ASIC Whistleblower Guidance
ASIC has released new guidance for companies on whistleblower policies – see “Regulatory Guide 270 – Whistleblower policies” (RG), accessible here.
The RG is intended to assist companies that are required to implement a whistleblower policy by 1 January 2020 in accordance with reforms to the Corporations Act 2001 (Cth) (Act) that strengthen whistleblower protections (see here).
The RG is lengthy – just over 50 pages – and prescribes a number of matters that ASIC considers must be included in a whistleblowing policy to be compliant under the Act. The Guide provides “good practice” guidance to assist companies in developing and implementing policies and procedures which can be used as a benchmark.
ASIC has also relieved public companies limited by guarantee that are not-for-profits or charities and have an annual consolidated revenue of less than $1 million, from the requirement to have a whistleblowing policy under the Corporations Act. Key takeaways for directors and an update on the relevant requirements are set out in the full AICD article here.
Despite all the talk about how important whistleblowing is, large numbers of employees still suffer after exposing wrongdoings and many organisations continue to have their reputations tarnished by their poor responses. A new report reveals how these outcomes can be minimised or averted — and what role directors can play in this.
Whistling While They Work 2 is the result of one of the world’s largest studies into whistleblowing. Funded by the Australian Research Council and 23 partners, and led by Griffith University's Centre for Governance and Public Policy, the three-year project surveyed 700 organisations and more than 17,000 employees, managers and governance professionals. The report comes at a time when new laws and protections are being introduced. It confirms there is still much to be done to improve how whistleblowing is managed.
“Despite the importance of whistleblowing in uncovering wrongdoing, we found continuing levels of poor outcomes for whistleblowers and the prevalence of informal, collateral impacts such as stress and isolation,” says associate professor Eva Tsahuridu, an industry fellow at the School of Accounting RMIT University, and a researcher involved on the director side of the study. “More than 80 per cent of the reporters of wrongdoing experienced some form of informal repercussion, while almost half of them suffered some form of direct retaliation.”
Yet the study also shows that whistleblowers need not necessarily suffer — and don’t always. On average, more than half the whistleblowers surveyed indicated they were treated well, or no differently, by management and colleagues. However, even if they didn’t believe they had been treated badly, most reporters experienced a range of negative consequences, including stress, isolation, ostracism, harassment or intimidation.
Tsahuridu notes that by being proactive and intervening early, organisations can create better perceptions of treatment and fewer cases of negative repercussions for whistleblowers. “Those using proactive risk assessments are also more effective in preventing whistleblower detriment,” she says.
The study found risk assessment should be the first step an organisation takes to reduce repercussions. It noted better outcomes when the risk assessment occurred as soon as a report was made. If done only when conflicts or problems began to arise, the assessment made little difference. “These results confirm that simply considering what could go wrong for reporters, before anything does, can make a crucial difference in helping place the organisation on the right path,” the report says.
On the governance side, the report advises that to be effective, there should be a functional separation between many key roles for whistleblowing, with independence granted to those entrusted with investigating and resolving disclosures as well as those tasked with ensuring support. However, there was little support in the study for ensuring those with whistleblowing management responsibilities had the required expertise or training to fulfil their role.
The director’s role
“Directors have legal and ethical responsibilities to ensure their organisations comply with the law, identify and address conduct risk, as well as protect the people who raise concerns from direct harm and collateral damage,” says Tsahuridu. “Their attention is needed on two fronts — how their company is dealing with the disclosure as well as the person who made the disclosure. Both need to be managed effectively.”
The information directors receive is also important. In partnership with the AICD, the researchers asked 118 Australian directors whether their board should receive information on whistleblowing cases. The majority (60 per cent) agreed they should receive such information through regular reporting on all cases, not simply “specific cases that seem likely to have serious consequences”. Only 36 per cent said management currently provided such information while 29 per cent said a board committee oversaw the program.
Tsahuridu says directors understand that information about whistleblowing is important and valuable, but don’t seem to receive as much information as they ought to. “Directors have to play a more active role and seek timely and comprehensive information on the number, nature and status of concerns, risk assessments and responses, and outcomes and actions, including the changes in policies and practices that ensue,” she says. “Remember, the absence of reports of wrongdoing is not necessarily indicative of an absence of wrongdoing. Our research shows the number of people who experienced serious wrongdoing but did not report it remains high.”
42% of those who reported felt they were treated badly by management or colleagues when raising concerns about wrongdoing
34% of those who reported agreed that reporters were treated badly when raising concerns
82.4% of reporters experienced at least some type of negative repercussion, including stress, ostracism, intimidation or a denial of promotion
60% of reports of wrongdoing were first made to immediate supervisors.
25% of governance professionals/managers experienced mistreatment after reporting wrongdoing as part of their role
46% of governance professionals reported being treated badly by management after reporting wrongdoing when this was not required of their role
46% of the most experienced governance professionals (those who had dealt with more than 25 reports of wrongdoing) had formal or professional training in investigations
39% of governance professionals had been trained to manage the workplace when wrongdoing reports were made
Source: Whistling While They Work 2
Sylvia Falzon FAICD, chair of Cabrini Health, says the new laws can be viewed in two ways. “The improved protections can be seen as a regulatory stick to enhance whistleblower protections and looking to bolster corporate responsibility — or, for those boards with a strong culture and a supportive, open and honest environment at its core, the new law is an extension to what already exists... enabling and encouraging a culture of continuous improvement.”
Tsahuridu also warns directors that organisations can suffer from overconfidence. “This overconfidence may lead boards to mistakenly think they do not have anything to be concerned about or need to improve. Governance and oversight of whistleblowing is necessary in all organisations.”
How to establish an effective whistleblowing policy
Commentary in Principle 3 of the ASX Corporate Governance Principles and Recommendations (Fourth Edition) offers guidance for organisations on whistleblowing policies and practices. It states: “In most cases, the best source of information about whether a listed entity is living up to its values are its employees. They should be encouraged to speak up about any unlawful, unethical or irresponsible behaviour within the organisation through an appropriate whistleblower policy.”
It suggests an organisation should:
- Link the policy to the organisation’s statement of values.
- Clearly identify the types of concerns that may be reported under the policy and how and to whom reports may be made.
- Explain how the confidentiality of the whistleblower’s identity is safeguarded, and how the whistleblower is protected from retaliation or victimisation.
- Outline the processes to follow up and investigate reports made under the policy.
- Provide for the training of employees about the whistleblower policy and their rights and obligations under it.
- Provide for the training of managers and others who may receive whistleblower reports about how to respond to them.
- State that the policy will be periodically reviewed to check that it is operating effectively and whether any changes are required to the policy.
Whistling while they work
Defending the organisation, but not fixing the issue
Sally McDow, a lawyer with 15 years’ international experience, had been divisional head of compliance in a major Australian energy company for four years when she disclosed to superiors that other managers had requested her to falsify audit findings about high risks of non-compliance with environmental and other laws.
McDow was also asked to present the changed findings to internal and external stakeholders, including investors. Senior colleagues had previously been terminated over similar requests. “Rather than properly addressing the issues, the first response was to appoint a person with human resources skills to review the audit report, even though it revolved around technical engineering and legislative issues,” says McDow.
“This person dismissed the concerns as invalid, even though they had no engineering or legislative training or skills to make such a finding. When the board finally asked for an investigation, several senior persons implicated in the cover-up were appointed to important roles in the investigation. One reviewer of technical issues later in the process was a relative of one of the persons involved. Terms of reference were changed until they were so narrow, they didn’t deal with the issue.”
Ultimately, a detailed review by external experts substantiated most of McDow’s allegations, but internally was deemed “not relevant” and kept under wraps. The board declined to get further involved on the basis that the issue “was out of their scope”. McDow was terminated, but took legal action for reprisal.
In 2017, after 18 months, the company settled the claim at substantial cost financially and to its reputation.
“People independent to the allegations, with the right skills and no conflict of interest, should have been appointed to supervise and monitor the investigations. The whole focus was on people defending the organisation and themselves from potential reputational and legal risk — not on examining the issues and fixing problems.”
Now a principal consultant with CPR Partners, McDow works in governance, culture and risk, and hopes new whistleblowing policies will help prevent the mistakes from happening again.
Just plain lucky?
In 2001, Dennis Gentilin joined the National Australia Bank’s foreign exchange option trading desk after completing the bank’s graduate program. During his first year on the desk, he became aware colleagues were misreporting transactions to reduce the volatility in the daily profit and loss — a practice widely known as “smoothing”.
A year later, increasingly uncomfortable with culture and practices in his team, Gentilin raised a number of concerns (including “smoothing”) with a senior manager — but his concerns fell on “deaf ears”. For the next 12 months, he questioned his own moral judgement, wondering if he was the one who didn’t belong, and coped by “turning a blind eye”. But eventually, becoming aware of the possible extent of the losses, he decided he couldn’t continue.
“My first instinct was to resign,” he says, “but my wife implored me to say something. For the first time, I sought advice from a colleague I respected outside my team. He made me realise I really had no choice, and he gave me confidence that this time something would be done.”
Gentilin approached the same senior leader, who this time had to act, and also told a supportive colleague in his own team what he had done. Within days, another bank analyst also discovered the losses were even larger than thought — ultimately $360m.
The incident became a defining moment in NAB’s history, resulting in it losing its mantle as the nation’s biggest bank. But despite the fallout, including appearing as a witness in the subsequent court cases, Gentilin remained at the NAB for a further 12 years, going on to lead a FX institutional sales desk before working in group strategy.
“Was I just plain lucky?” asks Gentilin, who says luck certainly played a role. To begin with, he didn’t have to face anyone remotely associated with or supportive of the conduct — all either resigned or were dismissed. Any risk of retaliation was minimised.
“Also, the senior leaders at NAB strove to support the whistleblowers. My identity was never publicly revealed by the company — only when the media got their hands on court documents. Most crucially, leaders and peers in my own teams continued to support me, refusing to label me as used goods. Instead, they kept seeing potential and providing opportunities. Even if I was lucky, there’s no reason the support I received couldn’t be part of a planned response. My experience proves organisational justice, ethical leadership and peer support can and do work. The challenge is for organisations to ensure these are not left to chance, and to establish processes to ensure they’re in place before and when they’re required.”
Source: Whistling While They Work 2: Improving managerial responses to whistleblowing in public and private sector organisations. The researchers asked 118 Australian board directors whether their board should receive information on whistleblowing cases. The majority (60 per cent) agreed such information should be received by the board through regular reporting on all cases – not simply ‘specific cases that seem likely to have serious consequences’. However, only 36 per cent indicated that management currently provided such information and only 29 per cent indicated a board committee was active in overseeing the program.