Photo by Oleg Laptev on Unsplash
Auditors cannot see everything. On a campus with dozens of units, thousands of transactions, and many research projects, most irregularities are found only because someone dared to report them. A safe reporting channel that is followed up is therefore not an add-on but part of the control system.
This article covers the legal basis for whistleblowing systems (whistleblowing system, WBS) in universities, the division of channels for different types of reports, design elements, and the role of the SPI. References were checked as of October 21, 2026.
Why Do Campuses Need a Violation Reporting System?
Findings summary ACFE Report to the Nations 2024 states that about 43 percent of occupational fraud cases are first detected through a tip or information from others, more than any other method. This figure comes from global data, not from universities in Indonesia, so it is only used as an indication that insider reports are an important source of detection.
For the SPI, such reports are also input for planning: units or processes that are repeatedly mentioned in reports deserve a place in risk assessment. The annual plan is discussed in the article University SPI annual audit plan (PKPT). Examples of audits of areas that are often reported are in the articles procurement audit, research grant fund audit, and SIAKAD security audit.
What Is the Legal Basis for a WBS in Universities?
| Reference | Relevant content |
|---|---|
| Presidential Regulation 16/2018 Articles 76 and 77 | Procurement oversight through APIP can take the form of audits, reviews, monitoring, evaluation, and/or running a whistleblowing system. Public complaints are submitted to APIP with factual, credible, and authentic evidence. |
| Ministerial Regulation 39/2025 Article 34 paragraph (2) letter d | Oversight and control of education activities include receiving, documenting, processing, and resolving complaints, reports, or grievances about alleged violations of academic ethics, university regulations, and laws and regulations |
| Ministerial Regulation 55/2024 | Prevention and handling of violence in universities, including forming a task force positioned under a vice head of the university (Article 23) |
| Law 31/2014 Article 10 | Witnesses, victims, cooperating witnesses, and/or whistleblowers cannot be prosecuted, criminally or civilly, for their testimony or reports, unless given not in good faith |
| Rector or campus leadership regulation | Details of the policy, channels, and managing unit at each campus |
In the sources I reviewed, I found no ministerial regulation that specifically governs a WBS for all universities. Campuses generally set their own. For example, UGM Rector's Circular Number 15406/UN1.P/PA.02.00/2024 states that the UGM WBS is based on Rector's Regulation Number 29 of 2024 and managed centrally, with guaranteed confidentiality of identity and an anonymous reporting feature (text of the circular).
Note that Law 31/2014 defines a whistleblower as a person who gives a report or information to law enforcement about a criminal act. That legal protection therefore does not automatically cover someone who reports only through a campus's internal channel. Protection against retaliation at the campus level needs to be written into policy.
Which Reports Go to Which Channel?
A common design mistake is putting every type of report into one box. Different types of reports need different handling, expertise, and protection. The table below is an example of a division, not a standard rule:
| Type of report | Example of | Handling channel |
|---|---|---|
| Fraud, corruption, and abuse of authority | Procurement mark-ups, fictitious research fund reports, gratuities, conflicts of interest | Campus WBS, reviewed by a unit independent of the person reported, for example the SPI, the audit committee, or a special team |
| Violence on campus | Sexual violence, bullying, physical violence | A task force for preventing and handling violence under Ministerial Regulation 55/2024 |
| Academic ethics violations | Plagiarism, manipulation of research data | Academic ethics mechanism and academic sanctions on campus |
| Service complaints | Administrative services, facilities | General complaint service |
The division above may differ between campuses. The UGM circular, for example, includes harassment in the scope of its WBS. What matters is that each type of report has a clear channel, and a report that arrives in the wrong channel is forwarded without revealing the whistleblower's identity.
What Are the Design Elements of a Good WBS?
- Written policy. Sets the purpose, scope, types of reports, rights and obligations of whistleblowers, and who is responsible. Ideally established through a rector or leadership regulation.
- Varied channels. An application, a dedicated email, a phone line, and face-to-face reporting, with an anonymous option.
- Independent recipients. Reports must not be received or reviewed by the person reported or their direct superior.
- Confidentiality and a ban on retaliation. The whistleblower's identity is protected, and actions that harm a whistleblower because of their report are prohibited and sanctioned.
- Initial screening. Assess the completeness of evidence, the type of report, and the level of risk to determine the channel and priority.
- Review and investigation. With procedures, time limits, and tidy recording of evidence.
- Follow-up and feedback. Decisions are carried out, and the whistleblower is told of progress to the extent permitted.
- Reporting. A summary of the number, types, and status of reports is submitted regularly to leadership and the oversight body.
The international guideline for this kind of design is ISO 37002:2021 on whistleblowing management systems. It is a guideline, not an obligation for campuses, and can be used as a benchmark.
What Does the Report Handling Flow Look Like?
- Receipt. The report is recorded, given a number, and the whistleblower receives confirmation.
- Screening. Determine the type of report and its channel, and whether the reviewer has a conflict of interest.
- Initial review. Assess whether there is a sufficiently reasonable allegation to review further.
- Review or investigation. Collect evidence, take statements, and prepare conclusions.
- Decision. Leadership or the authorized body determines the action, including control improvements and sanctions.
- Monitoring and closure. Follow-up is monitored until completion, then the report is closed and archived.
What Is the SPI's Role in a WBS?
The SPI's role varies by campus, so it should be written clearly in the WBS policy and the SPI charter. Some common forms:
- Report reviewer. The SPI reviews reports about finances, assets, and procurement because it has the access and expertise. If the SPI is the first recipient, it needs a mechanism for reports that concern the SPI itself.
- Information user. Patterns in incoming reports feed risk assessment and the preparation of the annual plan.
- System tester. The SPI assesses whether the WBS is designed and runs according to policy: confidentiality is kept, reports are followed up, and deadlines are met.
GIAS Standard 9.4 asks the audit plan to consider fraud risk, and technical discussions of fraud examination are in the articles fraud investigation, forensic audit, and fraud triangle. In-depth investigation of alleged criminal acts often involves other parties, including law enforcement, so the SPI needs to set the limits of its authority. Coordination with the audit committee, inspectorate, and external examiners is discussed in the article SPI coordination with the audit committee, board of trustees, inspectorate, and BPK.
How Do You Measure the Success of a WBS?
Some indicators that can be monitored include the number of reports, types of reports, time from receipt to initial screening, the percentage of reports processed within the time limit, and the percentage of follow-ups completed. Be careful interpreting the numbers: few reports do not automatically mean the campus is clean, as it can also mean the system is not yet trusted or known. Awareness and trust surveys of the academic community help complete the picture.
What Are Common Mistakes in Running a WBS on Campus?
- All reports go into one box. Service complaints, violence, and fraud get mixed so none is handled properly.
- Recipients are not independent. Reports land with the person reported.
- Identity leaks. Access to report data is not restricted.
- No feedback. Whistleblowers do not know their report is being processed, so trust falls.
- Only a formality. The application exists, but it is not publicized and there is no sanction for retaliation.
How Does Internal Audit Software Help?
Audithink is not a WBS platform and does not receive reports from the public or the academic community. For the SPI, Audithink helps follow up on review results through six main features: risk assessment, audit planning based on risk assessment, work program templates, deadline notifications, monitoring of recommendation follow-ups, and automated reports. Campus audit needs are discussed on the page Audithink for Educational Institutions.
FAQ About Whistleblowing Systems in Universities
Are universities required to have a whistleblowing system?
In the sources I reviewed, no ministerial regulation specifically requires a WBS for all universities. However, Article 34 paragraph (2) letter d of Ministerial Regulation 39/2025 covers the handling of reports and complaints about alleged violations, and Ministerial Regulation 55/2024 requires a task force to handle violence. WBS policy is usually set in a rector or leadership regulation.
What is the difference between a WBS and the PPKPT task force?
The PPKPT task force handles violence on campus under Ministerial Regulation 55/2024. A WBS handles alleged fraud, corruption, abuse of authority, and other violations under campus policy. The two channels should be kept separate and forward reports to each other.
Are whistleblowers protected by law?
Article 10 of Law 31/2014 states that a whistleblower cannot be prosecuted for their report unless it was not made in good faith. The law defines a whistleblower as a person who reports to law enforcement, so protection at the campus level needs to be set in the campus's own policy.
Who should receive WBS reports?
A party independent of the person reported, for example the SPI, the audit committee, or a special team appointed by leadership. A mechanism is needed for reports that concern the recipient itself.
Should a WBS accept anonymous reports?
There is no standard rule in the sources I reviewed. Some campuses, such as UGM, provide an anonymous feature to protect identity. Anonymous reports still need initial evidence so they can be reviewed.
What is the SPI's role if a report concerns procurement?
Article 76 of Presidential Regulation 16/2018 names a WBS as one form of procurement oversight. The SPI can review the report, feed it into risk assessment, and audit the related process within its authority.
Conclusion
A good reporting system is measured not by the number of reports but by trust: whistleblowers feel safe, recipients are independent, and every report leads to a decision and improvement. The SPI can help by making sure its role is clear and that report results feed into risk assessment.
If the SPI at your campus wants to follow up review results with tidy plans, work programs, and monitoring, schedule an Audithink demo.
