Internal, regulatory, and external reporting channels
This chapter discusses the committee's consideration of public and
private sector legislation against the best practice criteria for internal,
regulatory, and external disclosures. Disclosures to Members of Parliament are
not part of the best practice criteria and are discussed in the next chapter.
One of the simplest ways of describing the various reporting channels is
to classify them into a tiered reporting system. However, the terminology used
to describe the tiers has the potential to create confusion if not clearly
defined. The definitions used in this report are those that align with best
practice principles. While the arguments in favour of the principles are set
out in the subsequent paragraph by Professor A J Brown, at this juncture it is useful
to define the three tiers of the classification system described below:
- internal disclosure refers to reporting within an organisation;
- regulatory disclosure refers to reporting to a regulator
(regulatory disclosure is not treated as an external disclosure under this classification
- external disclosure refers to reports made to third parties such
as the media, non-government organisations, and labour unions.
Professor Brown argued that research and best practice legislative
design principles indicate that a disclosure regime should include three tiers:
- Internal disclosures, where safe and appropriate
(including disclosures to whistleblowing services, e.g. hotlines contracted by
the organisation; or disclosures to the board or audit committee);
- Regulatory disclosures...wherever a competent regulator
exists to receive and deal with the disclosure, and an internal disclosure was
(i) unsafe/unviable, (ii) inappropriate because the organisation was unlikely
to act on the matter, or likely to do worse, e.g. destroy evidence or victimise
others, or (iii) made but did not lead to satisfactory action;
- Third party (including media) disclosures where (i)
neither internal or regulatory disclosure channels were available or safe, or (ii)
an internal or...regulatory disclosure was made, which did not lead to
satisfactory action; or (iii) some emergency circumstances exist to justify a
disclosure to third parties or the media, without first making either an internal
or regulatory disclosure.
The best practice criteria in the Breaking the Silence report suggests
that a three-tiered disclosure system should include clear external disclosure
channels for whistleblowers to contact the media, Members of Parliament,
non-government organisations and labour unions where necessary. The report also
noted many G20 countries fall short on this criterion.
Evidence to this inquiry was strongly in favour of whistleblower
protections being made consistently available across the public, private and
not-for-profit sectors for the first two tiers, namely internal and regulatory
disclosures. However, different views were expressed about whether
whistleblower protections should apply to external disclosures made to third
parties such as the media. This evidence is discussed after the section below which
sets out the current legislative framework.
Reporting channels in current legislation
This section compares current legislation against the best practice
criteria on internal, regulatory and external disclosures. Table 8.1 below
compares the PID Act, the FWRO Act, and the Corporations Act across three
elements of a tiered system of disclosure that provides for internal,
regulatory and external reporting channels.
Table 8.1: Internal, regulatory, and external reporting
||To a supervisor or an authorised internal recipient
||The company's auditors.
A director, secretary or senior
manager of the company.
A person authorised by the company to receive disclosures.
||The agency that the
disclosable conduct relates to, or the agency the discloser belongs to.
The Commonwealth Ombudsman if
the discloser has reasonable grounds.
An investigative agency.
|The Registered Organisations
The Fair Work Commission.
The Australian Building and
An Australian Building and
The Fair Work Ombudsman.
||To any person other than a foreign public official, (subject to
Sources: PID Act, FWRO
Act, Corporations Act.
The committee observes that one of the main differences in terms of best
practice criteria across the three Acts is the silence of the FWRO Act on
internal disclosures within registered organisations. The committee notes that
prior to the December 2016 amendments, the FWRO Act was also silent on internal
disclosures within registered organisations.
The ACTU considered that protection should be available to persons from
the moment they make a disclosure internally (if they choose to do so). It
should not be necessary to make a formal complaint, either to a regulator or
externally, in order to trigger whistleblower protections.
The committee considers that the lack of protection for disclosures
within registered organisations is a significant gap in the legislation when
compared to the best practice criteria and other legislation including the PID Act
and the Corporations Act. Such a gap should be rectified. The committee
suggests that, regardless of whether a single private sector whistleblower
protection Act is implemented, internal disclosers within registered
organisations should be provided with protection.
The committee recommends that whistleblower protections be extended to
internal disclosures within the private sector, to include:
any person within the management chain for the whistleblower
within the whistleblower's employer;
any current officer of the company, or that company's Australian
or ultimate parent; and
any person specified in a policy published and distributed by an
employer (or principal) of the whistleblower.
As noted earlier, there was broad support for the consistent extension
of protections for regulatory disclosures across the private sector. While most
submitters and witnesses agreed that it would be preferable to encourage
internal reporting in the first instance, it was generally recognised that
providing protection for regulatory disclosures would have the additional
benefit of incentivising organisations in the private sector to ensure their
internal reporting procedures and practices were best practice.
KPMG suggested that while the whistleblower system should encourage the
use of internal reporting mechanisms, it is appropriate for whistleblowers to
be able to disclose direct to the regulator. KPMG also supported a tiered system
and argued that it would:
- allow disclosure to wider classes of people in extenuating
circumstances, or if the initial disclosure has not been acted upon;
- provide greater incentive for Australian corporates to act
quickly and decisively on internal reports, if they know that wider disclosure
can be made; and
- allow whistleblowers to report to the company's external hotline
(if there is one in place), followed by, if necessary, the relevant external
The AICD supported whistleblowers being able to disclose to a regulator
at the same time as, or before, disclosing to a company. However, the AICD
considered that if wrongdoing is to be disclosed to third parties, it should
only be in the context of serious wrongdoing. The AICD also noted that a well-functioning
tiered system of disclosure will assist in ensuring that minor matters,
including those solely related to employment grievances, are not
inappropriately disclosed to third parties.
The IBACC indicated that while it favours a corporate whistleblower
making a disclosure internally within a company in the first instance, any
whistleblower should not be excluded from a right to make a disclosure
externally to any relevant government agency (if the allegations concern
criminal conduct or contravention of a law) before, at the same time as, or
after, any internal disclosure.
The bulk of the evidence put to the committee supported extending
protections consistently across the private sector for regulatory disclosures. Furthermore,
many submitters and witnesses were of the view that consistent whistleblower
protections for regulatory disclosures would act as an additional incentive for
organisations in the private and not-for-profit sectors to ensure that their
internal reporting procedures and practices met best-practice criteria as a
means of encouraging internal reporting.
The committee recognises that there are currently no protections
available under the FWRO Act or Corporations Act for whistleblowers who make
disclosures to immediate supervisors or line managers, except in specific
circumstances (i.e. the supervisor is a director, auditor, senior manager,
etc.). A Whistleblowing Protection Act should make it explicit that internal
disclosures within the private sector can be made to any person within the
management chain. Further, disclosures should be protected where they are made
to any officer within the whistleblower's employing company or its Australian
or ultimate parent company.
Recognising that the three Acts currently appear to provide for
disclosures to regulators, the committee supports retaining and extending
regulatory disclosures to the private sector more generally.
The committee also notes that the existence of private sector regulators
with investigative powers makes regulatory disclosure more feasible in the
private sector than the public sector. As discussed in Chapter 12, there are
limitations on the ability of the Commonwealth Ombudsman to conduct substantive
investigations into disclosures and alleged reprisals against whistleblowers
that have occurred in Commonwealth public sector departments and agencies.
The committee recommends that a Whistleblowing Protection Act should provide
consistent whistleblower protections for regulatory disclosures from the public
and private sectors.
Disclosures to Australian Law
The committee recommends that where a whistleblower discloses a
protected matter to an Australian law enforcement agency, that agency must
provide regular updates to the whistleblower as to whether or not it is
pursuing the matter, including where it transfers the matter to another law
enforcement agency, in which case obligations to keep the whistleblower
informed are transferred to that agency. However, nothing that would prejudice
an investigation is required to be disclosed.
The committee recommends that Australian law enforcement agencies should
be required to pass on whistleblower disclosures to whichever appropriate
agency is to progress the disclosure. The whistleblower does not need to do
this, if they have complied with the disclosure requirements of the Act.
The other significant observation from Table 8.1 is that there is no
protection for external disclosures under the FWRO Act and the Corporations
Research indicates that there are major differences between organisations
in the public, private, and not-for-profit sectors when it comes to awareness
of external reporting options:
- external ombudsmen, integrity or regulatory agencies were
identified as an available reporting channel by:
- 94.7 per cent of public sector organisations;
- 55.7 per cent of not-for-profits; and
- 44.7 per cent of private business;
- media and journalists were identified as available 'if necessary'
- 23.8 per cent of public sector organisations;
- 5.2 per cent of not-for-profits; and
- 4.0 per cent of private business.
The remainder of this section examines the evidence received by the committee
on external disclosures.
Professor Brown argued that any system of whistleblower protections
should maximise the ability of whistleblowers to make internal disclosures in
the first instance, followed by the ability to make a regulatory disclosure.
However, he was of the view that in circumstances where it is reasonable to go
to the media, then those disclosures should also attract protection.
The Law Council submitted that whistleblower protections should only
apply to disclosures made to entities that have 'an obligation to treat that
information confidentially'. The Law Council was of the view that 'information
disclosed by whistleblowers in an emergency should be to the relevant regulator
or an oversight agency'.
The Law Council did not support extending whistleblower protections to
external disclosures made to third parties including the media:
...the Law Council does not consider that the whistleblower
protections should be available to whistleblowers who disclose information to
third parties such as the media or Members of Parliament. There are few
controls imposed or enforced in relation to the ways in which the media use
information provided by the public...there is no obligation on the part of the
media to maintain confidentiality and protect the whistleblower's identity. Nor
can the media protect the whistleblower from any retaliation which may arise as
a result of the media's portrayal of the information disclosed. Further, the
media does not have a duty to remain impartial or ensure the information is
credible and substantiated before publicising it.
The GIA suggested that legislation should not provide protection
for an employee disclosing to the media:
We are of the view that disclosures to the media should not
be legally sanctioned in legislation, as the media has no legal powers to
investigate but does have the capacity to express an opinion on a matter that
has not yet been tested. Disclosure to the media and media opinion on the
matter could also prejudice an ongoing investigation.
By contrast, the Australian Lawyers Alliance submitted that if the
discloser has a well-founded concern that their disclosure will not be acted on
with sufficient urgency, which might arise where the disclosure relates to the
activities of the individual or department that would be receiving the
complaint, for example, it may be unreasonable to require internal disclosure
before external disclosure can be permitted.
The Ethics Centre argued that in circumstances where an employer fails
to make it safe and reasonable for an employee to report wrongdoing using
internal mechanisms, it should be allowable for an employee to make a
disclosure to an external party, especially if the whistleblower reasonably
- there is a risk to safety or wellbeing;
- the relevant conduct is criminal in nature; and
- the report is made to a third party that acts for the public interest.
The Community and Public Sector Union submitted that external public
disclosure should only occur in particular circumstances, including that the alleged
misconduct is serious and that internal avenues have been exhausted.
Criteria for external disclosures
As noted above, of the three Acts, only the PID Act explicitly provides
protections for external disclosures. The PID Act includes the following criteria
for external disclosures:
information tends to show, or the discloser believes on reasonable grounds that
the information tends to show, one or more instances of disclosable conduct.
- On a
previous occasion, the discloser made an internal disclosure of information
that consisted of, or included, the information now disclosed.
- Any of the following apply:
- a disclosure investigation
relating to the internal disclosure was conducted under Part 3, and the
discloser believes on reasonable grounds that the investigation was inadequate;
- a disclosure investigation
relating to the internal disclosure was conducted (whether or not under Part
3), and the discloser believes on reasonable grounds that the response to the
investigation was inadequate;
- this Act requires an
investigation relating to the internal disclosure to be conducted under Part 3,
and that investigation has not been completed within the time limit under
- The disclosure is not, on balance, contrary to the
more information is publicly disclosed than is reasonably necessary to identify
one or more instances of disclosable conduct.
information does not consist of, or include, intelligence information.
of the conduct with which the disclosure is concerned relates to an
Professor Brown was of the view that the current provisions in the PID
Act regarding external disclosure were 'fairly subjective'. He therefore
suggested that, in order to ensure greater clarity for whistleblowers, the test
should be 'refined' if it was going to be applied to the private sector.
Young Liberty Victoria noted that the PID Act requires a whistleblower
to be satisfied that an external disclosure is in the public interest having
regard to a lengthy list of factors that must be considered and weighed against
each other. Young Liberty Victoria suggested that such provisions should be
repealed and argued that these requirements for making an external disclosure
are highly complex and create a significant and disproportionate barrier to
In its consideration of external disclosures, the Moss Review noted that
submissions and online survey responses criticised the external emergency
disclosure criteria as confusing and hard to apply in practice. However, there being
only a few occasions in which disclosers had sought the protections of the PID
Act for external disclosures, it was not possible for the Moss Review to draw firm
conclusions about the success of the provisions. The Moss Review went on to recommend:
That the external and emergency disclosure provisions be
considered in a future review of the PID Act, when further evidence about how
they are being used is available.
That the PID Act be amended to include situations when an
Authorised Officer failed to allocate an internal PID, or a supervisor failed
to report information they received about disclosable conduct to an Authorised
Officer, as grounds for external disclosure.
In reviewing external disclosures and reporting channels, the key
questions for the committee were:
- whether the PID Act criteria for external disclosures are
appropriate and effective; and
- what criteria should apply if protections were to be extended to
external disclosures in the private sector.
While recognising the limited examples of external disclosures under the
PID Act as identified by the Moss Review, the committee supports the Moss Review
recommendation to include a more objective test for the grounds for external
disclosures under the PID Act.
The committee notes the Moss Review recommendation that consideration of
other changes be deferred until more data is available. However, the committee
is mindful that the complexity of the provisions may be inhibiting external
disclosures and, by extension, the further data that would be relied on for any
future consideration of external disclosure may not be forthcoming.
The committee considers the lack of protections for external reporting
in the private sector to be a significant gap in the whistleblower protection
legislation. Nevertheless, the committee considers that it would be prudent to
begin with a cautious approach, including appropriate checks and balances. Once
data is available on the operation of the criteria for external reporting
provisions, then it may be appropriate to consider whether there is scope for
relaxing some of the criteria.
A Whistleblower Protection Act should maximize the ability of a
whistleblower to, in the first instance, make an internal disclosure and then a
regulatory disclosure. Failing this, a disclosure should be made to an authorised
external recipient. However, in instances where it is reasonable to make a
public third party disclosure (i.e. to the media), protection should be
afforded to the whistleblower.
The committee considers that the instances where it may be reasonable to
make a third party disclosure are limited to situations where:
- there is a risk of serious harm or death; or
- a disclosure in the public interest has been made to an
Australian law enforcement agency and, after a reasonable length of time, no
action has been taken by the agency.
Noting that it supports the Moss Review in recommending a more objective
test for external disclosures under the PID Act, the committee considers that,
in order to provide consistency for whistleblowers and businesses, the external
disclosure provisions across the private sector should be aligned with the PID
Act, except for the provisions relating to intelligence functions.
The committee recommends that the existing whistleblower protections for
external disclosures in the Public
Interest Disclosure Act 2013 be simplified (including a more
objective test) and extended to disclosures to a registered organisation, a federal
Member of Parliament or their office, and be included in a Whistleblowing Protection
Act, except the provisions relating to intelligence functions which should
continue to apply to the public sector only.
The committee recommends that if a disclosure of disclosable conduct has
been made to an Australian law enforcement agency and after a reasonable time,
no steps have been taken by that or any other agency (excluding where the
whistleblower has elected to make an anonymous disclosure) whistleblowing
protections shall apply if the same disclosure is subsequently made to the
media if they have complied with the disclosure requirements of the Act.
Navigation: Previous Page | Contents | Next Page