Having a policy and a channel is the easy part.
Nearly every mid-sized organization now has a whistleblower policy and a reporting channel, often required by a governance framework or an ISO 37001 anti-bribery certificate. Far fewer have a culture where staff believe reporting is safe, valued and acted on. Most ethics failures happen in that gap.
Close the loop, even when you cannot share details. Someone who reports a concern and hears nothing learns that reporting does not matter. A simple "we received this and are looking into it", followed by a closing note, even a general one, keeps the channel credible.
Make anonymous truly anonymous. If the channel is a shared inbox the ethics committee can trace to an IP address or a badge swipe, staff will find out and trust goes. A channel hosted by a third party solves this for a modest cost.
Lead by example. A code of conduct that leaders visibly ignore teaches staff to treat the whole framework as theatre. When a senior leader is held to the same standard as a junior employee, and people see it, even if the details stay private, that one event does more than a year of training.
Keep the investigation away from the reporter's manager. An employee reporting a concern about their own manager needs to know that manager will not decide what happens next.
Certifications such as ISO 37001 and frameworks from bodies like Nazaha give the structure. Structure without psychological safety produces a policy nobody uses. The organizations hurt by ethics failures are usually the ones that had the right policy on paper all along.