Your internal reporting channels must be designed to protect the confidentiality of the whistleblower’s identity. Only authorized personnel should have access to the report and the whistleblower’s identity should not be revealed unless the whistleblower gives explicit consent.