Handling a whistleblower report under the Corporations Act: an investigation guide

A whistleblower report is a legal event before it is an investigation. The Corporations Act gives eligible whistleblowers strong protections, requires public companies and large proprietary companies to have a policy, and makes breaching a discloser's confidentiality or causing them detriment a criminal offence. Getting the process right is as important as getting the answer right.

Is it a protected disclosure?

Most reports from current or former employees, officers, contractors, suppliers and their relatives about misconduct, an improper state of affairs, or breaches of corporations or financial services law will qualify. The disclosure must be made to an eligible recipient: a director, senior manager, auditor, actuary, or a person your policy names. Decide the question early and document the reasoning, because the protections attach from that point.

Confidentiality is absolute

The discloser's identity, and information likely to reveal it, cannot be shared without their consent except with ASIC, APRA, the AFP or a lawyer. In practice this means the investigation is designed so that the subject and most colleagues never learn who reported. Interview questions, document requests and the report itself are written with that in mind.

Protect from detriment

Dismissal, demotion, harassment, a changed roster or being frozen out are all detriment. The company is liable if it happens because of the disclosure, even at the hands of a colleague. A practical step is to nominate a protection officer separate from the investigator, who checks in with the discloser and acts on any concern.

Investigate proportionately

The investigation should be as thorough as the allegation warrants and no more intrusive than necessary. Preserve records first. Review documents and data before interviewing anyone. Interview witnesses before the subject. Keep the subject's rights in view: they are told the substance of what is alleged, given a fair chance to respond, and allowed a support person. Findings are made on the balance of probabilities and expressed as findings, not conclusions of guilt.

Independence

Where the allegation touches senior people, or the people who would normally investigate, an external investigator is the only credible option. Boards increasingly want to be able to show ASIC that the investigation was independent, competent and documented.

Report back

Whistleblowers are entitled to know, in general terms, that their report was received, is being looked at, and has concluded. They are not entitled to the findings. A short written update at each stage is both good practice and a strong defence against a later complaint.

What draws regulator attention

• No policy, or a policy nobody follows.
• The discloser's name in an email to the subject's manager.
• An investigation run by the person complained about, or their close colleague.
• Findings written to a predetermined conclusion.
• Silence toward the discloser for months.

Valitros conducts independent whistleblower investigations for boards and audit committees, directly or through counsel, with the confidentiality and fairness the Act requires. See the service or book a confidential call.