Whistleblowing policy and process – what you need to know

Companies preparing for the commencement of the Protected Disclosures (Amendment) Act 2022 in the New Year will need to overhaul whistleblowing policies and processes, but the effort will bring clear benefits, writes Gráinne Madden

Encouraging people in an organisation to speak up about their concerns should be a no-brainer. Why would an organisation not want to know about a potential risk? Why would an organisation want an employee to feel the need to go to an external body, such as a regulator or the media, to highlight internal problems?

International research repeatedly reinforces that there are two main reasons why people fail to speak up about their suspicions of wrongdoing. First, there is the fear of retaliation. Current Irish and UK law is seeking to address this by offering protection.

The second reason people fail to speak up about their suspicions of wrongdoing in an organisation is fear of futility. This is the fear that nothing will be done, even if they do speak up—and this is why having clear policies and processes in place is so important. 
The absence of a whistleblowing policy and process in an organisation will certainly send the message that the organisation does not really want to hear about any problematic issues that may exist or arise. 

As it stands, in Ireland and the UK, workers are entitled to legal protection against dismissal, or other reprisal from their employer or colleagues, when disclosing concerns about certain issues. Until now, however—except in certain sector-specific areas—most organisations have not been required to put a whistleblowing policy or procedures in place, or to follow up on such disclosures. 

The EU Whistleblowing Directive will, however, bring major changes to which organisations operating in EU jurisdictions must now respond. In Ireland, the Protected Disclosures (Amendment) Act 2022 will commence on 1 January 2023, giving effect to the EU Directive.

New requirements for organisations

There are several key additional requirements that will apply to organisations under the new Act, which are considered below.

Employee thresholds

For workplaces with more than 50 employees, there will be a requirement to have formal channels and procedures for receiving and, crucially, following up on disclosures. Workplaces with between 50 and 249 employees have until December 2023 to comply, and 250-plus employee workplaces must comply at commencement. 

However, all organisations operating in certain sectors will be required to comply at commencement, even those employing fewer than 50 people. This includes: 

• public bodies;
• companies subject to EU laws in the areas of financial services, prevention of money-laundering and terrorist financing; transport safety; and
• protection of the environment (offshore oil and gas installations and operations only).

The 2022 Act states that the Minister for Public Expenditure and Reform may, by order, reduce the threshold of 50 employees for specified classes of employers, subject to a risk assessment and public consultation. 

Change of definitions and burden of proof

Under the new Act, the scope of protected persons will be extended to include non-executive members, shareholders, volunteers, and ‘pre-contractual’ employees, such as candidates applying for a job during the recruitment process before the work-based relationship even begins.

Further, retaliation will be more broadly defined. In respect of alleged detriment (be it an act or omission) caused to a person because of the making of a protected disclosure, the employer will have to prove that the detriment complained of was not in retaliation for, or because of, the person having made a protected disclosure. 

Administration and staff

Confidentiality regarding whistleblowing must be respected by all reporting systems and access to data by non-authorised staff prevented. For staff who are authorised, appropriate training must be given in respect of the handling of reports.
Finally, records must be kept of all reports, as well as ensuring follow-up and feedback regarding these reports within certain timeframes. 

Blending culture with policy

The required process management will mean that many organisations will need to implement issue management systems. Simply having a policy and process in place isn’t, however, going to be an encouragement for nervous employees. Creating a culture in which people feel safe in speaking up—and feel that their concerns are welcomed—is far more important. 

So, in addition to having a sound policy and process in place, what other steps should employers consider? Here are seven recommendations:

1. Train managers and team leads to recognise when an issue could be a protected disclosure and, most importantly, to receive reports of potential issues in a calm and welcoming way. Word can spread very quickly about managers not being open to bad news.
2. Think about how whistleblowing is discussed in the organisation and consider whether it is healthy or whether the narrative needs to be changed. Any pejorative language in connection with whistleblowing or speaking up needs to be identified and stamped out. The focus must be on recognising that people who bring risks to our attention are doing the organisation a great favour. It is worth highlighting that research demonstrates that the people who blow the whistle tend to be the most loyal employees who care greatly about the organisation.
3. Ensure that the confidentiality regime is well- communicated and respected so that employees can be confident their identity will not become known if they disclose an issue.
4. Do not become complacent if the whistleblowing policy is not used—rather than indicating a spotless organisation, it could be signalling a poor work culture where people either fear speaking up or just don’t care enough to bother.
5. Remove any ‘good faith’ requirement from policies. The focus should be on the issue reported, not the motivation of the person reporting. Furthermore, there is no ‘good faith’ obligation under Irish or UK law or the directive.
6. Make sure that penalisation is not tolerated. State this clearly in the whistleblowing and speaking-up policy, making sure there are clearly defined processes for reporting claims of penalisation and for following up on claims of penalisation.
7. Provide feedback to a discloser on any action taken in response to their disclosure. The ability to do this will depend on the nature of the issue and the rights to confidentiality of other parties. At the very least, a discloser should be reassured that their concerns have been dealt with appropriately.

It is likely that most organisations will need to overhaul their whistleblowing policies and processes in response to the Protected Disclosures (Amendment) Act 2022. The requirements may seem daunting, but help and advice on good practice is available. The benefits are clear, not just in terms of risk management and protection of brand and reputation, but also for the common good.