Whistleblower policy and protections

Are boards supporting the people who are taking the risk of calling out what they see?

Antonia Korsanos GAICD knows the value to an organisation of a good whistleblowing program.

“On all my audit committees, I’ve always put whistleblowing first on the agenda — it’s such a great lens on compliance and risk management,” says the former CFO, company secretary and seasoned director, who currently chairs the audit and risk committee at Treasury Wine Estates.

Korsanos, who headed the audit committee during troubled times at Crown Resorts and was a director at Ardent Leisure Group in the wake of the Dreamworld tragedy, declines to discuss the specific details of board practices, past or present, but she’s an eager proponent for the line of sight and benefits whistleblowing can provide.

According to Korsanos, it’s a step up on “walking the floor” for directors as they strive to get a read on culture.

“In a committee meeting, it’s a good discussion starter — not just about what’s being reported, but for what it’s telling you,” she says. “I have seen the difference it makes when you go to the business with the message: ‘Say something, we want to hear it’. Things come out of the woodwork.”

Korsanos insists that it’s not a “gotcha” moment about catching people out. “If something bad is going on, then as a director you definitely want to know about it,” she says.

“It will tell you if there’s something systemically or culturally wrong — and a lot about people’s alignment to values.”

A change in scope

Korsanos’ views highlight a mindset shift that’s gripping directors across Australian corporations — one that puts the emphasis on the wellbeing of whistleblowers and the value of the information they can deliver on improper conduct to organisations.

It’s also a new take on director oversight, demanding awareness, vigilance and specific actions, by law.

“From my perspective, everything that’s reported [in a whistleblowing program] comes to the board — it’s not selective, but it can be summarised,” says Korsanos, whose current roles include deputy chair of global gaming company Light & Wonder, and directorships on social games platform SciPlay and business analytics software company Phocas Group.

Korsanos takes note of global benchmarks for whistleblowing trends, in which diversity and inclusion and harassment are now among the largest areas being reported.

Within organisations, she evaluates by category and the numbers being reported in each.

“At every meeting, you want a flavour of what’s coming up regularly and what’s changed,” says Korsanos. “The speed of cases being opened and closed — why haven’t some cases been closed? Who’s managing them? How are people who have lodged a disclosure being responded to?”

From every angle, whistleblowing is a perennial hot topic, compelling for disclosures of scandalous frauds and ethical failures that frequently have left whistleblowers out in the cold and organisations patching reputational damage — and memorable for the raw humanity exposed in dire headlines and accounts of victimisation, where fear is often the underlying all-round stakeholder emotion.

The pandemic crisis muffled the initial rollout and impact of reforms to the Corporations Act in 2019, which increased protections for whistleblowers and made the definition of whistleblowing bigger and broader.

Directors’ approaches are rapidly moving from defensive and reactive to proactive, primarily in response to a new era of legislative and regulatory action that’s become a true game changer.

Turning up the volume

Board members are squarely in the frame as keepers and overseers of whistleblowing policies and as eligible recipients of protected disclosures from whistleblowers, with significant deterrents in the form of civil penalties for individuals who breach their obligations facing fines of up to $1.1m (or three times the benefit derived or detriment avoided by the contravention), while a sliding scale of criminal penalties runs to six months in jail for breaching confidentiality protections and two years in jail for breaching protections against victimisation.

Through persistent rounds of guidance, corporate regulator the Australian Securities and Investments Commission has made it clear that whistleblowing is a fundamental part of the risk and governance framework of corporations.

ASIC published a 2021 open-letter reminder to CEOs on their new obligations to whistleblowers in the wake of a review that found deficiencies among 102 corporate policies.

In early March, ASIC’s 758 Report outlined good practice guidelines for handling whistleblower disclosures. Following its scrutiny of seven firms — Woolworths, Treasury Wine Estates, AustralianSuper, BHP, NetWealth Group and banks ANZ and CBA — the report called out high points of effective cultures, practices, frameworks and accountabilities.

It recommended annual training for eligible recipients, along with questions and templates for consent, and formalised arrangements for board oversight, with details of the type of information to be received.

The day before, ASIC had flexed its enforcement muscle, announcing the first civil action for alleged breaches of the new provisions being taken against Queensland coal producer Terracom — including its managing director, former board chair and deputy chair — following a whistleblower’s allegations of falsified coal quality results in 2020.

While the retrospectivity has given directors Australia-wide pause for thought, no findings have been made and the matter is slated for the Federal Court in 2024. Terracom denied the initial allegations and has stated it “will vigorously defend the proceedings”.

Beyond the wake-up calls are signs of change, including attitudes to whistleblowers’ sacrifices. In January, Jeff Morris, one of Australia’s most high profile exponents, was named a Member of the Order of Australia in recognition of his well-documented struggle to surface malpractice in CBA’s financial planning division, which triggered a Senate inquiry (which labelled ASIC’s performance in the matter as “inadequate”) and eventually resulted in revelations at the banking Royal Commission.

Eyes are now on Australia’s new National AntiCorruption Commission, amid calls for the establishment of an independent whistleblower protection agency to specifically take care of whistleblowers’ interests.

Meanwhile, momentum is building towards a review of the Corporations Act whistleblowing provisions, due to begin in July 2024.

Finding the way forward

Australia is effectively catching up with international best practice principles as defined by the 2019 European Directive on delivering protection to whistleblowers, argues Professor AJ Brown of Griffith University’s Centre for Governance and Public Policy, which has produced Protecting Australia’s Whistleblowers: The Federal Roadmap. The roadmap provides a checklist to help point the way.

The content of the Corporations Act laws remains problematic in terms of the difficulty in achieving the threshold to show whether a whistleblower has suffered detrimental action for which they deserve compensation, says Brown, a board member of anti-corruption agency Transparency International Australia, which is advocating a standalone whistleblower protection agency.

While ASIC is currently doing the regulatory grunt work, “it’s not its job to pursue compensation for whistleblowers, which is really what they need”, says Brown. “Under the Corporations Act provisions, they are protected against adverse costs to a degree, but it’s an uphill battle because they are up against the legal firepower of the employer.”

Governance and Public Policy’s groundbreaking Whistling While They Work 2 (WWTW2) research — which gathered evidence from 17,000-plus employees at 46 public/private sector and NFP organisations, around 5000 whistleblowers and others — showed whistleblowing cases gone wrong tended to involve an entire organisation turning against individuals who raised concerns about potential wrongdoing.

“It’s a complex battle where the organisation believes it’s right because the employee has been disloyal, even though the employee has done the right thing,” says Brown. “We need extra resources and an independent authority to resolve this.”

That said, organisations turning on individuals is not as common as media reports might have us believe, observes Brown. WWTW2, which ASIC helped to fund, showed a majority of organisations already putting major effort into whistleblowing systems.

“They are doing their bit to encourage people to speak up about concerns and, as a consequence, have become a lot better about handling them, especially where they learn very often that those concerns are valid and valuable,” he says.

Outcomes entirely depend on how power relations in organisations play out, and organisations now need to be proactive when a report comes in, and to overcome “the knee-jerk response to sweep problems under the carpet”, says Brown. “Any organisation is still capable of getting it wrong, but an increasing number are getting it right.”

Financial services moving ahead

Other experts in the field attest that the financial services sector is ahead in Australia when it comes to the maturity of whistleblowing programs. Leaders of programs at the nation’s big four banks hold a quarterly roundtable to exchange ideas and challenges under the confidential Chatham House Rule, but with many important insights.

The banking Royal Commission highlighted the importance of whistleblowing and other channels for raising concerns, says Andrew Sealey, inaugural head of NAB’s whistleblower program.

Similarly, he believes, it drove their resolve to simplify the bank, make NAB a better organisation for customers and to restore community trust in banks.

When Sealey took up his role in 2016, the bank’s whistleblowing policy was “full of thresholds, legal jargon and technical references to the Corporations Act, which were probably a disincentive to blowing the whistle”.

The whistleblowing service was very manual and there was no independent external whistleblowing service to help guide people wanting to blow the whistle — anonymously or not — as there is today.

“It needed to evolve into something more user-friendly,” he says.

In 2022, NAB had 207 whistleblowers — with numbers growing by about 10 per cent annually. That upward trend in numbers is considered a positive sign of a speak-up culture, rather than a deterioration in overall conduct and culture.

NAB’s board audit committee has oversight of the whistleblower program (an independent internal team) , including escalations, reporting, framework and policy.

The majority of reports at NAB arrive via the KPMG Faircall hotline.

“We really promote that as the way to go,” says Sealey. “It provides a safe and confidential way for our colleagues to raise concerns about wrongdoing. We tell our colleagues that the program works for whistleblowers, not the business. I can say, hand on heart, that we are independent.”

The board’s audit committee receives reports on the whistleblower program every six months and high-rated cases are escalated on a real-time basis to the committee chair (to the extent permitted by law). The executive receives thematic reporting on trends and emerging risks.

Disclosures bring on tangible changes

The nature of cases is also shifting. There’s a tendency to think whistleblowing is all about high-profile fraud, theft or criminal activity.

“We get a handful of complex cases a year, if that,” says Sealey, adding that most of last year’s cases were related to policy breaches, process failures, leadership/cultural concerns and conflicts of interest.

Recent law amendments have widened the scope. “An improper state of affairs is not well-defined in the Corporations Act, nor is misconduct, and a good whistleblower program allows people to speak up about anything that’s going on,” says Sealey.

“We err on the side of caution. Most disclosures provide invaluable insights about how we can be better for our customers and colleagues. Every week, we see something change because of whistleblowers. This may be a change in the wording of a policy or a process, something in the control environment gets moved, a leader who gets moved on or a consequence applied for poor behaviour. All these things make a difference, but we can’t shout it from the rooftop because of confidentiality. We enable anonymity, but we love it when a whistleblower gives us their identity and talks to us, because it’s a better opportunity to get richer information.”

The imperative to respect anonymity often makes cases difficult to investigate, while the need for confidentiality also makes it challenging for organisations to tell success stories and spread the word about whistleblower programs.

NAB has appointed 190 whistleblower champions to drive awareness across the business. The bank measures employee engagement quarterly with questions on speaking up and asking people how safe they feel using the program.

High scores show up in parts of the business where the champions are active, says Sealey.

Efforts are increasingly focused on demystifying whistleblowing, dispelling the myths that senior leaders don’t want to hear bad news and allaying whistleblowers’ fears that they will be seen as troublemakers.

Making the call

Demand for external whistleblowing services has reportedly spiked from organisations that were already ahead of the game, and those looking to implement proper programs since 2019.

There’s a higher appetite from organisations that want to go beyond compliance to better practice, with the dual drivers of improving both whistleblowers’ experiences and organisational culture, says Lauren Witherdin MAICD. She is CEO of Your Call, Australia’s largest independent whistleblowing provider.

Your Call operates online and phone hotline reporting and counts 750 organisations as clients — ranging from large ASX-listed corporations to NFPs with around 30 employees.

Some companies use the provider as a safety net, while others, with no whistleblowing program in-house, rely fully on the service. Your Call pioneered three-way anonymous online communication between the whistleblower, the organisation and the service, and now deals with thousands of disclosures annually.

Around 20 per cent of the disclosers who contact Your Call choose to be identified.

With nearly two decades of experience, starting as a chartered accountant in a professional services firm taking whistleblowers’ calls and working on investigations, Witherdin has seen changes.

First up is the wider range of matters being reported under the amended law provisions.

“Essentially, it’s any improper conduct in relation to the entity, with the exception of workplace grievances — an area where the law was catching up with what was already happening,” she says.

Sexual harassment, racism allegations and modern slavery issues are surfacing more often.

Mixed disclosures, where a workplace grievance has prompted a report of more widespread misconduct, are on the rise.

ASIC recommends these be treated as protected disclosures under the regime. Secondary disclosures, where a whistleblower reports a matter again after being dissatisfied with the outcome of an original report, are also becoming more common.

In a sign of the times, Witherdin says more boards are looking to Your Call as a direct reporting channel.

Would you recognise a disclosure?

Witherdin, who works with directors on the risks and implications, both for them and their organisation, explains it’s not an opt-out system — they must get involved as eligible recipients.

“They need to be able to identify a protected disclosure, which is not easy as there’s no requirement for a whistleblower to identify as such,” she says. “A protected disclosure may be made to a board director at a barbecue on a Saturday. If that director shares that information with another individual, they could be breaking the whistleblowing laws.”

Directors also face further organisational risk from senior leaders and other eligible recipients in their organisations who fail to recognise protected disclosures that come their way.

To whistleblowers, directors are the embodiment of the organisation, so they are just as likely to receive a complaint when they are doing a floor walk around the organisation or attending a function as they are to receive an anonymous envelope on their desk, says Annamarie Rooding GAICD, a partner in King & Wood Mallesons’ employee relations and safety team.

Her practice involves training directors and helping organisations to set up whistleblowing frameworks. Rooding notes that at that first encounter, the director needs to understand the protections of confidentiality and against any victimisation for the whistleblower, and endeavour to make speaking up a positive experience and to ensure that the matter is effectively triaged.

“The complaint needs to be actioned through an independent internal whistleblowing program, not simply taken on as feedback,” she says. “That’s the fundamental hygiene.”

The director’s role does not usually involve investigating or dealing daily with the discloser. There are others who are responsible for doing those things.

“We talk a lot about the importance of systems and support for speaking up,” says Rooding. “The director’s role — or any eligible recipient’s role — is to listen up.”

While the legislation does not prescribe how to set up a whistleblowing framework — and ASIC has been very open in its guidance that one size does not fit all — Rooding sees some organisations with entire teams managing and responding to disclosures, and others with low or variable numbers of disclosures, running virtual teams that mobilise when a complaint lands.

“There needs to be at least one person who coordinates, maintains and administers the framework and stays across the guidance coming from ASIC,” she says.

There are ample grey areas to consider, not least the expansion of whistleblower scope, which may encompass spouses and family members of impacted individuals, or an organisation’s contractors, suppliers and their employees.

How to investigate anonymous disclosures without consent from the whistleblower to reveal their identity is currently perplexing organisations, notes Rooding, although some are finding workarounds in the form of cultural reviews and other indirect avenues to explore the various matters raised.

Rather than rejoicing when an organisation is not receiving many complaints, she says directors should be asking if people don’t trust the system enough to speak up, why they don’t have the confidence to identify themselves and, ultimately, how to flip whistleblowing from being a tax on resources to being an opportunity to learn what’s going on in the organisation — to get in front of issues before they become legally and reputationally risky. There is much to think about.

Whistleblower director duties and responsibilities

Whistleblowers play an important role in exposing corporate misconduct and cultural or systemic issues. In this context, there is increasing recognition of the significance of whistleblowing to good governance.

It is clear that boards have a strong interest in ensuring that information about such issues is brought to light early so they can be detected, addressed and, ideally, prevented.

Cultivating an environment where whistleblowers feel safe to come forward is critical to achieving this and assisting the board to effectively discharge its oversight of financial and non-financial risks.

The AICD director tool sets out an overview of the whistleblowing laws under the Corporations Act 2001 (Cth) as well as practical insights and tips for directors to support an effective whistleblowing framework. 

This article first appeared under the headline 'When the Whistle Blows' in the August 2023 issue of Company Director magazine.