Implementing effective whistleblowing programmes

Whistleblowing refers to the act of exposing wrongdoing, corruption, or unethical behaviour within an organisation, often by an individual. These acts of disclosure can take various forms, from reporting financial fraud, to revealing safety violations or environmental hazards. By speaking out, whistleblowers play a crucial role in preventing misconduct and promoting transparency, accountability, and justice.

Recent high-profile whistleblowers, such as the Fujitsu employee who revealed that records in the Post Office’s Horizon system could be altered remotely and the individuals who raised safety concerns regarding Boeing’s aircrafts, underscore the importance of whistleblowing.

The latest developments around whistleblowing in the UK include a new “Protection for Whistleblowing” bill, led by the All-Party Parliamentary Group on Whistleblowing, which was presented before Parliament on 2nd February 2024, and which aims to revolutionise whistleblower protection in the UK.

Additionally, the new Director of the Serious Fraud Office, suggested in a speech in February 2024 that there should be financial incentivisation for whistleblowers, something which is already in place in the US. In the UK financial rewards for whistleblowers are currently limited to the

Competitions and Markets Authority offering a reward scheme for whistleblowers who report illegal cartel activity and HMRC who offer incentives for those who report tax fraud.

One example of the financial benefit of whistleblowing can be illustrated by the fact that the National Crime Agency reports the cost of fraud to the UK economy as £190bn per year, and the Association of Fraud Examiners report that whistleblowers are effective and responsible for the recovery of over £85bn.

As well as contributing to society more widely, whistleblowing can also be of critical importance to individual organisations, allowing for important issues to be raised and addressed. Therefore, in this article we discuss how organisations can protect themselves through establishing a whistleblowing programme and delve into some key questions about what makes an effective programme.

It might be a legal requirement. In some jurisdictions, companies may be required by legislation to have a whistleblowing programme in place. For example, the 2019 EU Whistleblower Protection Directive requires that companies over a certain threshold of employees or turnover, establish whistleblowing reporting channels and provide mechanisms for follow-up.

Even where it is not required to have a whistleblowing programme in place, it can be a legal requirement to treat those that do blow the whistle fairly. In the UK, the Public Interest Disclosure Act protects whistleblowers from retaliation such as negative treatment or unfair dismissal, so having procedures in place to treat whistleblowers appropriately is critical.

Legal requirements aside, establishing a whistleblowing programme drives a number of benefits. 

Such a programme enables the early detection and resolution of fraud and other misconduct issues before they escalate into major problems. This can result in reduced internal costs, improved adherence to internal controls, and increased trust between employees and leadership.

Even where issues are not caught early, having an internal reporting and resolution process can help pre-empt external reports to the media or regulators, minimize significant fines, and protect the organisation’s reputation from negative publicity.

Lastly, having established channels for individuals to speak up signals that an organisation values transparency and accountability, and helps reinforce a positive corporate culture.

An effective whistleblowing programme should be open not just to employees, but also contractors, suppliers, customers and other third parties. Providing access for a wide range of stakeholders allows for identification of potential misconduct that employees alone might fail to observe.

Some common issues that can be whistleblowing can identify include:

• Financial misconduct (such as asset misappropriation or fraudulent accounting)
• Bribery and corruption
• Insider trading
• Corporate tax evasion
• Discrimination and harassment
• Data breaches and GDPR violations
• Breaches of other legislation (e.g. Health and Safety at Work Act, Modern Slavery Act, Environmental Regulations, Employment Rights Act)

A whistleblowing programme will typically have one or more of a hotline, website, or email address that reports can be made through. These can be managed internally by the organisation itself or externally by a third party. Additionally, less formal routes for reporting will often exist in an organisation, such as through line managers or internal reporting structures.

Having an effective and trusted whistle-blowing programme can encourage whistleblowers to make reports internally, rather than directly to regulators or to the press, allowing organisations to address issues early and mitigate reputational impact.

An effective whistleblowing programme will have procedures in place to review all reports, and to investigate and take corrective action where relevant.

When reports are reviewed, they can be prioritised based on the reliability of the report, any time-sensitivity considerations (such as ongoing misconduct or safety hazards), and the magnitude of the potential operational or reputational impact on the organisation.

Where relevant, investigations should be performed in line with existing procedures (for example, a fraud response plan or HR guidance). These investigations should be conducted in an independent and unbiased manner and should be run by those with sufficient relevant expertise. In some cases, it may be necessary to bring in outside specialists, such as external legal counsel, forensic accountants and investigators, corporate intelligence specialists, or public relations firms.

The investigations performed should be comprehensively documented, with information stored safely and securely. Any findings of the investigation should be reported back to the relevant individuals in the organisation, which could be up to board level, depending on the severity of the case.

As a result of the investigation there may need to be disciplinary action, as well as improvements made to policies, procedures, and internal controls.

Finally, there should be continuous monitoring and review of the reports received and their status, such as through a dashboard. This can ensure that no reports are overlooked and allow the identification of potential trends.

In an effective whistleblowing programme, there should be procedures in place for how whistleblowers are treated. This will ensure the organisation is compliant with legislation that protects whistleblowers and will reassure potential whistleblowers that they will be treated fairly.

All whistleblowing reports should be treated confidentially and discreetly, although it may not be possible to promise anonymity to a whistleblower if a report is to be properly investigated.

Support should be offered to the whistleblower throughout the process, and once the investigation has been performed, feedback should be provided to the whistleblower where feasible.

It is also fundamental that whistleblowers are protected from any retaliation they may face as a result of having made a report.  As soon as any report is made, an assessment should be made of the potential for detriment to be suffered by the whisteblower and the subject of the report and steps taken to actively protect all parties involved.

As described above, having an effective whistleblowing programme in place is critical for an organisation, but there are a lot of complexities to consider.

If you would like to discuss any of the above further, or have any questions about how we can help, please fill out the form below and a member of our team will be in touch. 

1. The Whistleblowing bill - page 3