The Jakarta Hotline Report

What to investigate. The existence, amount, frequency and authorisation of the monthly payment; the identity and status of the recipient unit; how it was recorded and who approved the caption; who knew, including the general manager, and when; whether other sites in Indonesia or the region have similar arrangements; and whether any benefit was obtained that the company would not otherwise have received.

Resolve before travel. First, privilege. UK legal advice privilege attaches to communications with external lawyers for legal advice, but Indonesian in-house privilege is uncertain, so route the work through Indonesian external counsel and label and restrict documents accordingly; do not assume London privilege protects documents held in Jakarta. Second, data. The 2022 personal data law restricts cross-border transfer, so plan to review employee data locally, minimise collection, pseudonymise where possible, and only export what is necessary under an identified legal basis. Third, labour process: confirm the works council consultation trigger and the accompaniment right with local counsel, so interviews are conducted lawfully the first time. Fourth, proportionality. Imaging every laptop is over-collection; target the HSE manager, the general manager, and the finance staff who booked the entries.

Week one actions. Litigation hold and suspension of auto-deletion; notify the audit committee chair and the group general counsel in writing; preserve the hotline report in its original form; pull the community relations ledger and petty-cash records; and consider interim measures for the general manager, including suspension on full pay, on local advice, if the risk of evidence destruction or interference is real.

Protection. The report is a protected disclosure, so the company must ensure no detriment flows to the reporter. Because the pool is small, the ordinary investigation steps can expose the source: who was asked about the ledger, whose access logs were pulled, and which interview questions reveal what only the reporter would know. Sequence disclosure of information deliberately, and do not attribute facts to the report in interviews where a different plausible source exists.

Communication. The reporter is anonymous, but the hotline and the case-management system should allow anonymous follow-up and should send a holding acknowledgment and an outcome summary that does not identify anyone. If the person identifies themselves later, give them a single named contact, confirm in writing that retaliation is prohibited, and explain how to raise a concern about retaliation.

The general manager. Assume he will hear of the investigation. Do not brief him on scope, do not let him sit in on interviews of his staff, and do not let him control documents. Consider a communications plan for the plant so that the workforce hears something accurate rather than rumour, without disclosing the allegation. Document all of it, because a later unfair-dismissal or detriment claim will turn on what the company did and when.

Works council and accompaniment. Consult as local law and practice require, but share only the minimum necessary; confidentiality of an ongoing investigation is usually a legitimate limit. Allow accompaniment where required, and record who attended. Any interim suspension should be framed as precautionary, not disciplinary, in writing.

First, do not report an allegation. Report facts. Complete a preliminary assessment: what was paid, to whom, by whom, at what level, and for what benefit. Only then does a disclosure decision carry any value, because an incomplete report that later grows is worse than a timely accurate one.

Factors pointing toward disclosure. Payments to a police unit over an extended period, recorded under a false or misleading caption, with knowledge at country general-manager level, are serious. Crestline is a UK plc, so the section 7 failure-to-prevent offence applies to conduct anywhere in the world, and the adequate-procedures defence looks weak where a monthly cash payment sat in the books for a year. There is an Indonesian criminal exposure and the police unit may have its own sanctions or human-rights profile that makes the relationship worse. Voluntary disclosure and cooperation are the recognised routes to a deferred prosecution agreement, a reduced penalty and, for individuals, credit; silence that is later exposed is the aggravating factor.

Factors pointing the other way. If the payments turn out to be small-scale extortion for site access, with no benefit obtained and no senior knowledge, a remediation-first approach with no disclosure may be defensible.

Remediation package. Terminate the arrangement and the individuals responsible; recover funds where possible; redesign the community-relations budget so no cash exists; institute a third-party and official-engagement approval process; strengthen the hotline with local-language access and a visible non-retaliation policy; deliver targeted training to plant management and finance; audit other high-risk sites for similar captions; and report progress to the audit committee quarterly. The disclosure decision, the reasoning and the remediation plan should all be documented and board-approved, because the record is what the authority will assess.