Whistleblower policy: what directors need to know

Australia’s new whistleblower laws are now in effect and by the beginning of next year (2020), certain organisations will be required to have a whistleblower policy in place.

This legislation should be seen by directors as an opportunity to strengthen their organisation, and in-particular seen as a way of improving or protecting organisational culture.

The saying might be ‘no news is good news’ but in governance, it’s not the case and a board should encourage and foster the idea that any bearer of bad news is welcome at the board table.

Certainly the recent Hayne Royal Commission laid bare what happens when a workplace has a culture where nobody speaks up against wrong-doing. Not only can it cause harm to individuals, it can also pose significant reputational risk.

The reality is, in a climate where there is such a poor culture around people bringing forward bad news, legislation such as this has become necessary.

This is one piece of legislation that supports what we already say: good governance should encourage issues being brought forward.

There shouldn’t need to be protection offered, however, now that there is protection, we as directors need to look at what the impact will be and ask ourselves what we need to be aware of.

So regardless of whether an organisation is required by the new law to have a whistleblower policy, all organisations can use one as a tool to foster a positive workplace culture and negate some of the risk of illegal or unethical conduct.

Governance by Design’s specialist legal consultant Lyndall Barnett has outlined here the key information directors need to know about the new legislation and its requirements.

Whistleblower protection:  Is your organisation compliant?

What is the purpose of the whistleblower protections?

The legislation seeks to encourage increased reporting of illegal and unethical conduct and to recognise the important role whistleblowers play in calling out misconduct.

Do they apply to my organisation?

The whistleblower provisions of the Corporations Act apply to:

• companies;
• banks;
• a provider of general insurance or life insurance;
• superannuation entity or superannuation trustee; and
• incorporated association or other body corporate that is a trading or financial corporation. This includes a not-for-profit organisation that trades in goods or services, lends or borrows money, or provides other financial services and their trading or financial activities make up a sufficiently significant proportion of their overall activities.

A separate regime applies to the public sector.

Who needs a whistleblower policy?

Under the Corporations Act, the policy is required of:

• public companies (including those limited by guarantee);
• large proprietary companies which has at least 2 of the following 3 criteria:
  •  consolidated revenue of at least $25 million
  •  consolidated gross assets of at least $12.5 million
  • at least 50 FTE employees;
• and proprietary companies that are a trustee of a registrable superannuation entity.

A policy can be useful to any organisation as a way to support their commitment to accountability and integrity.

What are the consequences of not having a whistleblower policy?

A failure to put in place a whistleblower policy by January 1, 2020, where it is required under the Corporations Act, is a criminal offence.

What must your whistleblower policy include?

To be compliant, the policy must include:

• information regarding the protections available to whistleblowers,
• how and to whom an individual can make a disclosure,
• how the organisation will support and protect whistleblowers from detriment, and investigate disclosures that qualify for protection,
• how the organisation will ensure fair treatment of employees who are mentioned in, or related to, disclosures that qualify for protection and
• how the policy is to be made available to officers and employees of the organisation.

What protections are afforded to whistleblowers?

The Corporations Act provides protection in relation to disclosure of information that would give a person grounds to suspect misconduct, or an improper state of affairs in relation to the organisation or a related organisation.

A person making a protected disclosure will not be subject to any liability for making the disclosure and the information will not be admissible in any proceedings (except proceedings alleging that the information is false).

In addition, any relevant contractual or other rights and remedies cannot be enforced against the whistleblower as a result of the relevant disclosure.

Who is an eligible whistleblower?

An eligible whistleblower under the Corporations Act is a current or former officer or employee, contractor (or an employee of a contractor) who supplies goods or services to the organisation, a trustee, custodian or investment manager of a superannuation entity or an officer, employee or a goods or service provider to a trustee, custodian or investment manager, an associate of the organisation or a relative or dependent of any of those persons.

The whistleblower must have reasonable grounds to suspect that the information being disclosed concerns misconduct or an improper state of affairs or circumstances.

What information may be disclosed and to whom?

The information may be about the organisation or an officer or employee of the organisation engaging in conduct that breaches the Corporations Act or other financial sector laws enforced by ASIC or APRA, a breach of any other law that is punishable by imprisonment for a period of 12 months or more,  or represents a danger to the public or the financial system.

The whistleblower may disclose to an officer or senior manager, auditor or actuary of the organisation or related organisation and any person authorised by the organisation to receive relevant disclosures, as well as to ASIC or APRA.

What happens if the whistleblowers identity is disclosed or they are victimised?

It is an offence under the Corporations Act to disclose the identity of the whistleblower, with a maximum penalty of up to $200,000 for an individual and $1 million for an organisation.

An offence is also committed if a person or organisation causes detriment or threatens to cause detriment to a whistleblower or someone who may become a whistleblower.  Compensation orders can be made by the courts in connection with such offences and apologies, injunctions and reinstatement can also be ordered.

The Court may consider whether the employer took reasonable precautions and exercised due diligence to avoid the detrimental conduct and whether it had policies in place to prevent victimisation.

The legislation does include provision for certain very limited public interest disclosures.