Whistleblower Policy

What Is a Whistleblower Policy?

A Whistleblower Policy is a formal document that outlines how your business handles reports of misconduct, illegal activity, or dangers to the public. It sets the rules for how workers can report serious issues safely and what steps you will take to investigate those reports.

In the past, many Australian businesses viewed this as a document only for large corporations or government bodies. That view has changed. For tradespeople, startups, and small businesses, this policy is now a crucial tool for managing risk and meeting legal obligations.

The policy serves two main purposes. First, it protects the people who speak up. It guarantees that they will not face punishment, bullying, or dismissal for reporting a problem. Second, it protects the business owner. By having clear rules, you show regulators and courts that you are taking "reasonable steps" to prevent misconduct within your team.

A good policy creates a clear line between a standard workplace complaint and a serious disclosure of wrongdoing. It tells your team exactly who to talk to, what will happen next, and how their identity will be kept safe. Without this document, you leave your business open to significant legal risks and confusion when things go wrong.

When to Use This Document

You might think you only need this policy if your business is huge. However, Australian law requires many small and medium businesses to have one. Even if it is not mandatory for you, it is still a smart move to protect your interests.

Mandatory Legal Requirements

You must have a written Whistleblower Policy if your business falls into specific categories.

Large Proprietary Companies Under the Corporations Act 2001 (Cth), you are legally required to have a policy if you meet at least two of these three criteria:

• You have 50 or more employees.
• Your annual revenue is $50 million or more.
• Your assets are worth $25 million or more.

If you check two of those boxes, you must comply with Section 1317AI of the Act. The policy must be available to your officers and employees.

Tax Agents and BAS Agents Many tradespeople and small business owners are registered as Tax Agents or BAS Agents. If you fall into this group, the law is very strict. Under the Tax Agent Services Act 2009 and the Code of Professional Conduct, you must have a written whistleblower policy. You need this to report potential breaches of taxation laws. This is a requirement that often catches small business owners by surprise.

Government Contractors and Startups

If you are a startup seeking funding from venture capitalists, you will likely face a due diligence checklist. Investors often ask to see your governance documents, including a Whistleblower Policy. They view it as a sign that your business is mature and ready to scale.

Similarly, if you plan to tender for government contracts, especially at a state or federal level, a compliant policy is often a mandatory part of the application process.

Voluntary Adoption for Small Businesses

For small proprietary companies that do not meet the thresholds above, a written policy is not strictly mandatory under the Corporations Act. However, it is highly recommended. If you employ a team of tradespeople or office staff, you are still liable under the Fair Work Act 2009 if you take "adverse action" against an employee for making a complaint. A policy is your best defence to show you acted fairly and followed a process.

Key Sections and Required Elements

A Whistleblower Policy must be more than just a generic statement. It needs specific clauses to be effective in Australian law. If you are using a Whistleblower Policy Template, ensure it includes the following sections.

Scope and Definitions

This section defines what counts as a "whistleblower disclosure" versus a personal "workplace grievance." This distinction is vital under Australian law.

Disclosable Conduct You must define the types of wrongdoing that can be reported. This usually includes:

• Fraudulently claiming expenses or time sheets.
• Breaches of WHS laws that put people in danger.
• Tax evasion or incorrect BAS lodgements.
• Bribery or corruption.

Personal Work-Related Grievances These are interpersonal issues or management disputes. Examples might include a clash with a supervisor or a complaint about rostering. While these are serious, they do not always get the same legal protections as disclosures of corporate misconduct. Your policy should make this difference clear to manage expectations.

Who is Protected The policy must state who can make a disclosure. Under the Corporations Act, protections extend to employees, officers, contractors, suppliers, and even volunteers. Ensure your document covers everyone who works for you, not just full-time staff.

Protections and Confidentiality

This is the most important part of the document for your staff. It explains how they will be treated if they speak up.

You must include an explicit statement that your business will not take "detrimental action." Detrimental action includes firing someone, demoting them, cutting their hours, or bullying them.

The policy should also explain how you handle confidentiality. It must state that you will protect the whistleblower's identity to the fullest extent possible. There is an exception: you may need to disclose their identity to police or a regulator if the law requires it. You should mention this exception so there are no surprises later.

Reporting Channels (Eligible Recipients)

To receive legal immunity under the Corporations Act, a whistleblower must report the issue to an "Eligible Recipient." You cannot just tell them to "tell their manager."

Your policy must list specific people who are authorised to receive disclosures. For a small business, this might be:

• The CEO or Business Owner.
• The Company Secretary.
• An external legal advisor or auditor.

Make sure you include their contact details. If you do not have an internal HR department, you might nominate an external consultant as the primary contact point to ensure impartiality.

Investigation Process

This section manages the timeline and expectations for the investigation. It should outline:

• How quickly you will acknowledge the report (usually within 7 business days).
• Who will conduct the investigation.
• How you will gather evidence (interviews, documents).
• How you will communicate the outcome.

You do not need to give a detailed day-by-day plan, but you must show that the process is fair and unbiased. It helps to link this to your broader Disciplinary Policy.

External Disclosures

Australian law protects the right to go to a regulator. Your policy must clearly state that nothing in the document stops a worker from reporting misconduct to an external body.

You should list the relevant regulators for your industry. This might include:

• ASIC (Australian Securities and Investments Commission).
• The ATO (Australian Taxation Office).
• SafeWork or WorkSafe in your specific state.
• The Fair Work Ombudsman.

This shows your team that you respect their legal rights and are not trying to silence them.

How to Write a Whistleblower Policy (Step by Step)

Writing this policy does not have to be a headache. You can follow a logical process to ensure it meets your legal needs and fits your business culture.

Step 1: Check Your Legal Status

Before you write a word, check the size of your business against the Corporations Act thresholds. If you have 50 employees or earn $50m in revenue, your policy must meet strict mandatory content requirements. If you are a Tax Agent, check the guidelines from the Tax Practitioners Board. If you are a small trade business with five staff, you have more flexibility but should still aim to meet the Australian Standard AS 8004:2020 where possible.

Step 2: Define Your Risk Profile

Think about the specific risks in your industry. If you run a construction company, your main risks might be safety breaches andPhoenix activity. If you run an accounting firm, your risks are tax fraud and data breaches. Tailor the definition of "Disclosable Conduct" to reflect the actual risks your team faces. This makes the policy feel relevant rather than just a legal box-ticking exercise.

Step 3: Choose Your Investigators

Decide who will actually handle the reports. In a small business, this is often the owner. But if the owner is the one accused of misconduct, who does the employee call?

It is wise to nominate an external party, such as a lawyer or an HR consultant, as a fallback Eligible Recipient. This adds a layer of safety and impartiality. Write their details into the policy.

Step 4: Draft the Content

Use plain English. Avoid legal jargon where you can. If you use a template, customise it to remove references to committees or board members if your business does not have them. Ensure the tone is supportive but professional.

Focus on the "How-To." Make it easy for someone to follow the steps. Use bullet points for contact details and reporting methods.

Step 5: Align with Other Documents

Your Whistleblower Policy does not stand alone. It needs to fit with your other workplace documents. Cross-reference your Code of Conduct and your Bullying and Harassment Policy. Ensure that the consequences for misconduct mentioned in the Whistleblower Policy match the consequences in your Disciplinary Policy.

Step 6: Review and Approve

Once you have a draft, have it checked by a legal professional if possible. They can ensure you have not accidentally missed a requirement from the Corporations Act or the Fair Work Act. Once approved, you will need to sign it and date it.

Step 7: Distribute and Train

A policy that sits in a drawer is useless. You must actively distribute it to your staff. Send it via email and ask them to read it. For a trades business, you might print a summary and put it on the noticeboard in the shed. Better yet, hold a short toolbox talk to explain what the policy is and why it matters.

Common Mistakes to Avoid

Businesses often get the implementation of this policy wrong. Avoiding these common errors will save you a lot of trouble later.

Confusing Grievances with Whistleblowing

The most common mistake is treating every complaint as a whistleblower disclosure. If an employee complains about their roster or a minor interpersonal conflict, that is a grievance. It needs to be handled through your standard HR process. If you treat it as a whistleblower investigation, you might waste resources and create unnecessary stress.

Conversely, if you treat a serious allegation of fraud as just a personal gripe, you could be liable for failing to investigate. Your policy must clearly separate these two concepts.

Failing to Protect Identity

Breaching confidentiality is a fast track to a legal claim. If a manager tells the staff who made the complaint, or if the whistleblower is treated differently afterwards, the business can face severe penalties. Ensure your policy explains that breaches of confidentiality are themselves a disciplinary offence.

Ignoring Mental Health

Blowing the whistle is stressful. People who report misconduct often fear for their jobs. Your policy should acknowledge this difficulty. While you are not legally required to provide counselling, referencing support services like the Employee Assistance Program (EAP) or Lifeline is a good practice.

Not Updating the Policy

Laws change. For example, Victoria introduced new laws starting 1 July 2025 that affect private sector businesses with more than 10 employees. If you wrote your policy three years ago, it might be out of date. Review your policy annually to ensure it still reflects current legislation and your current business structure.

Legal Considerations (AU)

As an Australian business owner, you need to be aware of the specific legal framework surrounding whistleblowing.

Corporations Act 2001 (Cth)

This is the primary legislation for incorporated businesses. It provides comprehensive protections for whistleblowers who report information about misconduct to the company, a regulator, or a legal advisor.

Detrimental Action Under Section 1317A, it is an offence to take detrimental action against a whistleblower. The penalties are steep. Courts can impose fines of up to $1.11 million for bodies corporate and $222,000 for individuals. This applies even if the report turns out to be incorrect, as long as the whistleblower believed it to be true.

Immunity Section 1317AA provides whistleblowers with immunity from civil, criminal, and administrative liability. This means they cannot be sued for defamation or breach of confidentiality for making a protected disclosure. Your policy must reinforce this immunity.

Fair Work Act 2009

The Fair Work Act protects all employees, including those in small businesses and trades. Under the General Protections provisions, an employer cannot take "adverse action" against an employee because they have made a workplace complaint.

Even if you are a small proprietary company not covered by the whistleblower provisions of the Corporations Act, the Fair Work Act still applies. A clear Whistleblower Policy helps you demonstrate that any action you took was based on poor performance or conduct, not because the employee spoke up.

Work Health and Safety Act 2011

WHS laws operate in parallel to whistleblower laws. In NSW, Queensland, and other states, workers are protected from discrimination if they raise a WHS issue. If a worker reports an unsafe work site to SafeWork, they are protected. Your policy should explicitly state that reporting safety hazards is a protected activity. You might link this to your WHS Policy.

State-Specific Legislation

Most whistleblower laws are federal, but states have their own rules. The Victorian Whistleblower Protections Act 2024 is a significant development. From 1 July 2025, it captures private sector organisations with 10 or more employees and turnover over $5 million. If you operate in multiple states, you should check that your policy meets the strictest standard that applies to you.

Australian Standard AS 8004:2020

This is not a law, but it is very important in court. AS 8004:2020 is the voluntary standard for whistleblowing protection programs. If a dispute ends up in court, judges will look at this standard to see if you took "reasonable steps" to prevent misconduct. Following this standard is the best way to protect your business from liability.

Frequently Asked Questions (preview)

Do I really need a written policy if I only have three employees? If you are not a tax agent or a large proprietary company, the law does not strictly force you to have a written document. However, the Fair Work Act still protects your staff from adverse action. A simple policy helps you handle complaints fairly and shows you are a professional business.

Can an anonymous report be investigated? Yes. Your policy should outline how you will handle anonymous reports. It is harder to investigate without being able to ask follow-up questions, but you should still attempt to look into the matter if the allegation is serious enough.

What if the accusation is against me, the business owner? This is a common scenario for small businesses. This is why your policy must include an external Eligible Recipient, such as a lawyer or an industry association. Your staff need a safe place to go if they cannot report it to you directly.

Can I require my staff to report internally first? You can encourage it, but you cannot legally force them or stop them from going to a regulator like ASIC or the ATO. Your policy must acknowledge their right to make an external disclosure at any time.

Is a whistleblower protected if they are wrong? Generally, yes. Under Australian law, the protection applies as long as the whistleblower has reasonable grounds to suspect the misconduct. They do not need to have absolute proof. They are protected even if their investigation proves they were mistaken.