Whistleblowing Procedures and Worker Protection
Whistleblowing in Brief
- Public Interest Disclosure Act 1998 protects qualifying disclosures
- Workers know how to raise concerns and what counts as protected
- Concerns investigated and acted on without retaliation
Whistleblowing
Whistleblowing is the term for a worker raising a concern about wrongdoing, risk or malpractice within the organisation. It is different from a grievance, which is about how the worker themselves is being treated. Whistleblowing is about issues that affect others - the organisation, its customers, the public, or a particular interest like safety, legal compliance or financial integrity.
A clear whistleblowing policy makes it easier for concerns to come to light. Without one, problems tend to stay hidden until they are serious. With one, the organisation has a chance to investigate and put things right before they escalate.
The Legal Framework for Whistleblowing
In the UK, whistleblowing is protected by the Public Interest Disclosure Act 1998, which amended the Employment Rights Act 1996. The Act protects workers from dismissal or detriment where they make a qualifying disclosure in the public interest. Qualifying disclosures typically include concerns about:
- A criminal offence.
- A breach of a legal obligation.
- A miscarriage of justice.
- A risk to health and safety.
- Damage to the environment.
- The deliberate concealment of any of the above.
For the protection to apply, the worker must have a reasonable belief that the disclosure is in the public interest and, broadly, that the information tends to show one of the categories listed above. Other jurisdictions have their own whistleblower protection laws, and some sectors (financial services in particular) have sector-specific obligations.
What a Whistleblowing Policy Covers
A good whistleblowing policy sets out clearly:
- What the policy is for and what kinds of concern it covers.
- The difference between a whistleblowing concern and a grievance, with a pointer to the grievance procedure for personal issues.
- Who the concern can be raised with - typically a named manager, a senior figure outside the worker line of management, or an external third party.
- How concerns will be investigated and by whom.
- The protection the worker has from retaliation.
- The option to raise the concern anonymously where the organisation offers this.
- External routes (such as regulators or prescribed bodies) the worker can use if internal routes are not appropriate.
The policy should be visible, not buried. Staff handbooks, induction, and ongoing awareness all help make sure people know the policy exists and how to use it.
Handling a Whistleblowing Concern
When a concern is raised, it needs to be handled seriously and in line with the policy. Typical steps include acknowledging the concern, deciding who should investigate (ideally someone independent of the issue), gathering information, reaching a conclusion, taking any corrective action, and feeding back to the worker where possible without compromising confidentiality.
Retaliation against a worker who has raised a concern in good faith must not happen, and disciplinary action should follow if it does. Even unintentional detriment (being excluded from meetings, being overlooked for promotion, change of duties) can amount to retaliation in law.
Whistleblowing and the Management System
Whistleblowing is not directly required by ISO 9001 or ISO 45001, but it is called out by ISO 37001 (anti-bribery) which specifically requires a reporting mechanism for bribery concerns. More broadly, whistleblowing feeds into the management system as a source of early warning - concerns about non-conformity, unsafe practices, environmental harm or compliance failures can all come through this route, and the investigation and outcome should flow into the relevant corrective action process.
Patterns in whistleblowing concerns (particularly recurring themes) are a useful input to management review.
Whistleblowing is often seen as a tick-box policy. It should not be. A well-used whistleblowing process is one of the best sources of genuine information about what is going wrong in an organisation, often before the more formal monitoring and audit routes pick it up.
Under ISO 37001, a confidential reporting channel for bribery concerns is mandatory, not optional. Other standards do not prescribe one but treat whistleblowing as part of the leadership and governance environment.
When auditing I look for evidence the whistleblowing process is actually available and used. A policy on the shared drive with no record of any concerns ever raised, in an organisation of any size, usually tells me people either do not know it exists or do not trust it. Either is a problem.
We have a whistleblowing policy, a named contact, and an external independent line people can use if they would rather not raise something internally. We also make a point of mentioning it at induction and annually. If people do not know it exists, they do not use it.
Whistleblowing is not snitching, and it is not disloyalty. It is a legally protected way for workers to raise serious concerns. Make the policy clear, make the route easy, protect the person who uses it, and investigate properly. That is most of what is needed.
Practical Compliance Guidance
Section 3.1 of the IMS1 IMS Manual covers the management of staff, with whistleblowing forming part of the arrangements for raising concerns about wrongdoing or serious risk.
Several alphaZ documents support whistleblowing arrangements:
| alphaZ document | How to use it |
|---|---|
| ISO 9001, 14001 & 45001 IMS Toolkit | The complete toolkit for an integrated management system covering quality, environment and health and safety. |
| P-14 Whistleblowing Policy | Policy covering the organisation approach to whistleblowing, including how to raise concerns and how they will be handled. |
| P-58 Grievance Policy | Policy covering the grievance procedure, which is separate from but complementary to the whistleblowing route. |
| GEN1-1 General Staff Handbook | Consolidated staff handbook covering the main company policies and raising staff awareness of the whistleblowing process. |
Note - all the above files can be downloaded with an alphaZ subscription.
Frequently Asked Questions
UK Legislation
The following UK legislation is relevant to whistleblowing. Organisations outside the UK should identify the equivalent legislation applicable in their jurisdiction.
- Public Interest Disclosure Act 1998
- Employment Rights Act 1996
- Enterprise and Regulatory Reform Act 2013
