Whistleblowing Policies for Employers

A disclosure is protected if it is a qualifying disclosure made in the public interest. A qualifying disclosure is one that the worker reasonably believes tends to show one of six categories of wrongdoing: a criminal offence; a breach of a legal obligation; a miscarriage of justice; a danger to health and safety; damage to the environment; or the deliberate concealment of information about any of these. The worker does not have to be right — they simply need a reasonable belief. Personal grievances (such as disputes about pay or treatment) are not qualifying disclosures unless they also reveal wider wrongdoing.

The disclosure must also be made in the public interest — this does not mean it has to be publicised widely, but the worker must believe it serves some interest beyond their own. Internal disclosures to a manager or employer, and disclosures to a prescribed person (a regulator listed in legislation — including HMRC, the FCA, the HSE, and many others), attract the strongest protection. Wider disclosure (to a journalist, for example) is only protected in limited exceptional circumstances.

There is no statutory requirement for most private sector employers to have a whistleblowing policy — but the absence of one is a significant risk indicator and will weigh against an employer in any tribunal claim. A good whistleblowing policy should: set out clearly what types of concern qualify; provide multiple channels for reporting (line manager, senior manager, HR, an anonymous hotline, or an external service); guarantee confidentiality and protection from retaliation; explain how reports will be investigated; and confirm that malicious or false disclosures are not protected.

Certain regulated sectors — financial services firms regulated by the FCA, NHS bodies, and others — have mandatory requirements to have internal whistleblowing arrangements and a dedicated senior manager (a Whistleblowers' Champion). Even without a regulatory requirement, the case for a clear policy is compelling: organisations with effective internal reporting channels catch problems early, before they escalate into regulatory investigations, reputational damage, or litigation.

When a worker makes a disclosure, acknowledge it promptly and treat it seriously regardless of the source. Investigate promptly and impartially — never assign the investigation to someone implicated in the disclosure. Protect the worker's confidentiality so far as possible throughout, and consider whether interim protective measures are needed (for example, temporarily reassigning the worker if there is a risk of retaliation from colleagues).

Communicate the outcome of the investigation to the worker where it is appropriate to do so, and explain what action has been taken. Keep records of all disclosures and how they were handled. Monitor the worker's treatment following the disclosure — if they face any adverse action (redundancy selection, disciplinary proceedings, poor performance assessments), ensure there is a clear and documented business reason unconnected with the disclosure. The reputational and financial consequences of a successful whistleblowing claim — unlimited compensation including injury to feelings — make getting this right essential.