Whistleblowers across financial services, healthcare, the Post Office and in a recent example, within a regulator, have believed themselves to be the exception and the outsider. With deeply troubling consequences.
Whistleblowing remains widely misunderstood. Charlotte Hall, CEO of the charity, UK Whistleblowing, says that “most people assume there has to be a formal recognition of a reported incident for it to be treated as whistleblowing, attracting the relevant protections for the employee, but this is not the case”. The Public Information and Disclosure Act principles protect any individual when they raise genuine concerns that are in the public interest i.e. concerns that may affect others.
Unfortunately, all too often whistleblowers do not receive the protections and support they deserve.
A typical situation might play out as follows:
- An individual experiences, witnesses or suspects wrongdoing of some form and raises their concern.
- The concern escalates to a whistleblowing champion who may be formally or informally appointed.
- Triage occurs, involving HR and legal representatives, potentially triggering legal privilege principles.
- An investigation is initiated, generally with legal oversight: Internal Audit may be asked to be directly involved.
- The whistleblower is interviewed, as well as witnesses and others who may be within a similar team or function, creating inevitable tensions.
- A report is produced with a conclusion delivered. Where there are corporate failings or weaknesses, it is not uncommon for key findings in the investigation report to be retracted or obscured based on assumed commercial sensitivity, using the principles of legal privilege.
- Sadly, the whistleblower will often feel they cannot remain in the organisation. The discussion becomes an employment issue concerning the whistleblower, rather than a discussion around the underlying circumstances and issues (which may also have been excluded from the scope of the report). The whistleblower accepts a small settlement and signs a Non-Disclosure Agreement.
- The organisation, and its directors, will be relieved that a potentially embarrassing and reputationally damaging situation has been avoided. Some effort is made to implement changes but many of the issues are not addressed because of redactions or limitations in the scope of the investigation.
Unfortunately, this means the underlying issues are frequently not resolved with implications for a wide range of stakeholders.
The opportunity Internal Audit provides
What role might Internal Audit play in ensuring these risks are addressed?
- Audit the channels available for whistleblowing and informal feedback. Exit interviews should be conducted for example, with notes taken.
- Analyse trends in settlement agreements and HR claims. Obtain (anonymous) details of the factors behind settlement agreements and outstanding HR claims as part of the annual planning process. Even on a no-name basis they will be instructive in identifying why issues and concerns were raised.
- Understand the application of legal privilege during investigations. Is it being applied only in situations of commercial sensitivity where information might be of interest to competitors for example? Internal auditors have the right to discuss the issues and to see relevant information.
- Legal and HR functions are not infallible. Both functions are second line, meaning that it is within Internal Audit’s remit to consider their role in monitoring and mitigating organisation-wide risks.
Be brave! Embrace the complexity and sensitivity of whistleblowing issues. The consequences of not acknowledging and considering matters that are being raised can be tragic. If you overlook warning signs to prevent future harm, it will live with you.