Boost Board Skills: Master Whistleblowing Management

Rising Stakes in Whistleblowing Governance

Whistleblowing has long been a compliance checkbox for Australian corporations under Part 9.4AAA of the Corporations Act, which since 2019 has required public companies, large proprietary companies, and certain superannuation trustees to maintain whistleblower policies with strict protections against victimisation and identity breaches.

The urgency intensified in 2025 when ASIC released findings from its first comprehensive questionnaire on whistleblower programs, covering 134 entities across 18 industries. The report exposed inconsistencies: many organisations lack regular effectiveness reviews, training, or clear escalation paths to the board, leaving gaps that undermine legal protections.

ASIC followed with its inaugural enforcement outcomes for breaches of whistleblower provisions in August 2025, underscoring that non-compliance now carries tangible consequences beyond mere regulatory nudges. Directors, already bound by duties of care and diligence, risk personal exposure if they fail to ensure robust systems, particularly as misconduct reports can involve serious issues like fraud or dangers to the financial system.

Broader momentum builds from parallel developments. The Treasury continues its statutory review of the Corporations Act whistleblowing regime, while 2025 saw proposals for a Whistleblower Protection Authority—though one bill stalled—and stage 2 reforms to public sector protections under the Public Interest Disclosure Act, expected to finalise in 2026. These shifts could extend or harmonise standards into the private sector, raising the bar for board oversight.

Non-obvious tensions persist: boards must balance confidentiality mandates with their need for visibility into reports, often without clear guidance on when and how to receive anonymised summaries. Over-zealous protection can obscure patterns of wrongdoing, while leaks invite civil penalties up to AUD 1 million for individuals or higher for entities. Inaction risks undetected cultural or compliance failures, as seen in past scandals where early signals were ignored.

The concrete stakes are clear: penalties for victimisation or unauthorised disclosures include imprisonment, substantial fines, and compensation orders. ASIC's focus on benchmarking and enforcement signals that boards ignoring these signals face not just regulatory action but potential shareholder scrutiny and market fallout in an environment where governance lapses increasingly translate to share price hits.