Whistleblower Policy

Document control

1. Purpose

[Organisation] wants to know about wrongdoing as early as possible, so that it can be stopped and fixed. This Policy:

2. Legal framework and who must have this Policy

The Corporations Act 2001 Part 9.4AAA (ss1317AA–1317AK) gives protection to whistleblowers who disclose misconduct about companies, banks, insurers, superannuation entities and other regulated entities (s1317AAB). The Taxation Administration Act 1953 Part IVD (ss14ZZT–14ZZZE) gives similar protection for disclosures about tax affairs. The protections apply to any qualifying disclosure, whether or not the entity is required to have a policy (RG 270.4).

2.1 Where this Policy meets s1317AI(5)

3. Key definitions

4. Who can make a protected disclosure

You are an eligible whistleblower if you are, or have been, any of the following in relation to [Organisation] (s1317AAA; RG 270.43):

5. What can be reported: disclosable matters

A disclosable matter is information that you have reasonable grounds to suspect concerns misconduct, or an improper state of affairs or circumstances, in relation to [Organisation] or a related body corporate (s1317AA(4)). Without limiting that, it includes information that [Organisation] or a related body corporate, or any of their officers or employees, has engaged in conduct that (s1317AA(5)):

6. What is not covered: personal work-related grievances

Disclosures that relate solely to a personal work-related grievance, and do not concern detriment or a threat of detriment to you, do not qualify for protection under the Corporations Act (s1317AADA(1); RG 270.58). A personal work-related grievance concerns your current or former employment and has implications for you personally, but does not have significant implications for [Organisation] beyond you and does not concern a disclosable matter in s1317AA(5) (s1317AADA(2)). Examples include:

7. Who can receive a disclosure

To qualify for protection you must make your disclosure directly to one of the people or bodies below (RG 270.67). [Organisation] encourages you to make disclosures to one of our internal or external eligible recipients first, so that we can act quickly, but you can go directly to a regulator and still be protected (RG 270 good practice tip 5). If you want more information before making a disclosure, contact the WPO at [contact] or an independent lawyer (RG 270.66).

7.1 Eligible recipients within [Organisation]

7.2 Legal practitioners

A disclosure to a legal practitioner for the purpose of obtaining legal advice or legal representation about the whistleblower provisions is protected, even if the lawyer concludes it is not about a disclosable matter (s1317AA(3); s14ZZT(3); RG 270.72). Under the tax provisions only, a disclosure to a medical practitioner or psychologist for care, treatment or counselling is also protected (s14ZZT(3B)).

7.3 Regulators

You can disclose directly to ASIC or APRA, or another Commonwealth body prescribed by regulation (none was prescribed as at October 2026), and be protected (s1317AA(1); RG 270.73). Tax disclosures can be made to the Commissioner of Taxation (ATO) or, for matters within its functions, the Tax Practitioners Board (s14ZZT(1), (1A)). See ASIC Information Sheet 239 How ASIC handles whistleblower reports and the ATO's tax whistleblower guidance.

7.4 Public interest and emergency disclosures

In limited circumstances you can disclose to a member of the Commonwealth, a state or a territory parliament, or to a professional journalist (as defined in the Corporations Act), and be protected. You must first have made a disclosure to ASIC, APRA or a prescribed body; disclosures to [Organisation] alone are not enough (s1317AAD; RG 270.74–RG 270.77). [Organisation] strongly recommends you get independent legal advice before making one (RG 270.78).

8. How to make a disclosure

You can make a disclosure at any time, in person, by phone, in writing or online, during or outside business hours, and you can do so anonymously (RG 270.80, RG 270.83).

9. Legal protections for disclosers

These protections apply to qualifying disclosures made internally, to lawyers, to regulators, and to public interest and emergency disclosures made in line with the law (RG 270.89).

9.1 Identity protection (confidentiality)

• It is illegal for a person who obtained the information because of the disclosure to disclose your identity, or information likely to lead to your identification, unless an exception applies (s1317AAE(1); tax: s14ZZW). Under the Corporations Act this is an offence and a civil penalty provision; under the tax provisions it is an offence.
• The exceptions are disclosure to ASIC, APRA or a member of the Australian Federal Police; to a lawyer for advice or representation about the whistleblower provisions; to a person or body prescribed by regulation; or with your consent (s1317AAE(2)). For tax disclosures, the exceptions are disclosure to the Commissioner of Taxation, a member of the Australian Federal Police, a lawyer for advice or representation about the tax whistleblower provisions, the Inspector-General of Taxation, the Tax Practitioners Board or the ACNC Commissioner (prescribed), or with your consent (s14ZZW(2); Taxation Administration Regulations 2017 s13B).
• Information that could identify you may be disclosed without your consent only if it does not include your identity, is reasonably necessary to investigate the matter, and all reasonable steps are taken to reduce the risk that you will be identified (s1317AAE(4); RG 270.93).
• You cannot generally be required to disclose your identity, or produce documents that identify you, to a court or tribunal (s1317AG).
• If you think your confidentiality has been breached, tell the WPO or [Chair of the Board Audit Committee]. You can also complain to ASIC, APRA or the ATO (RG 270.94).

9.2 Protection from detriment

• No person may cause, or threaten to cause, detriment to you or anyone else because they believe or suspect that a person has made, may have made, proposes to make or could make a qualifying disclosure (s1317AC(1)–(2); tax: s14ZZY). A threat can be express or implied, conditional or unconditional, and you do not need to have actually feared it would be carried out (s1317AC(4)–(5)).
• Officers and employees involved in a company's contravention also contravene the law (s1317AC(3)). These are offences and civil penalty provisions.
• Reasonable administrative action to protect you (for example moving you to another location to prevent detriment), and managing unsatisfactory performance in line with the [Performance Management Policy], are not detrimental conduct. [Organisation] will explain the reasons for any such action (RG 270.100–RG 270.101).

9.3 Compensation and other remedies

• You, or any other person, can seek compensation and other remedies through the courts if you suffer loss, damage or injury because of detrimental conduct, including where [Organisation] failed to take reasonable precautions and exercise due diligence to prevent it (s1317AD, s1317AE; RG 270.102; tax: s14ZZZ, s14ZZZA).
• Courts can order compensation (from the person, the employer, or both), an injunction, an apology, reinstatement, exemplary damages or any other order the court thinks appropriate (s1317AE(1)).
• Once you point to evidence suggesting a reasonable possibility of detrimental conduct, the other party must prove the claim is not made out (s1317AD(2B)).
• You can be ordered to pay costs only if you brought the proceedings vexatiously or without reasonable cause, or your unreasonable act or omission caused the costs (s1317AH).
• [Organisation] encourages you to seek independent legal advice (RG 270.103).

9.4 Civil, criminal and administrative liability protection

• You are not subject to any civil, criminal or administrative liability (including disciplinary action) for making a qualifying disclosure, and no contractual or other remedy may be enforced against you on the basis of the disclosure (s1317AB(1)(a)–(b); tax: s14ZZX).
• You have qualified privilege in respect of the disclosure, and a contract you are party to cannot be terminated because the disclosure breaches it (s1317AB(2)).
• For disclosures to ASIC, APRA or a prescribed body, and public interest or emergency disclosures, the information is not admissible in evidence against you in criminal proceedings or proceedings for a penalty, other than about the falsity of the information (s1317AB(1)(c)). For tax disclosures, this applies to disclosures to the Commissioner of Taxation or the Tax Practitioners Board (s14ZZX(1)(c)).
• These protections do not give immunity for any misconduct you were involved in that is revealed by your disclosure (s1317AB(1) note; RG 270.105).

10. How [Organisation] protects confidentiality in practice

[Organisation] will (RG 270.108):

11. Support and protection from detriment in practice

• Risk assessment: as soon as possible after receiving a disclosure, the WPO assesses the risk of detriment to you and to others (for example colleagues who might be suspected of making it), by identifying who might have a motive, analysing likelihood and severity, putting controls in place, and monitoring the risk during and after the investigation. The assessment is recorded (RG 270.109; good practice tip 9).
• Support: access to the [Employee Assistance Program], counselling and other professional support, and a contact person for updates.
• Practical protection: where needed, working from another location, reassignment to another role at the same level, changes to how you work, or reassignment or relocation of other staff involved.
• Managers: managers are reminded of their duties to keep matters confidential, address risks of isolation or harassment, manage conflicts and ensure fairness when managing your performance.
• If detriment occurs: tell the WPO. A complaint about detriment is investigated as a separate matter by someone not involved in the original disclosure, and the findings are reported to the [Board Audit Committee]. Interventions may include disciplinary action against the person responsible, extended leave, a career development plan, or compensation or other remedies.
• You can also seek independent legal advice, or contact ASIC, APRA or the ATO, if you believe you have suffered detriment (RG 270.110).

12. Handling a disclosure

13. Investigating a disclosure

• Scope and lead: the WIO decides the nature and scope of the investigation, who will lead it (internal, external, or jointly with an external investigation firm), what technical, financial or legal advice is needed, and the timeframe (RG 270 good practice tips 12 and 13).
• Independence: investigations are objective, fair and independent of the discloser, the people who are the subject of the disclosure and the business unit involved. No one investigates a matter in which they have a conflict of interest.
• Confidentiality: information likely to identify the discloser is not shared without consent unless the s1317AAE(4) conditions are met (RG 270.118). Legal professional privilege is considered where [General Counsel] directs.
• Anonymous disclosures: [Organisation] will investigate as far as it can on the information provided. It may be unable to investigate fully if it cannot contact the discloser (RG 270.119–RG 270.120).
• Evidence: evidence is gathered and preserved properly; interviews are documented; findings are based on the balance of probabilities and the evidence.
• Updates: the discloser receives regular updates where they can be contacted, at least when the investigation starts, while it is in progress [every 4 weeks], and when it is finalised (RG 270.121–RG 270.122). Anonymity is protected when giving updates.
• Findings: the investigator reports findings in writing (Appendix C) to the WIO and, for serious matters, to the [Board Audit Committee], without identifying the discloser (RG 270.123). The discloser is told the outcome, although it may not always be appropriate to give full details, for example for privacy or legal reasons (RG 270.124).
• Review: a discloser who is not satisfied may ask for a review of whether this Policy was followed. The review is done by an officer not involved in the original handling, and the findings go to the [Board Audit Committee]. [Organisation] is not required to reopen an investigation if it was conducted properly and there is no new information that would change the findings (RG 270 good practice tip 14). The discloser can also complain to ASIC, APRA or the ATO.
• Outcomes: substantiated wrongdoing leads to action: disciplinary action under the RiskFA Consequence Management Framework, customer remediation under the RiskFA Customer Remediation Policy, fixing control weaknesses as issues under the Incident & Issues Management Standard, and regulatory notification where required.

14. Fair treatment of people mentioned in a disclosure

[Organisation] will ensure fair treatment of employees who are mentioned in a disclosure or who are its subject (s1317AI(5)(e); RG 270.125–RG 270.127). In particular:

15. Roles and responsibilities

16. Records, privacy and information security

• All disclosure records are kept in a secure, access-restricted [case management system], separate from general HR and incident records (RG 270.113, RG 270.147).
• Personal information is handled in line with the Privacy Act 1988 and the Australian Privacy Principles; a breach of disclosure records is managed under the RiskFA Data Breach Response Plan (RG 270.148–RG 270.149).
• Records are kept for at least [7 years] after the matter is closed, or longer where required by law.
• Service providers that receive disclosures are bound by contract to the same confidentiality and security standards, and [Organisation] monitors them. [Organisation] remains responsible for outsourced functions (RG 270 good practice tip 6).

17. Reporting and monitoring effectiveness

The WPO reports to the [Board Audit Committee] at least [quarterly], without including anything likely to identify a discloser (RG 270.150–RG 270.157). Reports include:

18. Availability of this Policy and training

• This Policy is available to all officers and employees on [the intranet], in the [employee handbook], and in induction packs, and is promoted in [staff briefings] at least [annually] (s1317AI(1)(b), (5)(f); RG 270.128–RG 270.130).
• It is published on [Organisation]'s external website so that former employees, suppliers and others can use it, with internal-only details (such as names and direct numbers of internal recipients) removed if appropriate (RG 270.138–RG 270.139).
• All employees complete training on this Policy at induction and [annually] (RG 270.131).
• Managers receive training on handling disclosures and preventing detriment (RG 270.133).
• Eligible recipients, the WPO and the WIO receive specialist training, including on confidentiality and the prohibition on detriment (RG 270.134). External eligible recipients (such as the auditor and actuary) are told about their obligations (RG 270.135).
• People in overseas operations receive appropriate training, because disclosures to overseas recipients, or about overseas entities, may qualify for protection (RG 270.136).
• Changes to this Policy are communicated to all staff and recipients, with targeted training where procedures change (RG 270.137).

19. Review of this Policy and law reform

• This Policy is reviewed at least every [2 years] (RG 270.158), considering whether its scope suits the business, whether it is easy to understand, whether it reflects current law and good practice, and whether handling, protection and support need to improve (RG 270.159). Staff feedback is sought (RG 270.160).
• Law reform (as at October 2026): s1317AK requires a review of the operation of Part 9.4AAA and Part IVD of the Taxation Administration Act 1953. Proposals for a Whistleblower Protection Authority had not been enacted. From 4 December 2026 the definition of 'journalist' for public interest and emergency disclosures moves from s1317AAD(3) to s9 of the Corporations Act, with the same wording (Treasury Laws Amendment (Strengthening Financial Systems and Other Measures) Act 2025). Check for changes before each review.

20. Compliance with this Policy

Causing or threatening detriment to a discloser, breaching confidentiality, or deliberately making a false disclosure are serious breaches of this Policy and may lead to disciplinary action, up to termination of employment or engagement, under the RiskFA Consequence Management Framework. They may also be offences or civil penalty contraventions. Breaches are reported to the [Board Audit Committee] and, where relevant, considered in remuneration outcomes under the RiskFA Remuneration Policy (CPS 511 where it applies). This Policy does not form part of any employment contract.

21. Related documents

• [Code of Conduct], [Grievance Policy], [Bullying, Harassment and Discrimination Policy], the RiskFA Consequence Management Framework
• RiskFA Incident & Issues Management Standard, RiskFA Customer Remediation Policy, RiskFA Data Breach Response Plan
• [Fraud and Corruption Control Policy], [AML/CTF Program], [Privacy Policy]
• Legislation: Corporations Act 2001 Part 9.4AAA; Taxation Administration Act 1953 Part IVD; Taxation Administration Regulations 2017 Division 3A; ASIC Corporations (Whistleblower Policies) Instrument 2019/1146
• ASIC: RG 270 Whistleblower policies; INFO 239 How ASIC handles whistleblower reports; ATO tax whistleblower guidance; APRA guidance on making a disclosure to APRA
• Standards: ISO 37002:2021 Whistleblowing management systems — Guidelines

Appendix A. Disclosure handling workflow

1. Disclosure received by an eligible recipient, the independent service or the WPO. Record date, channel and the matters raised. Ask for consent to share identity with the WPO; if not given, pass on only non-identifying information.
2. Acknowledge within [2 business days], through the discloser's chosen channel. Explain confidentiality, protections, support and next steps.
3. Detriment risk assessment by the WPO within [5 business days]; agree a support plan; monitor throughout.
4. Triage within [10 business days]: Does it qualify for protection (eligible whistleblower, disclosable matter, eligible recipient)? Is it a personal work-related grievance only? If unsure, treat as protected. Does it involve a director or executive (refer to the Board Audit Committee Chair)? Does it need urgent action or regulatory notification?
5. Decide the response: formal investigation, other action (for example a targeted review), referral to another process with consent (for example a grievance), or no further action with documented reasons. Tell the discloser.
6. Investigate under section 13: terms of reference, independent investigator, evidence, procedural fairness for people mentioned, updates to the discloser every [4 weeks].
7. Findings documented (Appendix C) and reported to the WIO and, for serious matters, the Board Audit Committee, without identifying the discloser.
8. Act: discipline, customer remediation, control fixes (issues raised under the Incident & Issues Management Standard), regulatory notifications.
9. Close: tell the discloser the outcome where appropriate; reassess detriment risk; secure records; include in reporting.
10. Review on request: independent review of whether this Policy was followed.

Appendix B. Eligible recipients list template

Publish internal details on the intranet. The external website version may omit internal names and direct numbers (RG 270.139).

Appendix C. Investigation report template

The report must not include the discloser's identity or information likely to identify them, unless the discloser has consented or the law permits.