Whistleblowers & Whistleblower Policies
A whistleblower is someone — often a current or former employee, officer or contractor — who reports serious wrongdoing inside an organisation, such as fraud, corruption, misconduct or illegal behaviour.
A whistleblower policy is the framework that lets them do so safely and protects them when they do.
It isn't a core ACXPA topic, and this isn't legal advice.
But good governance matters to every business, including contact centres — and whether a company protects the people who speak up says a lot about its culture and integrity.
The aim of this guide is simple: to explain clearly what a whistleblower and a whistleblower policy are, why they matter, how the rules work at a high level, and where to go for authoritative help.
What it is
A whistleblower reports serious wrongdoing in an organisation; a whistleblower policy sets out how they can report it safely and how they're protected.
Why it matters
Safe reporting channels protect an organisation from undetected misconduct, and signal a serious, ethical culture — something customers and partners increasingly look for.
What this guide covers
What a whistleblower and a policy are, why they matter, the rules (with an Australian example), how to find businesses with a policy, and where to get help.
What is a Whistleblower?
A whistleblower is a person — often an employee or former employee of a company or government agency, but also officers, contractors and suppliers — who reports serious wrongdoing such as fraud, corruption, unethical behaviour or breaches of the law.
Whistleblowers can report internally — to a supervisor, HR, a designated officer or a neutral third party — or externally, to regulators, law enforcement or, in some cases, the media.
Speaking up can be a risky proposition: whistleblowers run a very real risk of serious consequences for bringing wrongdoing to light, which is exactly why protections exist.
What it is — and isn't
Whistleblowing is about disclosing genuine misconduct or an improper state of affairs in an organisation.
It's generally not the same as a personal work-related grievance — a dispute about your own pay, roster or performance review — which is usually handled through other channels and isn't typically covered by whistleblower protections.
What is a Whistleblower Policy?
A whistleblower policy is a documented framework that sets out how people can safely report wrongdoing, and how the organisation will protect and support them when they do.
It turns "we take integrity seriously" into a real, accountable process.
A good policy typically covers:
- How to report: the channels available, including confidential and anonymous options.
- Who can report: the people the policy covers — usually current and former staff, contractors and others.
- What's protected: confidentiality of the whistleblower's identity, and protection from victimisation or detriment.
- How reports are handled: who investigates, how, and how the whistleblower is kept informed and supported.
Businesses that offer a genuine, anonymous whistleblower channel can generally be considered serious about ensuring their people, processes and practices act appropriately and within the law.
You'll normally find a business's whistleblower policy on its website.
Why It Matters
Whistleblowing isn't just a compliance formality — it's one of the most effective ways an organisation finds out about problems before they become disasters.
🛡️ Protects the organisation
The people closest to misconduct are usually staff. A safe channel surfaces fraud, safety issues and breaches early — long before regulators, the media or customers do.
💛 Signals culture & trust
How a business treats people who speak up is a window into its real culture. Strong protections build trust with employees, customers and partners alike.
🎧 Relevant to our industry
Contact centre and CX teams handle sensitive customer and employee matters daily. Staff may witness things that need raising — and larger operators may be legally required to have a policy.
The Rules (a High-Level View)
Whistleblower protections are written into law in many countries. The detail varies by jurisdiction, so the following is general information, not legal advice — always check the rules that apply to you.
Corporate whistleblower protections
In Australia, whistleblower protections for the corporate sector sit in Part 9.4AAA of the Corporations Act 2001, significantly strengthened from 1 July 2019 by the Treasury Laws Amendment (Enhancing Whistleblower Protections) Act 2019, and regulated by ASIC.
Who must have a policy
Public companies, large proprietary companies, and corporate trustees of APRA-regulated super entities have been required to have a whistleblower policy since 1 January 2020.
Not having a compliant policy is an offence, with significant penalties.
Who's protected & for what
Protections cover current and former employees, officers, contractors and their relatives — named or anonymous.
They apply to disclosures about misconduct or an improper state of affairs, but generally not to purely personal work-related grievances.
Beyond Australia
Most major economies have whistleblower regimes.
The EU Whistleblower Directive requires organisations with 50 or more employees to have internal reporting channels; the United States has long-standing protections and reward schemes under laws like Sarbanes-Oxley and Dodd-Frank; and the UK protects disclosures under the Public Interest Disclosure Act.
Wherever you operate, check the local requirements.
💡 Get qualified advice
This is a complex, high-stakes area of law. If your business needs a whistleblower policy or has obligations to meet, work from the official regulator guidance and get qualified legal advice for your situation.
Find Businesses with a Whistleblower Policy
Having a formal whistleblower policy is one signal of a well-governed, ethical business — and it's something you can look for when choosing who to work with.
The ACXPA Business Members Directory
ACXPA captures whether business members have a formal whistleblower policy, so you can find them in the ACXPA Business Members Directory. If you're a member with a policy in place, it's worth making sure your listing reflects it.
Where to Get Help & Official Resources
ACXPA isn't the right source for whistleblowing advice or support — these official channels are. Whether you need to understand your obligations, build a policy, or make a disclosure, start here.
For obligations & guidance (Australia)
- The regulator: ASIC — corporate whistleblowing
- The law: Part 9.4AAA of the Corporations Act 2001
- Always: seek qualified legal advice for your situation
A note on this guide
This page is a plain-English overview to help you understand the topic and find the right help.
It is not legal advice and is not a substitute for official regulator guidance or qualified professional advice. If you have obligations, start with the regulator for your jurisdiction.
Frequently Asked Questions About Whistleblowers
What is a whistleblower?
A whistleblower is a person — often a current or former employee, officer, contractor or supplier — who reports serious wrongdoing in an organisation, such as fraud, corruption, unethical behaviour or breaches of the law.
They can report internally (to a supervisor, HR or a designated officer) or externally (to a regulator, law enforcement or, in some cases, the media).
What is a whistleblower policy?
A whistleblower policy is a documented framework that sets out how people can safely report wrongdoing and how the organisation will protect and support them.
It typically covers how to report (including confidential and anonymous options), who is covered, what protections apply, and how reports are investigated and handled.
Is whistleblowing the same as making a complaint?
Not usually. Whistleblowing is about disclosing genuine misconduct or an improper state of affairs in an organisation.
A personal work-related grievance — for example a dispute about your own pay, roster or performance review — is generally handled through other channels and isn't typically covered by whistleblower protections.
Do businesses have to have a whistleblower policy?
It depends on the business and the jurisdiction.
In Australia, public companies, large proprietary companies and corporate trustees of APRA-regulated super entities have been required to have a whistleblower policy since 1 January 2020, with significant penalties for not having one.
Many other countries have similar requirements — for example, the EU Whistleblower Directive requires organisations with 50 or more employees to have internal reporting channels. Check the rules that apply to you.
Are whistleblowers protected?
In many jurisdictions, yes.
In Australia, Part 9.4AAA of the Corporations Act protects eligible whistleblowers — including current and former employees, officers, contractors and their relatives, named or anonymous — by safeguarding the confidentiality of their identity and protecting them from victimisation or detriment.
The specifics vary by country, so check your local law.
How can I tell if a business has a whistleblower policy?
You'll normally find a business's whistleblower policy on its website. For ACXPA business members, you can also find those with a formal whistleblower policy in the ACXPA Business Members Directory.
Where to Next
Summary: Whistleblowers & Whistleblower Policies
A whistleblower is someone who reports serious wrongdoing in an organisation — fraud, corruption, misconduct or illegal conduct — and a whistleblower policy is the framework that lets them do so safely and protects them when they do.
Whistleblowing is about genuine misconduct, not personal work grievances, and a real, confidential channel is a strong signal of an ethical, well-run business.
The protections are written into law in many countries.
In Australia, Part 9.4AAA of the Corporations Act — strengthened in 2019 and regulated by ASIC — requires public companies, large proprietary companies and certain super trustees to have a whistleblower policy, and protects eligible whistleblowers from detriment.
Other regimes, like the EU Whistleblower Directive, apply elsewhere.
This isn't ACXPA's area of expertise, and none of it is legal advice — for obligations, start with the regulator (ASIC in Australia) and qualified legal advice.
And if you want to see which ACXPA business members have a formal whistleblower policy, you'll find them in the Business Members Directory.
