Every employer faces the risk that something will go badly wrong in their organisation and ought to welcome the opportunity to address it as early as possible. Whenever such a situation arises, the first people to know of such a risk will usually be those who work in the organisation. Yet while these are the people best placed to speak up (known as “whistleblowing”) before damage is done, they often have the most to lose if they do.
A whistleblowing system is a formally established set of mechanisms for employees and other stakeholders to raise concerns within or outside normal management channels. Whistleblowing arrangements are a vital component of good governance and risk management in any organisation or industry. Effective whistleblowing can ensure that disaster is averted, costly legal claims are avoided and reputation is preserved. Benefits go beyond detecting wrongdoing and include deterring malpractice and improving standards and quality. A responsible approach to whistleblowing also helps organisation to promote a healthy workplace culture built on openness and accountability.
A Code of Practice (CoP) has been developed by the Whistleblowing Commission. The CoP provides practical guidance to employers, workers and their representatives and sets out recommendations for raising, handling, training and reviewing whistleblowing in the workplace. This code has been referred to by the Financial Conduct Authority and Prudential Regulation Authority in the guidance for the new rules on whistleblowing arrangements for deposit takers and banks.
The contents of the CoP are as follows:
- As part of the whistleblowing arrangements, there should be written procedures covering the raising and handling of concerns. These procedures should be clear, readily available, well-publicised and easily understandable.
- The written procedures for raising and handling concerns:
- should identify the types of concerns to which the procedure relates, giving examples relevant to the employer;
- should include a list of the persons and bodies with whom workers can raise concerns, this list should be sufficiently broad to permit the worker, according to the circumstances, to raise concerns with:
- the worker’s line manager;
- more senior managers;
- an identified senior executive and /or board member; and
- relevant external organisations (such as regulators);
- should require an assurance to be given to the worker that he/she will not suffer detriment for having raised a concern, unless it is later proved that the information provided by the worker was false to his or her knowledge;
- should require an assurance to be given to the worker that his or her identity will be kept confidential if the worker so requests unless disclosure is required by law;
- should require that a worker raising a concern:
- be told how and by whom the concern will be handled;
- be given an estimate of how long the investigation will take;
- be told, where appropriate, the outcome of the investigation 
- be told that if the worker believes that he/she is suffering a detriment for having raised a concern, he/she should report this; and
- be told that he/she is entitled to independent advice.
- The employer should not only comply with these procedures but should also sanction those who subject an individual to detriment because he/she has raised a concern and should inform all workers accordingly.
- In addition to the written procedure for raising and handling concerns, the employer should:
- identify how and when concerns should be recorded;
- ensure, through training at all levels, the effective implementation of the whistleblowing arrangements;
- identify the person with overall responsibility for the effective implementation of the whistleblowing arrangements;
- conduct periodic audits of the effectiveness of the whistleblowing arrangements, to include at least:
- a record of the number and types of concerns raised and the outcomes of investigations;
- feedback from individuals who have used the arrangements;
- any complaints of victimisation;
- any complaints of failures to maintain confidentiality;
- a review of other existing reporting mechanisms, such as fraud, incident reporting or health and safety reports;
- a review of other adverse incidents that could have been identified by staff (e.g. consumer complaints, publicity or wrongdoing identified by third parties);
- a review of any relevant litigation; and
- a review of staff awareness, trust and confidence in the arrangements.
- make provision for the independent oversight and review of the whistleblowing arrangements by the Board, the Audit or Risk Committee or equivalent body. This body should set the terms of reference for the periodic audits set out in 7(d) and should review the reports.
- Where an organisation publishes an annual report, that report should include information about the effectiveness of the whistleblowing arrangements, including:
- the number and types of concerns raised;
- any relevant litigation; and
- staff awareness, trust and confidence in the arrangements.