Whistleblowing, speak up culture, and the board

Trust and accountability are among an organisation’s greatest assets, and key components of the relationship it has with its stakeholders. Trust is earned through consistent behaviour and actions, and when this trust is lost through poor management or misconduct, it takes considerable time and energy to restore.

Media interest in how organisations manage misconduct and unethical behaviour has been heightened in recent times with high profile instances including Volkswagen, Barclays Bank, Wells Fargo and Kobe Steel dominating international headlines in 2017. Australia’s Royal Commission into Misconduct in the Banking, Superannuation and Financial Services Industry was established in late 2017 after concerns were raised by MPs, whistleblowers, and consumer groups. And the Australian Prudential Regulation Authority (APRA) inquiry into the Commonwealth Bank of Australia (CBA) found “CBA’s governance, culture and accountability frameworks and practices are in need of considerable improvement”. Closer to home, the Ministry of Transport, the Human Rights Commission, and the legal profession have all come under scrutiny over the past year.

The board sets the tone for ethical conduct by reinforcing and communicating a culture of speaking up, and holding management to account on transparency and accountability on ethical behaviour. Whistleblowing policies and Speak Up provisions help promote and support an ethical workplace culture.

However, according to research by Griffith University in Australia, 30% of New Zealand’s public sector agencies have no system in place for recording and tracking concerns, and 23% have no support strategy for staff. The 2017 IoD/ASB Director Sentiment Survey found that only 32% of boards had discussed whistleblowing and Speak Up provisions in the previous 12 months.

This article explores whistleblowing and Speak Up arrangements, and the board’s role in ensuring ethical conduct in the organisations they govern.

What is whistleblowing?

Whistleblowing is when an employee (or former employee), contractor, volunteer or supplier goes outside the regular management avenues to report suspected illegal or unethical information or activities in an organisation. Alleged wrongdoings include misconduct and issues of public interest. Reporting may occur through an internal channel, such as a Speak Up hotline, or to an external agency, such as a regulator.

Protected Disclosure Act 2000

The Protected Disclosures Act 2000 (PDA), currently under review, facilitates the disclosure of serious wrongdoing in and by organisations and protects those who make such disclosures. Serious wrongdoing includes:

• unlawful, corrupt or irregular use of funds or resources of a public sector agency
• conduct that poses a serious risk to health and safety
• damage to the environment
• unlawful or illegal conduct by an individual or organisation
• covering up wrongdoing
• any criminal offence. Protected disclosures must generally be made in accordance with an organisation’s internal procedures. However, they can be made to an appropriate authority (defined in the Act) in certain circumstances.

Under review

The State Services Commission is leading a review of the Protected Disclosures Act 2000 to ensure it is fit for purpose and in line with international practice. The review aims to identify limitations in the current Act, evaluating areas such as the serious wrongdoing threshold, external reporting channels, and standards for organisational procedures. The IoD, with other relevant stakeholders, attended a workshop with the Commission earlier in 2018 to discuss key issues with the current regime and look at potential areas of reform and how to build public confidence in the integrity of government and business in New Zealand. We will continue to monitor this matter, and update members on developments.

Directors should ensure their organisation has a policy on protected disclosures for both employees and contractors. The policy should be communicated to all workers and incorporated into their contracts. For more information, visit the website of the Ombudsman.

Don’t get caught out by serious wrong doing in the workplace – insights from the Chief Ombudsman 

Peter Boshier is Chief Ombudsman for New Zealand. He was appointed in December 2015 following a distinguished career as a Judge. As Chief Ombudsman, Peter’s focus has been on a faster and more effective resolution of Official Information Act and other complaints, working with government agencies to improve their practices and strengthening his team’s investigation and monitoring of prisons and public mental health facilities.

Peter is concerned many directors and senior managers in the private sector are putting themselves at risk because they haven’t put policies and procedures in place to protect whistleblowers. “When this issue arises in the media, it is the action or inaction of people within government departments that tends to hit the headlines”, Peter explains, “but the whistleblowing law, known officially as the Protected Disclosures Act, doesn’t just apply to the public sector. It covers anyone in the workforce who wants to raise issues of series wrongdoing.”

He advises that employees from both the public and private sector can seek advice from the Office of the Ombudsman. The Office is also an appropriate authority, for them to make disclosures and, in the case of public sector issues, investigate them.

He encourages directors to consider four key points:

1. Have a policy, make it accessible, and talk about it frequently. Make sure your staff know how to speak up, and what will happen if they do.
2. Develop a strategy for supporting staff who blow the whistle. If someone does make a disclosure within your organisation, consider the risks they face from speaking out and take appropriate action. Keep them informed – ‘check in’ with them, and make sure they are not mistreated in any way for making the disclosure.
3. Make sure whistleblower confidentiality is maintained in accordance with the Act.
4. Finally, recognise the value to your organisation of a culture that encourages speaking up.

What is Speak Up? 

Whereas whistleblowing suggests wrongdoing has already occurred, a culture of speaking up about concerns within an organisation is an early warning system for potential issues. Having a clear policy and procedure for reporting concerns and potential misconduct is an important first step. However, encouraging employees to speak up without safe and effective organisational systems for response in place, may place those employees and the organisation at risk. It is crucial that employees can speak up without fear of recrimination.

The effectiveness of any Speak Up arrangements relies on:

• robust and consistent response systems that build trust with appropriate recording and follow-up activities, and
• the operational independence of those who receive and investigate employee concerns, and the board’s willingness to safeguard that independence.

Directors need to be attentive and informed about organisational matters, and they play a crucial role in developing and maintaining a culture of speaking up. It is critical that the board monitors Speak Up arrangements and provides oversight of how the provisions are working within the organisation, including reviewing how employees may raise a concern and how the organisation responds to concerns raised.

Ways boards can make Speak Up more effective

• Offer a variety of Speak Up channels – these channels should vary in terms of formality and confidentiality. Providing a combination of channels through which employees can voice a concern including different key people (internal or external) and different interfaces (face-to-face, telephone, internet/intranet) allows channels to compensate for each other’s limitations. Include channels for asking about integrity related questions without making an allegation or to get advice on how to raise a concern. One of these channels may be an appointed director. The board needs to reinforce that responding to concerns is part of management’s role.
• Be responsive – effective Speak Up arrangements involve robust systems to respond to concerns. This can increase trust in the effectiveness of the Speak Up arrangement and can be a valuable opportunity for positively changing collective understanding and behaviour. Responsiveness needs to be well organised, clearly mandated, and adequately resourced. Follow through is crucial for developing trust. Different functions (ie HR and compliance) owning aspects of the Speak Up arrangements can set the ‘tone’ and encourage employees to voice concerns.
• Make responses visible where possible – where an organisation shares appropriate information with employees on how it responds to concerns, this enhances employee trust. Directors need to consider how and what the organisation can communicate most effectively to employees about the outcomes of investigations. There can be challenges, eg anonymity of those raising concerns, legal issues as to what information may be shared and, often, there may be invisibility of sanctions imposed. Directors may need to explore what works in their organisation.
• Concerns received may not be strictly considered Speak Up or whistleblowing cases – while some concerns may initially appear to be individual grievances or even trivial, they may nonetheless help the organisation recognise previously unidentified risks. Directors need to have a clear view on the organisation’s strategic and operational risks and how these are managed. Employee concerns can help assess these risks and assist in risk management. Information coming via the Speak Up channels can act as an indicator of a wide range of employee concerns, eg health and safety concerns, such that you may be able to identify and tackle risks at an early stage.
• Analyse the data in ethical reporting – it is essential to receive regular reports from managers responsible for Speak Up arrangements and, where appropriate, discussing the data and analysing for pattern recognition, ie concerns that couldn’t be investigated (not enough information or not substantial enough) where concerns might be symptomatic of a deeper or growing risk. Differences between departments or regions in the types of concern raised, as well as preferred Speak Up channels, can give insights on the Speak Up environment and guide the board’s efforts to improving specific aspects of the arrangements. In the 2017 IoD/ASB Director Sentiment Survey, just 44% of directors had assessed ethics risks in their organisations in the previous 12 months, and 40% had received comprehensive reporting from management on ethical matters, conduct incidents and the actions taken to address them.
• Consider publicly reporting statistics – organisations might be hesitant about publicly reporting numbers from their Speak Up arrangements, however increased transparency could be a potential source of credibility in the eyes of stakeholders. Whistleblowing information can be shared in the public domain once it has been anonymised and aggregated. This will help develop better understanding of effective Speak Up arrangements.

Person barriers to speaking up	Organisational barriers to internal reporting
Fear of reprisal/retaliation	Hostile or unethical organisational culture
Lack of awareness that the behaviour is wrong	Unavailable resources (multiple channels for reporting)
Lack of self-efficiency (confidence/ability to speak up)	Toxic leadership
Concern that nothing will be done	Lack of organisational justice

Thought point 

Retaliation against employees who speak up about a compliance or ethics issue in the workplace comes in many forms. Research shows they experience negative consequences around 80% of the time, including harassment or bullying, job reassignment, demotion, relocation, disciplinary actions, or dismissal. Monitoring long-term data of indicators on career success of those who do Speak Up, ie pay raises or bonuses, annual review ratings, overtime allocation, job reassignment or exit interviews, can help the board identify any possible retaliation.

Role of culture and ethics

Speak Up and whistleblowing policies are important parts of a healthy organisational culture where asking questions, admitting mistakes and raising concerns is valued. These policies are more effective as part of an overall ethics programme, where core organisational values form a framework that informs employee decision-making and behaviour. The board is responsible for establishing and role-modelling an ethics based culture, while an organisation’s leadership embeds those ethics into decisions, processes and operations that protect and incentivise speaking up.

“The starting point for this is the articulation of a set of values reflecting what the organisation stands for and voluntarily aspires to, beyond compliance with the law and regulations. These values are typically expressed in an ethics policy and guidance is provided to employees through a Code of Ethics or similar. They should guide decision making and norms of behaviour.

An ethics programme to embed these values will, as a minimum, consist of training and communication activities. In addition, mechanisms to support high ethical standards will be needed – such as for raising concerns and reporting misconduct and including ethical criteria in recruitment and in performance appraisals, and detailed policies such as Discrimination, Procurement, Bribery and Corruption, Gifts and Hospitality and Conflicts of Interest. Finally, an assurance process must be in place to monitor the effectiveness of the programme and the extent to which the organisation lives up to its values.”

Code of ethics/conduct

The FMA’s Corporate governance in New Zealand: Principles and guidelines (2018) and the NZX Corporate Governance Code (2017) require that a company adopt a written code of ethics with clearly communicated expectations around ethical decision making and personal behaviour, including adhering to whistleblowing procedures and support from management and the board in responding to whistleblowing.

The IoD’s Code of Practice section 3.1 recommends directors encourage the adoption of a Code of Conduct as a foundation for ethical behaviour within the company.

Role of internal audit

Jeff Galt, from the Institute of Internal Auditors, highlights how internal audit can be a key line of defence for directors having to deal with multiple forms of risk. It can be a valuable resource to management and the board for ensuring effective code of business conduct and ethics programmes, and assessing culture, ethics and Speak Up programmes. Internal auditors are often well-positioned to handle sensitive information competently and objectively and to report on significant cultural and ethical risks.

As an independent, objective function, internal audit can be well placed to administer Speak Up channels. This includes receiving and investigating whistleblowing incidents, and escalating to the appropriate authority, such as the audit committee and board, and external authorities where accusations are more serious. Internal audit can also provide assurance on the effectiveness of Speak Up programmes, which can be a reflection of organisational culture and ethics.

Questions for the board

Is the organisation clear about what it defines as speaking up/whistleblowing? For example, it may not be employment issues.

• Does the board have a broad oversight of the Speak Up programme? Is there a framework for deciding how to deal with issues that arise?
• Are the Speak Up channels effectively resourced and actively promoted by senior management – programme awareness, training, annual reinforcement?
• Are systems or safeguards in place to protect the anonymity of the complainant and are they appropriately supported, protected and informed on progress? Is the organisation meeting its obligations with respect to the Protected Disclosure Act?
• What is the role of internal audit in relation to the assessment of the culture and ethics of the organisation? Are employee asked if they can, and do, speak up and raise issues?