a new phase in its approach to protected disclosures following amendments to the country’s Whistleblower Protection Act, organisations have an opportunity to rethink not only how concerns are raised, but how the resulting information is used. The revised legislation, passed in 2025 and scheduled to take effect from December 1, 2026, strengthens safeguards against retaliation and places greater emphasis on the effectiveness of internal reporting arrangements.This reflects a broader trend that has been under way for some time. Worldwide, regulators and financial institutions have sought to encourage stronger speak-up cultures, recognising that concerns raised by employees can provide an early indication of misconduct, control failures and emerging risks. Japan is on that same journey, although building confidence in reporting channels inevitably takes time.These themes were reinforced during a recent discussion with senior risk, compliance and governance professionals at Risk Live Japan 2026. The session was held under the Chatham House Rule and, while we are unable to disclose full details to non-participants, we are pleased to share some of the key learnings. One such key insight was that organisations are only beginning to unlock the strategic value of internal reporting data. Japan’s reporting gapNAVEX benchmarking data shared at the event revealed that Japanese organisations receive significantly fewer internal reports than their counterparts elsewhere in the world.Japan registers about 0.63 reports per 100 employees, while globally it’s around 1.65 per 100.The figures can be interpreted in different ways. Fewer reports do not necessarily mean fewer problems. Equally, they should not be viewed as evidence that Japanese organisations are somehow falling short in their reporting responsibilities.Reporting volumes often reflect the maturity of speak-up cultures, and levels of employee awareness and confidence that concerns will be handled fairly.Many global organisations have spent years encouraging employees to use reporting channels and demonstrating that speaking up leads to positive outcomes. Japan’s recent regulatory developments are likely to provide further momentum to similar efforts, but changing behaviours and building trust is an ongoing process.One point discussed in depth was that awareness itself remains a challenge.Many participants said that their employees still don’t know about the tools and services available to them. Even among professionals working in risk functions, knowledge of whistleblowing protocols and internal reporting mechanisms was sometimes limited. Installing a reporting channel is sometimes treated as ‘job done’, when it should only be the starting point.Beyond complianceAnother common theme was that internal reporting is still too often viewed through a narrow compliance lens, whereas concerns raised by employees can provide valuable signals about emerging issues related to their business long before they become material incidents.Risk teams can sometimes feel compliance is detached from their day-to-day activities. Yet internal reporting can provide an important input into risk management.Reports relating to harassment, inappropriate conduct, conflicts of interest or questionable business practices may reveal wider weaknesses in controls, management oversight or organisational culture. In practice, reporting data can sit alongside more traditional indicators, providing context that formal metrics alone may miss.An interesting talking point raised by the investment community was that governance-related data could also become increasingly valuable to external stakeholders. If reporting data could be aggregated and compared meaningfully across firms, it might offer investors another lens through which to assess governance quality and downside risk.You can encourage reporting … but, unless you can show what changed as a result, it’s hard to get internal buy-inBuilding trustTechnology featured prominently in the conversation, but few participants saw it as the complete solution to the problem.Many organisations have invested in reporting platforms and case management tools. The more difficult task is creating a culture in which employees are encouraged to use them and feel comfortable in doing so.Employees need confidence in the system that concerns will be treated seriously, investigated fairly and handled confidentially. Alongside this, organisations need to demonstrate that speaking up leads to positive outcomes.“You can encourage reporting,” one attendee observed, “but, unless you can show what changed as a result, it’s hard to get internal buy-in.”Some attendees had informed their organisations about actions taken following reports, using intranet communications and updates to reinforce the message that concerns are listened to and acted upon.As one example discussed during the session showed, improving awareness and responsiveness can transform reporting levels. As reporting increases, organisations gain more material from which to learn. Among those reports may be a small number of high-value cases that lead to significant improvements.Turning reports into insightAs reporting programmes mature, the opportunity lies not simply in managing individual cases, but in understanding the patterns that emerge over time.During the discussion, participants explored how internal reporting data could be linked with other risk and control information, including risk and control self-assessments, operational loss events and scenario analysis. Doing so can help organisations identify recurring themes, challenge assumptions and strengthen operational risk assessments.One attendee also noted that certain incidents have direct financial implications. Harassment cases, for example, can result in legal costs, compensation payments and reputational damage. Connecting incident data with financial outcomes can help organisations quantify the consequences of governance failures and communicate them more effectively to senior management.The difficulty, of course, is that reporting systems, compliance processes and op risk frameworks are often managed separately.Fragmented governance, risk and compliance information is hardly a new issue, but bringing these data sources together can add significant value. Organisations can begin identifying emerging patterns, understanding root causes and providing boards with richer management information about governance and culture.Looking aheadJapan’s revised whistleblower regime provides an opportunity to strengthen internal reporting arrangements, but regulation alone will not create a speak-up culture. Leadership, communication and trust remain just as important as technology or policy.Internal reporting is evolving from a mechanism for handling individual complaints into a source of management information that can inform governance and risk oversight. That represents one of the biggest opportunities for risk leaders over the coming years.For financial institutions facing growing operational, conduct and reputational risks, some of the earliest warning signs may already exist within the organisation itself. The challenge is recognising their value – and acting on what they reveal.