ASIC calls on companies to review and renew their whistleblower policy
19 October 2021
Siobhan Mulcahy,
Partner, Melbourne
After having first introduced a corporate whistleblowing regime in 2004 and subsequently expanding that regime in a piecemeal way, the Federal government introduced new whistleblowing laws with effect from 1 July 2019.
In simple terms, under those laws an eligible whistleblower (which includes a current or former officer, employee or contractor, or their relative, dependant or spouse) may make a protected disclosure to an eligible recipient (which includes an officer or senior manager of the entity) or regulator, where they have reasonable grounds to suspect that their information concerns misconduct or an improper state of affairs or circumstances. Where that occurs the whistleblower, who may remain anonymous, will be entitled to various protections. Please see our comprehensive guide to those laws: New whistleblowing laws – are you ready?
In addition, under those laws from 1 January 2020 public companies, large proprietary companies, and corporate trustees of registrable superannuation entities, had to implement a whistleblower policy. Given that almost two years has now elapsed, companies should consider reviewing their policies to ensure that they are fully compliant – the Australian Securities and Investments Commission (ASIC) agrees!
The requirement to have a whistleblower policy
In broad terms the whistleblower policy has to contain information about:
- the protections available to whistleblowers;
- how and to whom an individual can make a disclosure;
- how the company will support and protect whistleblowers from detriment;
- how investigations into a disclosure will proceed;
- how the company will ensure fair treatment of employees who are mentioned in whistleblower disclosures; and
- how the policy will be made available to officers and employees of the company.
Companies limited by guarantee that have revenue (or consolidated revenue) for a financial year of less than $1 million, which will include small not-for-profits or charities, are exempt from this obligation.
ASIC regulatory guidance
In late 2019 ASIC issued Regulatory Guide 270: Whistleblower policies (RG 270), setting out guidance to companies on the matters to be covered by a policy and what ASIC considers to be good practice guide on establishing, implementing and maintaining a policy.
The regulatory guide contains both detail as to how a company can meet its mandatory policy obligations, together with recommendations as to ‘good practice’. Those good practice recommendations are not strictly mandatory, but they provide a clear indication of what ASIC expects from a whistleblower policy, how ASIC will interpret the whistleblower obligations, and the issues ASIC will consider when carrying out its enforcement role in respect of the whistleblower protections.
ASIC sent a letter to the CEOs of entities required to implement a policy
During 2020 ASIC reviewed a sample of whistleblower policies to understand how entities were responding to the whistleblower policy requirements. In undertaking that review ASIC noted that the majority of the policies reviewed did not to include all the information required by the Corporations Act 2001 (Cth) (Corporations Act), including information about the legally enforceable protections available to whistleblowers.
In ASIC’s view, the most prevalent and concerning issues were unclear, incomplete or inaccurate information about how potential whistleblowers can make a qualifying disclosure and about the protections available to them when they did so.
In its letter, ASIC summarised the results of its policy review, including the legally required content, its observations on non-complying policies and some better practice tips. We have expanded on that summary below, including setting out in some detail the ‘musts’ and ‘shoulds’ from RG 270:
| How to make a qualifying disclosure, including to whom | ||
|---|---|---|
| Required content | Observations by ASIC | Requirements and best practice from RG 270 |
| Information about what a reporter needs to do to qualify for protection under the Corporations Act. | A number of policies did not summarise the threshold criteria for whistleblowers to qualify for protection under the Corporations Act. | It is key that the policy makes clear which persons can potentially qualify for whistleblower protections and what actions should be taken by them to ensure that they qualify for those protections. |
| Information about who is eligible to be a whistleblower. | Some policies omitted some of the categories of individuals who are eligible to make disclosures qualifying for whistleblower protections (i.e. individuals who can meet the legal definition of ‘eligible whistleblower’). | The policy must identify all of the different types of disclosers within and outside the entity who can make a disclosure that qualifies for protection (i.e. ‘eligible whistleblowers’). In practice, the types of disclosers who will be covered will depend on the entity's business operations, practices and organisational structure and set-up. |
| Indication that reporters can be anonymous or identifiable. | Some policies continued to require whistleblowers to identify themselves to qualify for protection, suggesting that not all entities understood that protections now extend to anonymous disclosures, or did not state that anonymous whistleblowers could be protected. Some policies did not provide details of an internal reporting mechanism to facilitate anonymous disclosures and, for example, asked whistleblowers to report to eligible recipients by telephone or in person. | The policy:
|
| Information about who is eligible to receive disclosures qualifying for protection. | Many policies did not fully or accurately identify the channels available under the law that whistleblowers may use to make disclosures qualifying for protection. For example, a number of policies only listed the preferred or internal channels available. Some policies encouraged whistleblowers to first talk to their managers about their concerns. There is no requirement that a whistleblower first report their concerns to a manager who is not an ‘eligible recipient’. In certain circumstances, doing so may place whistleblowers at greater risk of detriment and loss of confidentiality. | The policy must:
The policy must:
The policy may encourage employees and external disclosers to make a disclosure to one of the entity’s internal or external eligible recipients in the first instance. |
| Information about the types of reportable matters that qualify for protection. | Some policies’ descriptions of the types of reportable matters that qualify for whistleblower protections did not align with those listed in the Corporations Act and were incomplete or inaccurate. Many policies did not explain when disclosures about matters such as personal work-related grievances may be protected under the Corporations Act. | The policy must:
The policy must clarify that disclosures relating to personal work-related grievances do not qualify for protection and should explain the meaning of ‘personal work-related grievance’ by including some examples. The policy may make clear how those grievances can nonetheless be raised internally. The policy must outline when a disclosure about, or including, a personal work-related grievance still qualifies for protection. |
| The protections available to whistleblowers | ||
|---|---|---|
| Required content | Observations by ASIC | Requirements and best practice from RG 270 |
Information about the protections for qualifying disclosures, which are:
| A small number of policies did not include information about any of the protections, or incorrectly described the protections. Some policies did not describe all the protections available under the Corporations Act, or did not state that the protections are legal protections. | The policy must include a brief explanation about its purpose, and information about the protections under the Corporations Act that are available to disclosers who qualify for protection as a whistleblower. |
Identity protection (confidentiality) – the policy:
|
||
Protection from detrimental acts or omissions – the policy:
|
||
Compensation and other remedies – the policy:
|
||
Civil, criminal and administrative liability protection – the policy:
|
||
| The entity’s measures to support and protect whistleblowers | ||
|---|---|---|
| Required content | Observations by ASIC | Requirements and best practice from RG 270 |
| Information about how the entity will support whistleblowers. | Some policies only stated that the entity would support and protect whistleblowers without describing how they would do this. | The policy:
The policy must provide examples of how the entity will, in practice, protect the confidentiality of a discloser’s identity including:
|
| Information about how the entity will protect whistleblowers from detriment. | A few policies claimed that support or protection is conditional on whistleblowers making disclosures in good faith. A whistleblower’s motive is not relevant in qualifying for the protections and a whistleblower does not need to satisfy a ‘good faith’ test. | The policy:
The policy may refer to measures and mechanisms for protecting disclosers from detrimental acts or omissions including:
|
| How the entity will investigate whistleblower disclosures and ensure fair treatment of employees mentioned in qualifying disclosures, or to whom such disclosures relate | ||
|---|---|---|
| Required content | Observations by ASIC | Requirements and best practice from RG 270 |
| Information about how the entity will investigate disclosures that qualify for protection. | A small number of policies did not provide even a high-level statement about how the entity would investigate disclosures that qualify for protection. | The policy:
The policy should clarify that the method for documenting and reporting the findings will depend on the nature of the disclosure, and that there may be circumstances where it may not be appropriate to provide details of the outcome to the discloser. |
| Information about how the entity will ensure fair treatment of employees mentioned in qualifying disclosures, or to whom such disclosures relate. | Some policies stated that the entity would conduct fair assessments and investigations and ensure fair treatment but did not include details of how they would ensure fair treatment of employees who are mentioned in disclosures that qualify for protection, or to whom such disclosures relate. | The policy must include information about how the entity will ensure the fair treatment of its employees who are mentioned in a disclosure, including those who are the subject of a disclosure. Measures and/or mechanisms for ensuring fair treatment of individuals mentioned in a disclosure may include statements in the policy that:
|
| How the entity makes its policy available to officers and employees | ||
|---|---|---|
| Required content | Observations by ASIC | Requirements and best practice from RG 270 |
| Information about how the entity makes its policy available to officers and employees. | Not all policies explained how the entity would make its whistleblower policy available to its officers and employees. Not all entities made their whistleblower policy publicly available on their websites. | The policy must cover information about how the policy will be made available to the entity’s officers and employees. The policy may include the methods for making the policy available to officers and employees including:
To ensure that disclosers outside an entity can access the policy, the policy should be available on the entity’s external website (with the deletion of internal contact details if appropriate). |
Reviewing and updating the policy
It is important for every entity to review its whistleblower policy, processes and procedures on a periodic basis, and to rectify any issues identified in the review in a timely manner. ASIC has itself identified various matters where existing policies do not fully comply or reflect best practice.
In reviewing a policy, an entity should always consider which aspects worked well in relation to any disclosure and which did not work well since a last review. This can of course include seeking feedback from employees about the effectiveness of the whistleblower policy, processes and procedures.
If you require assistance to implement a whistleblower policy, or to review an existing policy in light of the review findings of ASIC and the best practice summary, please contact us.
If you found this insight article useful and you would like to subscribe to Gadens’ updates, click here.
Authored by:
Brett Feltham, Partner
This update does not constitute legal advice and should not be relied upon as such. It is intended only to provide a summary and general overview on matters of interest and it is not intended to be comprehensive. You should seek legal or other professional advice before acting or relying on any of the content.
Get in touch
- Siobhan Mulcahy
- Partner, Melbourne
- +61 3 9252 2556
- siobhan.mulcahy@gadens.com
