Make anonymous two-way
A report without a name is only useful if the case team can ask a question and the person can answer. Give each report its own access code, so the person can come back, read replies and add to it without ever giving a name or an email.
Answer quickly, then keep answering
Acknowledge every report straight away and say what happens next. The EU Directive asks for an acknowledgement within seven days and feedback within three months; the POSH Act runs on 90 days. A line where reports disappear teaches people not to use it.
Take the concern in the shape it comes
Not everyone writes easily, or in English. Offer the line in the languages people speak, by voice as well as text, on a phone as well as a computer, and without an account. A voice that can be changed protects people who would be recognised.
Keep the people named out of it
A report about a manager must never reach that manager, or anyone who reports to them. Check for conflicts before a case is assigned, and keep a record of who opened what.
Collect only what you need
Don't ask for an employee ID or a phone number on an anonymous report, and don't keep device details. Every field you add is a reason not to report.
Protect people after the case closes
Retaliation often starts after the case is closed: a changed shift, a missed promotion, a cold shoulder. Check in with the person at intervals after the case closes, and give them a simple way to say something has changed.
Report numbers, never names
Boards and audit committees need to see that the line works: reports in, time to first answer, time to close, outcomes, and patterns by site or type. They don't need names, and a small group in a chart can identify someone, so hide numbers that are too small.
Test it
Make a test report every quarter, in a different language and channel each time, and time the answer. Ask new joiners if they know how to raise a concern.
This guide explains the law in plain words. It isn't legal advice: check your own facts with your lawyer.