Connect Support Advance

White paper

Whistleblowing
Programs
Updated 2020

Level 7, 133 Castlereagh Street, Sydney NSW 2000 | PO Box A2311, Sydney South NSW 1235
T +61 2 9267 9155 F +61 2 9264 9240 E [email protected] www.iia.org.au
 Whistleblowing Programs

Contents Risk management includes effectively managing misconduct,

some of which may be reported if the person doing so can be
Background 2
offered safe and secure means of reporting misconduct.
- Purpose 2
Organisations wishing to maintain a trusted reputation in
- Background 2 accordance with good practice and comply with the law
- Changes to the Law 2 relating to whistleblowing should consider a whistleblowing
program as part of their overall governance and risk
Discussion 2
management environment.
- Issue 2
So, how does an organisation establish a whistleblowing
- Benefits 3 program?
- Public Sector Legislation 3
Changes to the Law
- Corporate Whistleblowing Legislation 4
Historically there have been numerous incidents of
- ASIC Regulatory Guide 270 4 whistleblowers being treated poorly and suffering
- Roles and Responsibilities 5 victimisation, harassment and detrimental conduct in Australia
Conclusion 7 and internationally. In the last decade an increasing number
of whistleblowers have gained national and international
- Summary 7 media publicity which has created a desire by the community,
- Conclusion 7 regulators and lawmakers for the system of protection
to change. Whistleblowers from the #metoo movement,
Bibliography and References 8 WikiLeaks and technology data, sexual abuse in schools and
- Purpose of White Papers 8 churches, the elder care industry and the financial planning
- Author’s Biography 8 industry and subsequent Royal Commissions, in addition
to many other examples have helped change community,
About the Institute of Internal Auditors–Australia 9 regulators and lawmakers attitudes in Australia.
Copyright 9 New and significantly tougher whistleblowing laws for
Disclaimer 9 corporations in Australia officially came into effect on 1
July 2019 under the Treasury Laws Amendment (Enhancing
Background Whistleblower Protections) Bill 2019 (Cth) (Whistleblower Bill).
This Bill dramatically increased protections for whistleblowers
Purpose and increased the individual and organisational penalties for
not doing so, in the Corporations Act (2011) (Corporations Act).
The purpose of this white paper is to provide information and
guidance on how to effectively implement a whistleblowing Discussion
program which complies with the significant new legal and
regulatory changes in this area. Issue
Many organisations have a whistleblowing program in The issue to be discussed is:
place. There are many more organisations considering a
How can an organisation implement an effective
whistleblowing program which are keen to understand the
whistleblowing program?
implications, resources required, and cost to implement and
maintain. A whistleblowing program is a practical and invaluable tool for
managing disclosures in the workplace and is something that
How can an organisation implement and resource a
can be utilised by all organisations.
cost-effective whistleblowing program that is compliant with
the new legislative changes? Effectiveness of a whistleblowing program depends on
capturing necessary components that will ensure the quality
Background of the program.
Every organisation is exposed to risk and it is important for However, one size does not fit all organisations. This white
organisations to consider how best to address risk to protect paper aims to explain how whistleblowing can be useful to an
employees, clients and the organisation itself from costly and
organisation.
damaging exposure.

© 2020 - The Institute of Internal Auditors - Australia 2

 Whistleblowing Programs

Benefits whistleblowing program can provide a secure and safe

method to report misconduct, and to the whistleblower the
Despite its growth internationally, whistleblowing has been
option of making a disclosure via an independent channel
poorly understood and, at times, subjected to bad publicity
while remaining anonymous.
in Australia because people have suffered as a result of
whistleblowing. It is fast becoming an essential tool for A whistleblowing program should be managed by a selected
organisations to tackle misconduct. group of ‘Officers’ holding executive leadership positions,
with the senior executives or board of directors responsible
Benefits for organisations include:
for assuming ownership under the scrutiny and control of
› Complying with legal obligations in the Corporations reporting and audits
Act and Australian Securities and Investments
The program should be subject to periodic independent
Commission (ASIC) Regulatory Guide (RG) 270 relating to
reviews and audits.
whistleblowing which now carry very significant fines for
non-compliance including individual fines up to $1million, There are many facets to consider in designing a good
jail sentences up to 2 years and organisational fines up to practice whistleblowing program that assures the unique
$525 million. needs of an organisation are met.
› Enhancing the ability to identify systematic and recurring Public Sector Legislation
problems.
Historically whistleblowing legislation in Australia has focused
› Significant costs savings by offering early detection of on the public sector with the Federal and State Governments
potential or actual wrongdoing. enacting their respective disclosure legislation which are set
› Allowing effective management of disclosures, reducing out below.
misconduct and avoiding employees going public or to › Whistleblowers Protection Act 1993, South Australia
external regulators.
› Public Interest Disclosures Act 1994, New South Wales
› Presenting a further, and perhaps a final opportunity
to intervene in wrongdoing which may otherwise go › Whistleblowers Protection Act 1994, Queensland
undetected – whistleblowing can still work when › Public Interest Disclosures Act 2002, Tasmania
regulatory monitoring and good governance fails.
› Public Interest Disclosure Act 2003, Western Australia
› Promoting confidence and trust in organisational
leadership when they are prepared to go on record for › Public Interest Disclosure Act 2008, Northern Territory
encouraging disclosures. › Public Interest Disclosure Act 2012, Australian Capital
› Fostering organisational stability and productivity and Territory
reducing possibility of reputational damage, litigation, › Protected Disclosure Act 2012, Victoria
prosecutions and financial impact by acting on
information provided by whistleblowers. › Public Interest Disclosure Act 2013, Commonwealth

› Empowering employees by giving them a path to disclose The various state and commonwealth acts make a serious
wrongdoing. attempt to address integrity and accountability in the public
sector in their respective jurisdictions, with the primary
› Protecting and enhancing an organisation’s reputation objective being the provision of safe means to make
which can be irrevocably damaged by a whistleblowing disclosures and protect whistleblowers. However, they are not
issue covered by the media. without their shortcomings. Critics note that:
› Positively impacting on organisation culture – › Reportable wrongdoing is ill-defined and differs between
whistleblowing calls out poor culture and practices and jurisdictions.
offers an improvement opportunity.
› Anonymous complaints are not always protected.
Whistleblowing can also help meet an organisation’s
workplace safety and legal obligations to employees. Left › It is not clear who will be protected and how.
unchecked, misconduct or wrongdoing may in some cases › Obligations on organisations differs and is unclear.
compromise and endanger wellbeing of employees.
› Absence of an oversight agency responsible for
Most people want misconduct exposed and addressed, but whistleblower protection.
not everyone feels safe reporting it. Most people will only
do so if they can feel safe from reprisals. A well-constructed

© 2020 - The Institute of Internal Auditors - Australia 3

 Whistleblowing Programs

Corporate Whistleblowing Legislation › Who can make and receive a disclosure.

The ‘Treasury Laws Amendment (Enhancing Whistleblower › How to make a disclosure.
Protections) Bill 2017’ was passed in 2019. The Bill amended
› Legal and practical protections for disclosers.
the Corporations Act and came into effect on 1 July 2019.
The new protections set a standard for whistleblower › Investigating a disclosure.
protection going forward for all corporations in Australia. The
› Ensuring fair treatment of individuals mentioned in a
Corporations Act now requires that all public companies, large
disclosure.
proprietary companies, and proprietary companies that are
trustees of registrable superannuation entities must have a ‘Robust and transparent whistleblower policies are essential to
whistleblower policy available to their officers and employees achieving sound risk management and corporate governance,’
by 1 January 2020. Among other things, requirements in the said ASIC Commissioner John Price in November 2019.
Corporations Act: ‘Whistleblower policies will influence behaviour and corporate
culture in positive ways – for example, by encouraging greater
› Enlarge the range of whistleblowers going so far as to
disclosures of wrongdoing and by deterring people from doing
include a spouse or relative of any individual defined as
the wrong thing. They play a crucial role in achieving a more
an eligible whistleblower.
fair and accountable corporate environment.’
› Allows whistleblowers to remain anonymous.
RG 270 also provides good practice guidance to assist
› Makes breaching the confidentiality of a whistleblower’s companies develop and implement policies that are tailored to
identity an offence. their operations. Some of the key recommendations outlined
in RG 270 include the following:
› Offers improved remedies to those who suffer damage
due to victimisation. a. Requirement to foster a whistleblowing culture
› Sets out tough penalties for individuals and organisations Under RG270.140 to RG270.143, ASIC says: “It is important for
for non-compliance. an entity to create a positive and open environment where
employees feel they can come forward to make a disclosure.
The protections are aimed at encouraging and making
A positive and open environment may also help eliminate
whistleblowing an acceptable and effective tool in tackling
the negative connotations associated with whistleblowing.
wrongdoing and creating a more uniform whistleblowing
An entity’s senior leadership team plays an important role in
protection framework.
demonstrating the entity’s commitment to its whistleblower
The law defines disclosable conduct in broad terms. policy. They can demonstrate their commitment in practice by
ensuring:
Among other things it includes ‘misconduct, or improper state
of affairs or circumstances relating to the company’. i. disclosures are taken seriously and acted on immediately;
This definition was made deliberately broad so as to capture ii. wrongdoing is addressed promptly;
conduct that doesn’t necessarily break any laws but may be
iii. disclosers are provided with adequate protections and
viewed as unethical. The CommInsure scandal, which found
support; and
the Commonwealth Bank had not engaged in illegal conduct
but had nonetheless engaged in unethical conduct that iv. early interventions are made to protect disclosers from
harmed consumers, was given as an example as the type of detriment.
conduct intended to be caught.
An effective whistleblowing program needs to be built
Specific types of disclosable conduct which are of particular around an organisation’s culture, work environment, unique
concern to an organisation and which are based on their characteristics and needs. Legal requirements and standards
business operations and practices, may be captured and governing whistleblowing must also be met. A commitment
stated by an organisation in their whistleblower policy. from the senior executives or the board of directors is essential
to win trust and commitment for a whistleblowing program.
ASIC Regulatory Guide 270
b. Roles and responsibilities under a policy
ASIC released its detailed and prescriptive Regulatory Guide
270 Whistleblower Policies (RG 270) in November 2019 which Under RG 270.144 ASIC says “It is good practice for an entity to
is used by ASIC when auditing compliance. allocate key roles and responsibilities under its whistleblower
policy. An entity could create new roles. Alternatively, the
RG 270 sets out the components a whistleblower policy must responsibilities could be integrated into existing roles. Staff
include to comply with the law. These include: members may hold more than one role, provided that this does
› Types of matters covered by a policy. not result in conflicts of interest. For example, it is important
© 2020 - The Institute of Internal Auditors - Australia 4
 Whistleblowing Programs

for an entity to enable its whistleblower protection officer and In addition to the release of RG 270, ASIC granted relief to
whistleblower investigation officer (or equivalent), to exercise public companies that are not‑for‑profits or charities with
independent judgement and have a mechanism through which annual revenue of less than $1 million from the requirement
they can escalate problems directly to the entity’s board.” to have a whistleblower policy. All companies are however
bound by the whistleblower protections in the Corporations
c. Upfront and ongoing education and training
Act from 1 July 2019, regardless of whether they are required
ASIC Good practice tip 15 says “Demonstrate the entity’s to have a whistleblower policy.
commitment to the policy by promoting it actively and
regularly. We encourage an entity’s management to actively Roles and Responsibilities
and regularly promote the entity’s whistleblower policy. This Role of internal auditors
may help demonstrate the entity’s commitment to protect and
support disclosers, and to identify and address wrongdoing Internal auditors are now ‘eligible recipients’ under the
promptly.” Under RG 270.131 ASIC says “An entity should Corporations Act and whistleblowers may disclose a
conduct upfront and ongoing education and training regarding whistleblower matter to an internal auditor or external auditor,
its whistleblower policy, processes and procedures. The including a member of an audit team conducting an audit. As
training should be provided to every employee.” a result, internal auditors need to understand their obligations
when receiving a whistleblowing disclosure to ensure they do
ASIC also outlines specific topics that should be covered in not breach personal or corporate obligations.
training for all staff, and those with specific roles under the
whistleblower policy. Internal auditors have two clear roles they can play. One is
optional and the other is not.
d. Ensuring the privacy and security of personal information
One imposes a legal obligation to receive disclosures made
Under RG 270.147 ASIC says “It is good practice for an entity to them under the law. This role is not optional. Auditors must,
to have appropriate information technology resources and in the first instance, receive a disclosure if it is made to them
organisational measures for securing the personal information while performing an audit for a client, whether it be made
they receive, handle and record as part of their whistleblower openly or anonymously.
policy. Due to the sensitivity of the information, any leaks
or unauthorised disclosure (including from malicious cyber The reason is simple; the law appoints auditors as eligible
activity) may have adverse consequences for the disclosers, recipients or persons to whom a disclosure may be made. The
the individuals who are the subject of disclosures and the law does not require auditors to carry out a role beyond that
entity. It is important for the entity to consult the Australian unless they wish or are required by the organisation to do
Privacy Principles and other relevant industry, government and so. They merely have to ensure the disclosure made to and
technology-specific standards, guidance and frameworks on received by them is forwarded to a person legally authorised
data security to help safeguard their information.” to deal with the disclosure in accordance with the legislation.
Auditors must however receive the whistlelbower’s consent
e. Monitoring and reporting effectiveness of the policy to forward on a report to the next appropriate person at the
Under RG 270.150 ASIC says “It is important for an entity to organisation. If the auditor does not receive consent from the
have mechanisms in place for monitoring the effectiveness of whistleblower they may face criminal and civil penalties.
its whistleblower policy and ensuring compliance with its legal To comply with this and any other extended obligation
obligations. It is good practice for an entity to provide periodic imposed on them, auditors need to receive a sufficient level of
reports to the entity’s board or the audit or risk committee. training.
An entity could also monitor and measure its employees’
understanding of the entity’s whistleblower policy, processes Another role which auditors are best placed to deliver is that
and procedures on a periodic basis. This may help the entity of ‘auditing’ the organisation’s whistleblowing framework to
to determine where there are gaps in their employees’ check for and ensure compliance with the law.
understanding. It may also help the entity to enhance and This role is optional. Miss this opportunity and the organisation
improve its ongoing education, training and communication misses the benefit of the sharp mind of auditors attuned to
about the policy.” compliance.
f. Reviewing and updating the policy The law is more than substantially prescriptive. Hefty
Under RG 270.158 ASIC says “It is good practice for an entity penalties, including jail, may follow non-compliance with this
to review its whistleblower policy, processes and procedures new and technical whistleblowing framework. An audit (the
on a periodic basis (e.g. every two years). It is also good new law calls it a review) of past disclosures offers assurance
practice to rectify any issues identified in the review in a timely of compliance, an opportunity to detect breaches, and for the
manner.” audit to make recommendations for improvement.

© 2020 - The Institute of Internal Auditors - Australia 5

 Whistleblowing Programs

An audit should examine procedures concerning such as: › Making an immediate assessment of the welfare and
protection needs of a whistleblower
› Receipt of disclosures.
› Remaining alert to any intimidation or detrimental acts of
› Acknowledging and recording disclosures.
omissions and taking appropriate action if need be
› Secure storage of information and communications.
› Informing the whistleblower how the organisation will
› Confidential and private communications. deal with intimidation, victimisation or detrimental action.
› Authorisation and accessibility of information. Among other things a whistleblower protection officer needs
to be:
› Legal processes carried out within required timeframe.
› Trustworthy.
Who more capable than an auditor to monitor and assure
effectiveness of an organisation’s whistleblower policy and › Impartial (independent from the allegations raised in the
framework for legal compliance. whistleblower’s report).
Internal auditors also have a role in supporting a successful › Capable of building rapport and confidence with others.
whistleblowing program, including:
› Discreet.
› Providing independent and objective monitoring and
› Capable of addressing concerns or reports of intimidation
testing.
or victimisation.
› Providing assurance to the board of directors and
A whistleblower protection officer should be given direct
management the program meets good practice.
access to human resources and legal advisors. Where
› Conducting risk assessments. necessary in serious matters, they should have direct access
to the audit committee, chief executive officer or other senior
› Establishing internal controls to mitigate risks.
executive.
› Triaging significant issues with the benefit of their
Role of investigator
thoughts and suggestions.
Disclosures that qualify for protection are usually investigated
› In some cases, receiving disclosures.
to determine whether the disclosure is proven or not, and
› Liaising with the risk management team. accordingly decide an appropriate response.
› Understanding and interpreting misconduct trends. An investigation should be carried out by an investigator
appointed under the whistleblower policy and in the manner
› Providing regular reports to the board of directors.
set out in the policy; by law the policy must outline key steps
Role of whistleblower protection officer of the investigation process.
Whistleblowers often need support and protection in what can To be sure, the investigator should, in the first instance, satisfy
be a traumatic and confronting experience. themselves the ‘disclosure’ qualifies as a protected disclosure
as a pre-requisite to the investigation.
A whistleblower protection officer is appointed by an
organisation for that purpose; to support and protect a In accordance with good practice tips provided by ASIC, an
whistleblower, if necessary, from detrimental action. A person investigation should focus on the substance, rather than the
from within or external to the organisation may be appointed. motive, of disclosures and ensure the investigation follows
good practice and good governance. The investigator must
This role should enlighten the whistleblower of critical ensure confidentiality requirements under the Corporations
information contained in the organisation whistleblower policy Act are met during the investigation or they may face criminal
about the protections available to them, including protections and civil penalties.
under the Corporations Act.
The organisation should provide an avenue for review of the
They play a critical role in: investigation should a party to the disclosure challenge the
› Making the whistleblower aware of support and findings.
protection available including identity protection Role of employees
(anonymity and confidentiality) if they have asked to
remain anonymous. Employees are key players in a whistleblowing program, with
a key role to:
› Fostering a supportive work environment.
› Keep on the alert for misconduct.

© 2020 - The Institute of Internal Auditors - Australia 6

 Whistleblowing Programs

› Report known or suspected misconduct. Conclusion

› Be an active bystander and do not let bad behaviour go Summary
unreported. Providing a way for people to disclose misconduct is a positive
› Support whistleblowers. incentive to those who want to do the right thing. It can also be
a strong deterrent for potential wrongdoers.
› Avoid doing anything which could be seen as intimidation
or victimisation. Establishing a whistleblowing program can send a powerful
message demonstrating an organisation’s commitment
› Keep confidential the identity of anyone they know or to ethical behaviour and in compliance with relevant law.
suspect of having made a disclosure. Observing and maintaining the program is confirmation of
Role of external and anonymous reporting providers an organisation’s determination to conduct its business with
integrity and respect.
It is appropriate to encourage employees to use internal
whistleblower processes in the first instance because it:
Conclusion
› Promotes and strengthens efficient use of organisation There are many facets to a whistleblowing program which are
resources. of equal value and importance.
› Encourages ownership and early resolution of issues.
Ignoring or compromising components of a whistleblowing
› Can avoid adverse publicity. program may compromise the program. Periodic review
and audit is important to assure effectiveness, integrity and
› Builds confidence and trust in the organisation and the
reliability of a whistleblowing program is maintained.
whistleblowing process.
However, provision should also be made for anyone who does
not feel comfortable or safe in making a disclosure openly
and to do so using an optional process which allows the
whistleblower to remain anonymous and feel safe.
Providing an alternative channel sends a positive message to
potential whistleblowers their disclosure is valued and they
should not be deterred by barriers such as fear of retaliation.
The integrity and viability of a whistleblowing program will be
strengthened if an alternative avenue for making disclosures
is available.
Elements of a good practice external whistleblowing service
includes:
› True independence.
› Confidentiality.
› Impartiality.
› Security.
› Whistleblower-focused.
› Modern reporting tools.
› Expert team to manage whistleblower disclosures.

© 2020 - The Institute of Internal Auditors - Australia 7

 Whistleblowing Programs

Bibliography and References Author’s Biography

https://www.whistleblowing.com.au/#download-checklist Written by:

http://www.whistlingwhiletheywork.edu.au Dominic Lallo
https://www.aph.gov.au/Parliamentary_Business/Bills_ BJuris LLB
LEGislation/Bills_Search_Results/Result?bId=s1120 Dominic is Senior Legal Counsel at LS Partners Workplace
https://asic.gov.au/about-asic/asic-investigations-and- Behaviour Consulting Services which specialises in workplace
enforcement/whistleblowing/guidance-for-whistleblowers/ behaviour matters. He is a lawyer with over 30 years of
https://www.ombo.nsw.gov.au/complaints/Complaint-handling- experience. Dominic has practiced extensively in workplace
resources behaviour including bullying, harassment, sexual harassment,
https://www.iia.org.uk/resources/ethics-values-and- workplace violence, victimisation, discrimination and the
culture/whistleblowing/position-paper-internal-audit-and- impact of such behaviours on employers. He has worked
whistleblowing/ for major insurers, private and government organisations,
defendant and plaintiff legal firms. He is considered an expert
https://global.theiia.org/knowledge/Public%20Documents/TaT- in developing proactive approaches in the management and
Sept-Oct-2015.pdf prevention of inappropriate behaviour.
https://www.iia.nl/SiteFiles/Nieuws/Whistleblowing_Not_
Childs_Play_For_Internal_Auditors_2014-05-19.pdf Nathan Luker

http://www.whistlingwhiletheywork.edu.au/wp-content/ Nathan is General Manager of Your Call Whistleblowing

uploads/2020/01/Clean-as-a-whistle-Key-findings-and-actions- Solutions and has assisted numerous leaders to establish
WWTW2-December-2019.pdf modern external whistleblowing programs at their
https://asic.gov.au/regulatory-resources/find-a-document/ organisations. Clients include federal and state government
regulatory-guides/rg-270-whistleblower-policies/ agencies, not-for-profit organisations, education providers and
multinational corporations.
This White Paper was edited by:
Purpose of White Papers
Andrew Cox
A White Paper is a report authored and peer reviewed by
MBA, MEC, GradDipSc, GradCertPA, DipBusAdmin,
experienced practitioners to provide guidance on a particular
DipPubAdmin, AssDipAcctg, CertSQM, PFIIA, CIA, CISA, CFE,
subject related to governance, risk management or control. It
CGAP, CSQA, MACS Snr, MRMIA
seeks to inform readers about an issue and present ideas and
options on how it might be managed. It does not necessarily Stephen Horne
represent the position or philosophy of the Institute of Internal BBus, GradCertMgtComm, GradCertFraudControl,
Auditors–Global and the Institute of Internal Auditors– CertPublicAdmin, PFIIA, FGIA, CIA, GAICD, CGAP, CRMA,
Australia. MIPAA
Sally McDow
LLB, MBa, GAICD

© 2020 - The Institute of Internal Auditors - Australia 8

 Whistleblowing Programs

About the Institute of Internal Auditors–Australia Copyright

The Institute of Internal Auditors (IIA) is the global professional This White Paper contains a variety of copyright material.
association for Internal Auditors, with global headquarters in Some of this is the intellectual property of the author, some
the USA and affiliated Institutes and Chapters throughout the is owned by the Institute of Internal Auditors–Global or the
world including Australia. Institute of Internal Auditors–Australia. Some material is
owned by others which is shown through attribution and
As the chief advocate of the Internal Audit profession, the IIA
referencing. Some material is in the public domain. Except
serves as the profession’s international standard-setter, sole
for material which is unambiguously and unarguably in
provider of globally accepted internal auditing certifications,
the public domain, only material owned by the Institute of
and principal researcher and educator.
Internal Auditors–Global and the Institute of Internal Auditors–
The IIA sets the bar for Internal Audit integrity and Australia, and so indicated, may be copied, provided that
professionalism around the world with its ‘International textual and graphical content are not altered and the source
Professional Practices Framework’ (IPPF), a collection of is acknowledged. The Institute of Internal Auditors–Australia
guidance that includes the ‘International Standards for the reserves the right to revoke that permission at any time.
Professional Practice of Internal Auditing’ and the ‘Code of Permission is not given for any commercial use or sale of the
Ethics’. material.
IIA–Australia ensures its members and the profession as Disclaimer
a whole are well-represented with decision-makers and
Whilst the Institute of Internal Auditors–Australia has
influencers, and is extensively represented on a number of
attempted to ensure the information in this White Paper is
global committees and prominent working groups in Australia
as accurate as possible, the information is for personal and
and internationally.
educational use only, and is provided in good faith without
The IIA was established in 1941 and now has more than any express or implied warranty. There is no guarantee given
200,000 members from 190 countries with hundreds of local to the accuracy or currency of information contained in this
area Chapters. Generally, members work in internal auditing, White Paper. The Institute of Internal Auditors–Australia does
risk management, governance, internal control, information not accept responsibility for any loss or damage occasioned
technology audit, education, and security. by use of the information contained in this White Paper.

© 2020 - The Institute of Internal Auditors - Australia 9