Speech by ob体育 Commissioner Sean Hughes at the 3rd Australian National Whistleblowing Symposium, Thursday 11 November 2021.
Check against delivery
I begin by acknowledging the Traditional Custodians of the lands I am on today, the Boon Wurrung and Woiwurrung people of the Kulin nation. I pay my respects to their elders past, present and emerging, and extend that respect to Aboriginal and Torres Strait Islander peoples joining the symposium today.
It is a pleasure to speak to you today and to participate in this important symposium. Conversations such as this topic are increasingly relevant.
Today I am here to provide a regulatory update on ob体育鈥檚 role as conduct regulator in corporate and financial services.
Most of you attending today are aware that the past three years have seen world-leading changes to the Australian whistleblower protection regime under the Corporations Act 2001.
What you may not realise is that as the conduct regulator of Australia鈥檚 corporate sector, ob体育 is also benefiting from those changes in terms of the amount of information on misconduct being shared with us by whistleblowers.
We are able to perform our role more effectively. We can step in and address misconduct that may cause serious harm to consumers and investors. And as a result, all Australians benefit from having increased confidence and deeper trust in a fair, strong and efficient financial system.
I will share some statistics to back that up shortly.
But first I would like to say thank you on behalf of ob体育 to the people who step forward to speak up. We know that takes a certain level of courage. And a willingness to endure a lonely process of assessment and investigation before any form of closure.
Investigating misconduct revealed by whistleblowers is just one touchpoint ob体育 has with the whistleblower protection regime. We do more than just: 1. investigate misconduct and 2. enforce breaches of the protections. We also promote and foster compliance with the whistleblower protection regime.
It is for that reason ob体育 has called on Australian CEOs 鈥� from public companies, large proprietary companies and corporate superannuation trustees 鈥� to review their whistleblower policies to ensure they comply with the law.
I have called this speech 鈥榃histleblower policies and the compliance gap鈥� because it鈥檚 the gap that matters 鈥� that is what our recent review uncovered 鈥� a gap between the legal requirements and how company policies are responding to them.
In the next 10 minutes I will briefly outline:
- the Corporations Act reforms
- the scope of ob体育鈥檚 review and our findings
- what we are asking Australian CEOs to do.
If time permits, I will also outline what ob体育 is doing to 鈥榳alk the talk鈥� on whistleblowing within our own organisation.
1. Corporations Act reforms and goals
The 2019 reforms to the Corporations Act whistleblower protection regime have not only encouraged more people to come forward, but also supported ob体育鈥檚 performance of its regulatory role.
The latest statistics speak for themselves.
- In the 2018鈥�19 financial year, (before the protections commenced), ob体育 dealt with 278 whistleblower reports.
- The following 2019鈥�20 financial year, we dealt with 644 whistleblower reports.
- In the 2020鈥�21 financial year we dealt with 817.
In other words, the immediate post reform period has witnessed an increase of 194% in reports over two years.
I acknowledge that many factors will have contributed to this 194% increase in the number of reports to ob体育. But some correlation to the law reform cannot be denied. I know we are also hearing that the reforms have encouraged reporting by whistleblowers within businesses.
These statistics relate to reports to ob体育. But we are also responsible for enforcement of the whistleblower protection regime under the Corporations Act. I would like to call out two important protections that ob体育 is responsible for enforcing:
- Protection offered by confidentiality 鈥� including protection of identity.
- Protection from harm or detriment 鈥� including from threats to cause detriment for making disclosures.
ob体育 can take action against people who breach a whistleblower鈥檚 identity. And we can also take action against people who harm or fail to prevent harm to whistleblowers. Those who suffer detriment can also separately seek compensation and other remedies.
We have current investigations underway into alleged breaches of the whistleblower protections. And we continue to assess new reports of these matters. Given the nature of our activities and the confidentiality protections in place, I will not go into any detail on individual matters.
Please know that ob体育 takes non-compliance with the whistleblower protections seriously. If you have suffered detriment for making a whistleblower disclosure or because someone thinks you have, we want to hear about your experiences. ob体育 may be able to take action against the company or individual for their detrimental actions.
2. Review of whistleblower policies
I will now turn to ob体育鈥檚 whistleblower policy review.
Since 1 January 2020, the Corporations Act has required public companies, large proprietary companies, and trustees of registrable superannuation entities to have a whistleblower policy that sets out particular matters, and to make that policy available to its officers and employees.
In November 2019, ob体育 released听Regulatory Guide 270听Whistleblower policies,听which contains guidance and good practice tips on establishing and implementing a whistleblower policy and program.
In the 2020鈥�21 financial year, we reviewed a sample of 102 whistleblower policies from entities that are subject to the requirement to have a policy. We did this to:
- understand how entities are responding to the requirements
- understand and benchmark the standard of policies across entities
- refine ob体育鈥檚 regulatory approach to the requirements.
First, the good news. Of the 102 policies we reviewed, many did meet some of the requirements set out in the Corporations Act.
We were pleased with the better practices we identified and I want to give credit where it is due before getting into the details of our findings.
Because unfortunately, the majority of policies we reviewed did not fully address the legal requirements. I will set out three of the most prevalent and concerning deficiencies we saw:
- incomplete or inaccurate information
- obsolete and out-of-date policies
- policies without oversight arrangements.
These three issues are of particular concern to ob体育 because they suggest that many entities do not fully understand the enhanced whistleblower protection regime, or worse still, have chosen to ignore them.
Incomplete or inaccurate information about the protections
Concerningly, around a third of the policies in our sample provided incomplete or inaccurate information about the protections available to whistleblowers. For example, we found policies that did not:
- mention whistleblowers can seek compensation and other remedies if they suffer harm for making a disclosure
- explain a whistleblower鈥檚 right to confidentiality
- explain that these protections are available under the law.
Understandably, if a potential whistleblower is concerned about the negative effects of making a disclosure, they may not speak up. As such, it is vital for entities to provide clear and complete information about the protections available to encourage people to come forward.
The policies that did well in this area provided information about the protections in positive terms. For example, they described how the entity would safeguard the reporter鈥檚 entitlement to the protections and how whistleblowers can enforce the protections.
Obsolete and out-of-date policies
Two in five (or 40%) of policies we reviewed did not adequately summarise the threshold criteria for whistleblowers to qualify for protection. Many included references to obsolete requirements or had not been updated to refer to the regime鈥檚 expanded scope.
This suggests those policies were not fully updated to reflect the Government鈥檚 reforms to the regime, or management simply chose to ignore them. Neither response is acceptable.
For example, we saw policies that did not fully describe who a whistleblower can report to under the law (missing from nearly half the policies we reviewed).
Instead, they tended to list only the preferred or internal channels available to whistleblowers.
Some policies encouraged whistleblowers to discuss concerns with their managers before making a report 鈥� without clarifying that those discussions may not qualify for whistleblower protections.
These procedural and policy flaws may result in potential whistleblowers not understanding how to make a disclosure that qualifies for the protections.
It is important to note that we did see policies that correctly addressed some of these issues. For example, two thirds of the policies we reviewed acknowledged that whistleblowers could disclose anonymously and qualify for protections.
We also found some policies encouraged people to use the whistleblower reporting channels for all reports, even when it is unclear if the issue raised would be covered by the legal protections. This approach preserves a person鈥檚 ability to rely on the protections.
Policies without oversight arrangements
While not legally required, we are concerned that close to a third of policies we reviewed did not state if the entity had mechanisms to monitor the effectiveness of its whistleblower policy.
This suggests there is an attitude of 鈥榮et and forget鈥�, which is not good enough.
ob体育 wants to see entities treating their whistleblower programs as an important governance function which supports robust and timely escalation of important information and cultural warning signs to an organisation鈥檚 leadership. This includes review mechanisms to monitor their effectiveness. We also encourage entities to integrate insights from their whistleblower programs with other information sources for boards to make decisions.
3. Call to action for Australian CEOs
Review your policies
Once we completed our review in October 2021 ob体育 published an open letter to CEOs of public companies, large proprietary companies and corporate superannuation trustees.
In it, we asked them to review their whistleblower policies to ensure they comply with the law.
The letter provides more information about our review and findings, and is available for anyone to read on the ob体育 website.
You can read the letter in more detail to see where the policies in our sample fell short, and what entities can do to improve.
Of course, since the release of our whistleblower policy guidance in 2019, the COVID-19 pandemic has created multiple challenges for entities to address.
But (touch wood) now that we appear to be emerging from the worst of the pandemic, ob体育 wants to remind CEOs and executives about these important issues.
In the new year we will continue to monitor compliance and we are planning another review of whistleblower policies in the future. If we identify non-compliance, ob体育 will draw upon the full suite of regulatory tools we have available to us, which includes enforcement action.
Review your internal systems and processes
To ensure the whistleblower protections are embedded, ob体育 considers it essential for a company to have effective internal systems and processes to handle disclosures in line with its whistleblower policy.
Courts can consider whether a company鈥檚 whistleblower policy has been effectively implemented when deciding on compensation claims for whistleblowers who may have suffered for speaking out.
Significantly, one of our priorities in the coming year is to review whistleblower programs from a sample of regulated entities to see how practices are evolving to address the reforms. With a corporate governance lens, we want to look at:
- how entities are handling whistleblower disclosures
- how entities use the information from disclosures to address issues or misconduct or change their operations
- the level of board and executive oversight of whistleblower programs.
4. Walk the talk: ob体育鈥檚 approach to whistleblowing
Before I conclude I will briefly mention ob体育鈥檚 own approach to detecting and responding to concerns internally.
We are actively fostering an environment where people feel confident to speak up about wrongdoing. Commissioners, as well as our executives and senior leaders, strive to ensure our people know that we value the information they provide.
We have a range of formal and informal reporting mechanisms for our people to raise different issues. This includes our Public Interest Disclosure Policy and Procedures, governed by the Public Interest Disclosure Act 2013, which was discussed at this symposium earlier today.
We recently launched a new reporting platform to complement our existing reporting mechanisms. The new platform provides a channel for our people to easily lodge public interest disclosure reports, or other reports about integrity-related matters. It also makes it easier for those who want to raise issues anonymously to do that, and to remain anonymous throughout the assessment and investigation process.
We think this sends a clear message within our organisation that we genuinely want to hear about issues. We hope it encourages more people to speak up.
Our program is not limited to reporting mechanisms. We have processes and resources to ensure our people have confidence that:
- matters they raise will be looked into confidentially
- we will protect them from retaliation
- they will be treated fairly, professionally and respectfully.
We also have internal escalation and reporting mechanisms designed to ensure that not only do we address immediate issues arising from reports, we also use the information we receive to identify trends and address emerging risks before they become systemic.
Our program has evolved over time and we will continue to try to improve it within the confines of our operating and legal environment.
Conclusion
After the community health and safety challenges of the past 18 months and the economic crisis surrounding them, it would have been tempting for entities and their senior management to treat the 2019 reforms 鈥� and indeed the whole whistleblower program of work as a 鈥渘ice to have鈥� which could be postponed to more benign times. But despite that pressure, I believe Australia鈥檚 corporate sector whistleblower regime is moving in the right direction.
In particular, I am positive about the changes we have seen in the past three years.
Once companies have caught up to the new requirements I believe we will see even greater benefits to the health and sustainability of the culture within Australia鈥檚 corporate sector.
I am looking forward to hearing more about the recently published ISO 37002 Guidelines for Whistleblowing management systems from some of the ISO Working Group members this afternoon. ob体育 may consider some of the broader practical guidance in these guidelines in our next review.
We are also monitoring developments in the European Union. I am keen to see what we can learn from observing how each EU member state implements the standards in the Whistleblower Protection Directive () on the protection of persons who report breaches of Union law by the end of this year.
This local and international activity points to the fact that laws and standards on protection are moving positively and consistent with the overall policy intent. We just need to bring companies along with us. Strong whistleblower systems, processes and procedures are 鈥� and always will be 鈥� a vital element of good corporate culture.
Consistent with our role in promoting increased confidence in a fair, strong and efficient financial system, ob体育 will continue to advocate for whistleblower programs which place at their heart trust, impartiality and protection. With the increased transparency and earlier risk identification and harm prevention arising from an effective regime, we can all have greater confidence 鈥� and with that confidence 鈥� support the recovery of our community and economy.
Thank you.