Whistleblower policy: Where culture, integrity and risk management meet

ASIC asserts that “Valuable and credible information from whistleblowers can provide firms with the opportunity to investigate the allegations raised… address the underlying harms and improve company performance.” Directors are critical to this process. 

What kind of board do you want to be? What kind of organisation are you steering? Whistleblower complaints focus directors on the pointy end of these questions. They invite examination of organisational culture, that potentially uncomfortable territory beyond sound economic management.

Consider this assertion by Kieran Pender, Associate Legal Director at the Human Rights Law Centre (HRLC) and an internationally recognised authority on whistleblower protections: “So many of the major, defining corporate scandals of recent decades in Australia have only been brought to light because brave people have spoken up.” We should recognise, he says, that, “Whistleblowers are essential to integrity, probity and good governance across the Australian corporate landscape.”

The unfolding evidence that professional services firm KPMG misused confidential client information in pursuit of lucrative audit contracts, and mistreated the whistleblower who persisted for almost two years via numerous avenues to bring the matter to light, is only the latest poorly handled whistleblower case to invite corporate introspection. 

The repercussions at KPMG Australia so far include that its chief executive, two audit partners, the chief operating officer and chair of the board have been removed from their roles or resigned as a result of the whistleblower’s claim, which was publicly disclosed by Labor Senator Deborah O’Neill under parliamentary privilege in March this year.

KPMG wrongdoing contributed to the Treasury Department’s decision to reform the rules under which Australia’s Big Four consulting firms operate. On 1 July, Assistant Treasurer Daniel Mulino sought feedback on an options paper for new regulations. The introduction to the paper says, “Recent events have confirmed that gaps exist in the regulation of the audit sector in relation to independence and ethics, audit firm culture and values, firm-wide monitoring systems and internal controls, and prioritisation of audit quality”.

These in-company consequences and important regulatory reforms all but eclipse the consequences for the whistleblower. Although the KPMG whistleblower’s identity remains unknown, the person in this case told a parliamentary inquiry into the matter that KPMG had responded to his disclosure by denying him a payrise, withdrawing his client work and threatening to sack him. Such reprisals against whistleblowers are illegal.

What should any board do when a whistleblower concern is raised?

1. Protect the whistleblower

The vital responsibilities according to law, says Bruce Cowley FAICD, a corporate and governance lawyer and a non-executive director on several boards, are to “not disclose the name of the whistleblower and to ensure that the whistleblower is not victimised”, as the company embarks on a path of investigation. 

Cowley says there can be challenges in not naming the whistleblower, especially “if the complaint is about a specific person in circumstances where the whistleblower might be the only one, or one of two or three people who know what happened”. In advance of conducting an independent investigation, you need to consider in advance how you will protect the whistleblower’s identity.

One practical suggestion made by the Australian Securities and Investments Commission (ASIC) is that companies ensure they: “limit access to materials related to disclosures using secure recording-keeping or technology systems”. Taking care with an investigation also helps to protect people potentially innocent of wrongdoing until allegations can be substantiated.

In cases where lawyers will be brought to bear, Pender, (who leads the HRLC Whistleblower Project, established in 2023) recommends an additional, unmandated, level of support: funding legal advice for the whistleblower. “Engaging in a process where everyone except the whistleblower has legal representation can be really hard.” 

Supporting whistleblowers to participate in the process signals a company’s commitment to a fair and thorough examination of alleged misconduct.

2. Ensure an unbiased investigation

Public companies, large proprietary companies and corporate trustees of APRA-regulated superannuation entities are required by Australian law to have a whistleblower policy. For organisations large and small, ASIC provides guidelines for handling whistleblower complaints, but in essence, it says, the formal and available policy must “include information about the legal protections available to whistleblowers and how a company will investigate whistleblower disclosures and protect whistleblowers from detriment”.

Policies of larger companies often include the appointment and training of a designated officer, responsible for whistleblower matters. Directors are among the office holders eligible to receive whistleblower disclosures and invoke the relevant protections, and need to be up to date in their understanding of the company whistleblower policy.

Cowley cautions that, “If an individual board member receives a whistleblower disclosure, they need to check who else they can talk to, because talking to other board members might not be possible for a variety of reasons.” He recommends consulting the designated officer and/or the policy before proceeding with either an internal or external investigation.

He says matters of smaller consequence might be handled internally, “but if it’s a major or complex issue, you’d want to engage external parties”: such as a law firm that isn’t otherwise employed to handle company matters, or a workplace investigator, and perhaps others with expertise relevant to the complaint.

3. Question the “all clear”

Whether an investigation is carried out internally or externally, whistleblower policy should include that the board, which is ultimately responsible for risk management and the corporate governance framework, be made aware of whistleblower complaints.

ASIC’s Report 758: Good Practices for Handling Whistleblower Disclosures, published in March 2023, provides an example of how to avoid the board being handed false positives on the resolution of complaints. Successful practice involved firms providing boards or a designated board committee with:

“De-identified information about all disclosures received… or information and updates on the progress and resolution of disclosures that met a defined risk threshold.”

Cowley says in the event of a whistleblower complaint, most of the boards he sits on receive a report describing the matter in general terms. Questions directors should ask, if they haven’t been sufficiently addressed in the report, may include:

• Why are we investigating this internally, rather than externally?

• What’s the timeframe for a resolution?

• If there are findings against one or more people: What kind of consequences have been or will be applied?

4. Focus on the facts and act without favour

It may be that the person or people being investigated are key revenue earners of the company, cornerstones of the company’s reputation, or both. Under the law, as well as for reasons of integrity, cultural resilience and risk management, such cases must be as rigorously pursued as others.

Failing to properly investigate a whistleblowing concern is dangerous for organisations of any size or purpose, says Pender, because whistleblower concerns about misconduct in relation to company policy or legal requirements may ultimately escalate. In Pender’s research and interactions through the HRLC Whistleblower Project, he says, “We’ve seen so many examples where the whistleblower speaks up, the company doesn’t deal with it well, and it’s ultimately escalated to a regulator, to the media, to a member of parliament…” 

5. Set the standard from the top

“A speak-up culture isn’t only how you deal with a formal whistleblowing complaint,” says Pender. Rather, it’s embedded in how companies and leadership deal with everyday situations. “The culture set in relation to dealing with minor, day-to-day issues influences how people are or are not willing to raise matters of much greater severity,” he says. 

Pender adds that situations also frequently occur in which, “Someone speaks up, but they may not have the full picture – maybe there is an explanation, maybe the wrongdoing isn’t as it seems. In organisations with good whistleblowing cultures, that’s not seen as a bad thing.” Getting to the bottom of a perceived wrongdoing and determining there was no breach is instead viewed as a good stress test of the system and processes. “You want to have a culture where people can speak up, the concerns can be looked into, and whether or not the wrongdoing actually exists, it’s been properly investigated.”