Who’d be a whistleblower?

“Nothing is confidential,” says a risk manager from a major global corporate, speaking to StrategicRISK about his company’s whistleblower programme.

His admission brings into sharp focus the fears the many employees face when considering whether to report unethical or unlawful behaviour at their company.

Take Sally McDow as an example. The former senior compliance manager at Australia’s Origin Energy alleges that the company has serious compliance failures at its gas and oil fields, a culture of leaks, spills and explosions, and a habit of intimidating anyone brave enough to speak out.

Her claim will be heard in the Federal Court, in the first ever case to test whistleblower protections in Australia.

Like many whistleblowers, McDow paints a distressing picture of her treatment. She claims management told staff she was being investigated and had “made stuff up”. She further alleges that a recruiter told her she was unemployable in Brisbane as a “known” whistleblower, and that she should change her name or move country.

Sadly, it seems failures in company whistleblowing programmes are not uncommon.

In a StrategicRISK survey of its Asia-Pacific Advisory Panel, 15% of respondents said their company’s whistleblowing scheme was ineffective.

“More often than not, the identity will be revealed and shared among top management,” one respondent said.

Another remarked: “In Asian culture, employees are not keen to make such complaints for fear that they be ‘marked’ by colleagues as a ‘bad person’.”

To prevent whistleblowers from being victimised, protection needs to be guaranteed and a culture of transparency and accountability must be promoted. But how can a firm ensure its whistleblowing programme is effctive, particularly when operating across multiple jurisdictions?

Lauren Witherdin, a director in KPMG Australia’s forensic service, says it’s important to consider any whistleblower programme as part of a holistic fraud and corruption control strategy.

“The key message around a whistleblower programme that’s effective is allowing employees to have a range of different channels by which they can provide information – and then, at the same time, having a culture within the organisation that really supports speaking out, and whereby there’s trust that the senior management will respond appropriately and take matters seriously,” she says.

GPT Group chief risk offcer Diona Rae says there are inherent diffculties in evaluating the effectiveness of a whistleblowing programme.

“If [there is] no use of the programme, does that mean [it is] ineffective or just no issues? We have used our annual staff survey to ask questions around confidence in the service, willingness to use it, etc.”

The results of the survey are yet to be published, but it’s worth asking what might dissuade some employees from using a whistleblower hotline.

Rae says: “They need to have a level of trust in the whistleblower officer, the policy, and indeed the organisation. It comes down to whether they believe the organisation will follow the process.”

Astro Overseas vice president, enterprise risk management, Patrick Abdullah agrees.

He says “the risk that confidentiality of the whistleblower is not maintained, and the whistleblower being subject to harassment or victimisation” would dissuade someone from using the company’s service.

One can only speculate whether, with the benefit of hindsight, McDow would have used Origin’s whistleblowing programme.

PIECEMEAL APPROACH

Legal protection for whistleblowers also varies greatly from country to country.

According to a 2015 DLA Piper report, Japan and China are taking the lead in Asia-Pacific, with express legislative provisions outlawing detrimental treatment of workers who blow the whistle.

Hong Kong offers no statutory protection; Australia does, but at present only through a series of general laws.

“Australia’s piecemeal and limited approach to whistleblowers to date is out of step with the approaches adopted in a number of our larger trading partners, including the protections afforded to whistleblowers in the United Kingdom, the USA, Japan and China,” DLA Piper employment partner Brett Feltham says.

This could change, though, since the Federal Government announced in its 2016-17 budget the introduction of arrangements to better protect whistleblowers, and a series of parliamentary hearings set for the first half of this year.

When the legislation is inadequate, how can companies ensure the anonymity of their whistleblowing programme?

One approach is to contract out the service to a consultancy. KPMG said 80% of its whistleblower reports over the past 12 months had elected to be anonymous.

Challenges remain, however.

A risk manager whose company uses KPMG’s FairCall whistleblower service said: “If people know that the tip has come from a whistleblower, there will be an internal hunt to find out who it is. For that reason, I now won’t tell management that the report came from FairCall, just that the issue came up in our regular auditing process.”

An ineffective whistleblower programme should also trouble company directors and officers.

Feltham says that even where a programme is legally compliant, it may still fail to bring up internal issues.

“A programme which is ineffective in this way may potentially expose a company to corporate disaster, whether through substantial financial loss, product associated flaws/risks and/or reputational damage which could have otherwise been avoided,” he says. “If those situations arise, then directors may themselves be held accountable for those events.”

Another challenge for corporates is adopting a consistent global approach that accommodates di erences in legislation and culture. In China and the US, for example, legislation provides financial incentives or bounties to the whistleblower if their allegations hold water. Employees in China are also obliged – by law – to report any suspected criminal wrongdoings.

Similarly, a multi-jurisdictional footprint may introduce diffculties in terms of the response, both from a language and logistical perspective.

“If you’ve got matters coming in from all around the world, you need to be able to very quickly and efficiently respond within 24 hours,” KPMG’s Witherdin says. “That may mean mobilising on-the-ground investigation and legal services pretty quickly.”

A perennial risk is that the hotline receives vexatious or frivolous reports.

“The important thing is to have the right triaging procedures in place to make sure that management time can be focused on the important and serious matters that are genuine,” Witherdin says.

What is plain is that vast improvements need to be made across the board to improve whistleblower protections and corporate governance.