Free template · Updated May 2026

Case Handler Training Curriculum

A 16-hour initial training curriculum covering the legal framework, operational procedure, trauma-informed practice, platform tooling, and live exercises. With an 8-hour annual refresher and topic-specific modules. Adaptable to in-person or virtual delivery.

Module 1: Legal framework (3 hours)

Trainer: external counsel or in-house General Counsel.

• EU Directive 2019/1937: structure, scope, the three-tier model.
• National transposition in force in [jurisdiction]: HinSchG / Loi Sapin 2 / D.Lgs. 24/2023 / Ley 2/2023 / Wbk.
• Article 16 confidentiality: scope, exceptions, sanctions for breach.
• Article 19 retaliation and Article 21(5) reverse burden of proof.
• GDPR overlay: Articles 5, 6, 9, 17, 30, 32, 35 in the whistleblower context.
• Article 22(1) rights of the subject; tension management with Article 16.
• Case-law walk-through: 3 leading decisions per applicable jurisdiction.

Module 2: The reporting channel and intake (2 hours)

Trainer: Head of Compliance.

• [Organisation]'s channel architecture, URL, and accessibility.
• Reporter UX: case codes, anonymity, contextual-identification risk.
• Intake routes: web, voicemail/phone, in-person; the Oral Intake Script.
• Receipt and triage decision; classification taxonomy.
• Acknowledgement message: the 7-day clock, the human-action component, the message template.

Module 3: Conflicts and escalation (1 hour)

Trainer: Head of Compliance + Audit Committee Chair (briefly).

• Conflict-of-interest check at intake.
• Named alternate handler; recusal procedure.
• Escalation paths: alternate, Audit Committee Chair, external ombudsperson.
• Documenting recusal in the audit log.

Module 4: Investigation planning (2 hours)

Trainer: in-house counsel or external investigator.

• The 12-step Investigation Protocol.
• Investigation plan structure; the privilege assessment.
• Evidence preservation: scope, legal hold issuance, hashes, chain of custody.
• Timeline anchored to the 3-month feedback deadline.
• Decision-rights matrix.

Module 5: Interviews (3 hours, including practice)

Trainer: external investigator or trauma-informed-practice specialist.

• The Interview Protocol.
• Free narrative versus specific questioning.
• Upjohn warnings and confidentiality scope for in-counsel-led interviews.
• Trauma-informed practice for harassment, assault, coercion cases.
• Subject interview: Article 22(1) operationalised.
• Documentation: contemporaneous notes, memorandum within 48 hours, interviewee verification.
• Practical exercise: two role-play interviews (witness and subject), with peer feedback.

Module 6: Findings, closure, and feedback (2 hours)

Trainer: Head of Compliance + General Counsel.

• Findings memorandum structure; standard of proof.
• Closure panel: composition, decision rights, recordkeeping.
• Closure memorandum template.
• Substantive feedback: message variants, extension procedure.
• Remedial action: HR, policy, training, system, external referral.

Module 7: Data protection and AI (2 hours)

Trainer: DPO.

• DPIA walkthrough using the DPIA template.
• RoPA entry: the RoPA template.
• Retention rules: the Retention Schedule.
• Right to erasure versus Article 18: handling the conflict.
• AI features: governance under the EU AI Act, when AI is high-risk, the role of human oversight.

Module 8: The platform (1 hour)

Trainer: Head of Compliance.

• Confidly admin walkthrough: cases, audit log, role-based access.
• Case timeline: deadlines, attachments, messages, audit entries.
• Reporter view: how the reporter sees the case channel.
• Export and reporting: CSRD / board / regulator extracts.

Closing assessment (30 minutes)

• 10-question knowledge check on legal framework and procedure.
• Sign-off by the trainer; record in the LMS.
• Initial training valid for 12 months; refresher required to maintain authorisation to handle cases.

Annual refresher (8 hours)

• Updates on national law and DPA / authority guidance (2 hours).
• Case-law update (1 hour).
• Post-mortem review of cases handled in the past year (2 hours).
• Interview practice with new scenarios (2 hours).
• Platform updates and new features (1 hour).

Topic-specific modules (as required)

• Cross-border investigation: 4 hours.
• ABC / FCPA / UK Bribery Act cases: 4 hours.
• Sexual harassment and trauma-informed practice (extended): 6 hours.
• Forensic accounting essentials: 4 hours.
• AI governance refresher: 2 hours.

Owner: Head of Compliance. Reviewed annually. Delivery records in the LMS.