ASIC RG 270 — ASIC Regulatory Guide – RG 270 Whistleblower policies

Page 1 REGULATORY GUIDE 270 Whistleblower policies November 2019 About this guide This guide is for entities that must have a whistleblower policy under the Corporations Act—public companies, large proprietary companies and proprietary companies that are trustees of registrable superannuation entities. It gives guidance to help these entities establish a whistleblower policy that complies with their legal obligations. It also contains our good practice guidance on implementing and maintaining a whistleblower policy. This guide will also help entities that are not required to have a whistleblower policy but are required to manage whistleblowing in accordance with the Corporations Act. Note: From 27 July 2020, applications for relief should be submitted through the ASIC Regulatory Portal. For more information, see how you apply for relief. Page 2 REGULATORY GUIDE 270: Whistleblower policies © Australian Securities and Investments Commission November 2019 Page 2 About ASIC regulatory documents In administering legislation ASIC issues the following types of regulatory documents. Consultation papers: seek feedback from stakeholders on matters ASIC is considering, such as proposed relief or proposed regulatory guidance. Regulatory guides: give guidance to regulated entities by:  explaining when and how ASIC will exercise specific powers under legislation (primarily the Corporations Act)  explaining how ASIC interprets the law  describing the principles underlying ASIC’s approach  giving practical guidance (e.g. describing the steps of a process such as applying for a licence or giving practical examples of how regulated entities may decide to meet their obligations). Information sheets: provide concise guidance on a specific process or compliance issue or an overview of detailed guidance. Reports: describe ASIC compliance or relief activity or the results of a research project. Document history This regulatory guide was issued in November 2019 and is based on legislation and regulations as at the date of issue. The note on the front page was inserted on 27 July 2020. Disclaimer This guide does not constitute legal advice. We encourage you to seek your own professional advice to find out how the Corporations Act 2001 and other applicable laws apply to you, as it is your responsibility to determine your obligations. This guide includes examples to help entities comply with their obligations; they are not exhaustive. Page 3 REGULATORY GUIDE 270: Whistleblower policies © Australian Securities and Investments Commission November 2019 Page 3 Contents A Overview ........................................................................................... 4 The importance of whistleblower policies .......................................... 4 Entities that must have a whistleblower policy .................................. 5 Requirement to have a whistleblower policy ..................................... 6 Complying with the requirements ...................................................... 7 Summary of our guidance.................................................................. 7 Our regulatory powers ..................................................................... 12 B Guidance on establishing a whistleblower policy ..................... 13 Approach to our guidance................................................................ 13 Purpose of the policy ....................................................................... 15 Who the policy applies to ................................................................. 16 Matters the policy applies to ............................................................ 18 Who can receive a disclosure .......................................................... 22 How to make a disclosure................................................................ 26 Legal protections for disclosers ....................................................... 27 Support and practical protection for disclosers................................ 31 Handling and investigating a disclosure .......................................... 34 Ensuring fair treatment of individuals mentioned in a disclosure .... 38 Ensuring the policy is easily accessible ........................................... 39 C Good practice guidance on implementing and maintaining a whistleblower policy...................................................................... 42 Fostering a whistleblowing culture ................................................... 42 Roles and responsibilities under a policy ........................................ 43 Ensuring the privacy and security of personal information .............. 44 Monitoring and reporting on the effectiveness of the policy ............ 44 Reviewing and updating the policy .................................................. 46 Key terms ............................................................................................... 47 Related information ............................................................................... 51 Page 4 REGULATORY GUIDE 270: Whistleblower policies © Australian Securities and Investments Commission November 2019 Page 4 A Overview Key points The Corporations Act 2001 (Corporations Act) provides a consolidated whistleblower protection regime for Australia’s corporate sector: see Pt 9.4AAA. The regime requires public companies, large proprietary companies and proprietary companies that are trustees of registrable superannuation entities to have a whistleblower policy and make the policy available to their officers and employees. We have developed this guidance to help these entities establish a whistleblower policy that complies with the obligations under the Corporations Act. We have also included some good practice tips and good practice guidance—which are not mandatory. Under the regime, ASIC has the power to grant relief from the requirement to have a whistleblower policy in some limited circumstances. The importance of whistleblower policies RG 270.1 Transparent whistleblower policies are essential to good risk management and corporate governance. They help uncover misconduct that may not otherwise be detected. Often, such wrongdoing only comes to light because of individuals (acting alone or together) who are prepared to disclose it, sometimes at great personal and financial risk. RG 270.2 Whistleblower policies help: (a) provide better protections for individuals who disclose wrongdoing (disclosers); (b) improve the whistleblowing culture of entities and increase transparency in how entities handle disclosures of wrongdoing; (c) encourage more disclosures of wrongdoing; and (d) deter wrongdoing, promote better compliance with the law and promote a more ethical culture, by increasing awareness that there is a higher likelihood that wrongdoing will be reported. Page 5 REGULATORY GUIDE 270: Whistleblower policies © Australian Securities and Investments Commission November 2019 Page 5 Entities that must have a whistleblower policy RG 270.3 This guide is for entities that must have a whistleblower policy and make it available to their officers and employees, which are: (a) public companies; (b) large proprietary companies; and (c) proprietary companies that are trustees of registrable superannuation entities (within the meaning of the Superannuation Industry (Supervision) Act 1993 (SIS Act)). Note 1: See s1317AI of the Corporations Act. Note 2: In this guide, references to sections (s) and parts (Pts) are to the Corporations Act, unless otherwise specified. RG 270.4 It is important to note that the whistleblower protections in Pt 9.4AAA are available to any discloser who makes a disclosure that qualifies for protection, regardless of whether the entity that is the subject of the disclosure must have a whistleblower policy. Public companies RG 270.5 All public companies must have a whistleblower policy, including listed companies and public companies that are owned or controlled by the Commonwealth: see s1317AI(1). Large proprietary companies RG 270.6 All large proprietary companies must have a whistleblower policy: see s1317AI(2). RG 270.7 A proprietary company is a large proprietary company for a financial year if it has at least two of the following characteristics: (a) the consolidated revenue for the financial year of the company and any entities it controls is $50 million or more; (b) the value of the consolidated gross assets at the end of the financial year of the company and any entities it controls is $25 million or more; and (c) the company, and any entities it controls, has 100 or more employees at the end of the financial year. Note: See s45A(3) of the Corporations Act and the Corporations Amendment (Proprietary Company Thresholds) Regulations 2019. RG 270.8 Once a proprietary company qualifies as a large proprietary company during a financial year, it must have a whistleblower policy and make it available to its officers and employees within six months after the end of that financial year. The company must continue to maintain and make available its whistleblower policy in all subsequent financial years in which it qualifies as a large proprietary company. Page 6 REGULATORY GUIDE 270: Whistleblower policies © Australian Securities and Investments Commission November 2019 Page 6 Trustees of registrable superannuation entities RG 270.9 All public companies and proprietary companies that are trustees of registrable superannuation entities (within the meaning of the SIS Act) must have a whistleblower policy: see s1317AI(1) and 1317AI(3). Other entities that may benefit from this guidance RG 270.10 The information in this guide will also help entities that would like to establish mechanisms for managing disclosures on a voluntary basis, since they are required to manage whistleblowing in accordance with the Corporations Act: see RG 270.4. Requirement to have a whistleblower policy RG 270.11 Section 1317AI(5) requires entities to have a whistleblower policy that covers information about: (a) the protections available to whistleblowers, including protections under the Corporations Act; (b) to whom disclosures that qualify for protection under the Corporations Act may be made, and how they may be made; (c) how the entity will support whistleblowers and protect them from detriment; (d) how the entity will investigate disclosures that qualify for protection under the Corporations Act; (e) how the entity will ensure fair treatment of its employees who are mentioned in disclosures that qualify for protection, or its employees who are the subject of disclosures; (f) how the policy will be made available to officers and employees of the entity; and (g) any matters prescribed by regulations. RG 270.12 An entity’s whistleblower policy should also include information about the protections provided in the tax whistleblower regime under Part IVD of the Taxation Administration Act 1953 (Taxation Administration Act): see the Revised Explanatory Memorandum to the Treasury Laws Amendment (Enhancing Whistleblower Protections) Bill 2018 (Whistleblower Protections Bill). We have included references to the Taxation Administration Act in this regulatory guide, where relevant. For further information about the protections under the tax whistleblower regime, see the webpage of the Australian Taxation Office (ATO) on tax whistleblowers. Note: Since public companies, large proprietary companies and trustees of registrable superannuation entities are required to have a whistleblower policy under the Corporations Act, such a requirement has not been included in the tax whistleblower provisions. Page 7 REGULATORY GUIDE 270: Whistleblower policies © Australian Securities and Investments Commission November 2019 Page 7 Complying with the requirements RG 270.13 To ensure entities have a whistleblower policy that sufficiently meets the objectives set out in RG 270.1–RG 270.2, we expect entities to: (a) establish a whistleblower policy that: (i) is aligned to the nature, size, scale and complexity of the entity’s business; (ii) is supported by processes and procedures for effectively dealing with disclosures received under the policy; and (iii) uses a positive tone and language that encourages the disclosure of wrongdoing; (b) take steps to give effect to their whistleblower policy by ensuring that the policy is implemented appropriately and consistently carried out in practice; and (c) have arrangements in place for periodically reviewing and updating their whistleblower policy to ensure issues are identified and rectified. RG 270.14 An entity’s board is ultimately responsible for the entity’s whistleblower policy, as part of the entity’s broader risk management and corporate governance framework. It is important for an entity’s board (either directly or through its audit or risk committee) to ensure that the broader trends, themes and/or emerging risks highlighted by the disclosures made under its policy are addressed and mitigated by the entity as part of its risk management and corporate governance work plans. Summary of our guidance RG 270.15 In Section B, we provide guidance on establishing a whistleblower policy. Section B includes: (a) the matters that must be addressed by an entity’s whistleblower policy; (b) examples of content for a whistleblower policy, which entities can adapt to their circumstances; and (c) some good practice tips, which are contained in grey boxes—the good practice tips are not mandatory. RG 270.16 For a summary of Section B, see Table 1. RG 270.17 In Section C, we provide good practice guidance on implementing and maintaining a whistleblower policy. This guidance is not mandatory. For a summary, see Table 2. Page 8 REGULATORY GUIDE 270: Whistleblower policies © Australian Securities and Investments Commission November 2019 Page 8 Table 1: Summary of our guidance on establishing a whistleblower policy Component Guidance (relating to the requirements in s1317AI(5)) More information Good practice tips (non-mandatory) Purpose of the policy (see s1317AI) The policy must include a brief explanation about the purpose of the policy. RG 270.39– RG 270.40 Good practice tip 1: State the importance of the entity’s whistleblower policy Who the policy applies to (see s1317AI(5)(a)) An entity’s whistleblower policy must identify the different types of disclosers within and outside the entity who can make a disclosure that qualifies for protection (i.e. ‘eligible whistleblowers’). The policy must set out the criteria for a discloser to qualify for protection as a whistleblower under the Corporations Act. RG 270.41– RG 270.46 Good practice tip 2: Encourage those who are aware of wrongdoing to speak up Matters the policy applies to (see s1317AI(5)(a)) An entity’s whistleblower policy must identify the types of wrongdoing that can be reported (i.e. ‘disclosable matters’), based on the entity’s business operations and practices. In addition, the policy must outline the types of matters that are not covered by the policy (e.g. personal work-related grievances). The policy must state that disclosures that are not about ‘disclosable matters’ do not qualify for protection under the Corporations Act. RG 270.47– RG 270.63 Good practice tip 3: Provide information about how to internally raise grievances that are not covered by the policy Good practice tip 4: Include a statement discouraging deliberate false reporting Who can receive a disclosure (see s1317AI(5)(b)) An entity’s whistleblower policy must identify the types of people within and outside the entity who can receive a disclosure that qualifies for protection— that is:  ‘eligible recipients’;  legal practitioners;  regulatory bodies and other external parties; and  journalists and members of Commonwealth, state or territory parliaments (parliamentarians), under certain circumstances. The policy must also include information about who a discloser can contact to obtain additional information before making a disclosure. RG 270.64– RG 270.78 Good practice tip 5: Encourage disclosures to the entity in the first instance Good practice tip 6: Use independent whistleblowing service providers when necessary Good practice tip 7: Provide advice about how to make a disclosure to an external party Page 9 REGULATORY GUIDE 270: Whistleblower policies © Australian Securities and Investments Commission November 2019 Page 9 Component Guidance (relating to the requirements in s1317AI(5)) More information Good practice tips (non-mandatory) How to make a disclosure (see s1317AI(5)(b)) An entity’s whistleblower policy must include information about how to make a disclosure. The policy must outline the different options available for making a disclosure. The options should allow for disclosures to be made anonymously and/or confidentially, securely and outside of business hours. The policy must include information about how to access each option, along with the relevant instructions. The policy must advise that disclosures can be made anonymously and still be protected under the Corporations Act. RG 270.79– RG 270.86 Not applicable Legal protections for disclosers (see s1317AI(5)(a)) An entity’s whistleblower policy must include information about the protections available to disclosers who qualify for protection as a whistleblower, including the protections under the Corporations Act. These protections are:  identity protection (confidentiality);  protection from detrimental acts or omissions;  compensation and remedies; and  civil, criminal and administrative liability protection. RG 270.87– RG 270.105 Not applicable Support and practical protection for disclosers (see s1317AI(5)(c)) An entity’s whistleblower policy must outline the entity’s measures for supporting disclosers and protecting disclosers from detriment in practice. The policy must provide examples of how the entity will, in practice:  protect the confidentiality of a discloser’s identity; and  protect disclosers from detrimental acts or omissions. RG 270.106– RG 270.110 Good practice tip 8: Explain how the entity will protect confidentiality when initially dealing with a discloser Good practice tip 9: Establish processes for assessing and controlling the risk of detriment Page 10 REGULATORY GUIDE 270: Whistleblower policies © Australian Securities and Investments Commission November 2019 Page 10 Component Guidance (relating to the requirements in s1317AI(5)) More information Good practice tips (non-mandatory) Handling and investigating a disclosure (see s1317AI(5)(d)) An entity’s whistleblower policy must include information about how the entity will investigate disclosures that qualify for protection. The policy must outline the key steps the entity will take after it receives a disclosure, including how it:  investigates a disclosure;  keeps a discloser informed; and  documents, reports internally and communicates to the discloser the investigation findings. RG 270.111– RG 270.124 Good practice tip 10: Determine whether the location and time are appropriate for receiving a disclosure Good practice tip 11: Focus on the substance, rather than the motive, of disclosures Good practice tip 12: Outline the factors that the entity will consider when investigating a disclosure Good practice tip 13: Ensure investigations follow best practice Good practice tip 14: Provide an avenue for review Ensuring fair treatment of individuals mentioned in a disclosure (see s1317AI(5)(e)) An entity’s whistleblower policy must include information about how the entity will ensure the fair treatment of employees who are mentioned in a disclosure that qualifies for protection, including those who are the subject of a disclosure. RG 270.125– RG 270.127 Not applicable Ensuring the policy is easily accessible (see s1317AI(5)(f)) An entity’s whistleblower policy must cover how the policy will be made available to the entity’s officers and employees. It must outline the entity’s measures for ensuring its policy is widely disseminated to and easily accessible by disclosers within and outside the entity (e.g. through upfront and ongoing education and training for its employees). An entity should make its policy available on its external website. RG 270.128– RG 270.139 Good practice tip 15: Demonstrate the entity’s commitment to the policy by promoting it actively and regularly Good practice tip 16: Provide upfront and ongoing training to all staff Page 11 REGULATORY GUIDE 270: Whistleblower policies © Australian Securities and Investments Commission November 2019 Page 11 Table 2: Summary of our good practice guidance on implementing and maintaining a whistleblower policy Component Good practice guidance (non-mandatory) More information Fostering a whistleblowing culture It is important for an entity to create a positive and open environment:  so that employees feel they can come forward to make a disclosure; and  to help eliminate the negative connotations associated with whistleblowing. The senior leadership team plays an important role in demonstrating the entity’s commitment to its whistleblower policy. RG 270.140– RG 270.143 Roles and responsibilities It is good practice for an entity to allocate key roles and responsibilities under its whistleblower policy. An entity could create new roles. Alternatively, the responsibilities could be integrated into existing roles. Staff members may hold more than one role, provided it does not result in conflicts of interest. RG 270.144– RG 270.146 Ensuring the privacy and security of personal information It is good practice for an entity to have appropriate information technology resources and organisational measures for securing the personal information they receive, handle and record as part of their whistleblower policy. It is important for an entity to consult the Australian Privacy Principles (APPs) and other relevant industry, government and technology-specific standards, guidance and frameworks on data security to help safeguard their information. RG 270.147– RG 270.149 Monitoring and reporting on the effectiveness of the policy It is important for an entity to have mechanisms in place for monitoring the effectiveness of its whistleblower policy and ensuring compliance with its legal obligations. An entity could set up:  oversight arrangements for ensuring its board or audit or risk committee are kept informed about the effectiveness of the entity’s policy, processes and procedures—and can intervene when necessary—while preserving confidentiality;  a mechanism to enable matters to be escalated to the entity’s board or the audit or risk committee, when required; and  periodic reporting to the board or audit or risk committee. RG 270.150– RG 270.157 Reviewing and updating the policy It is good practice for an entity to review its whistleblower policy, processes and procedures on a periodic basis (e.g. every two years). It is also good practice to rectify any issues identified in the review in a timely manner. RG 270.158– RG 270.160 Page 12 REGULATORY GUIDE 270: Whistleblower policies © Australian Securities and Investments Commission November 2019 Page 12 Our regulatory powers Power to grant relief by legislative instrument RG 270.18 Under the regime, ASIC has the power to make an order by legislative instrument to relieve a specified class of entities from the requirement to have a whistleblower policy: see s1317AJ. RG 270.19 We can only use this power in some limited circumstances—specifically, if the benefits of the whistleblower policy requirement, in encouraging good corporate culture and governance, are outweighed by reduced flexibility and unnecessarily high compliance costs (as outlined in the Revised Explanatory Memorandum to the Whistleblower Protections Bill). For further information, see Regulatory Guide 51 Applications for relief (RG 51). Companies that are not-for-profits or charities RG 270.20 We have granted relief to small not-for-profits or charities—that is, companies limited by guarantee that have revenue (or consolidated revenue, if that applies) for the financial year of less than $1 million: see ASIC Corporations (Whistleblower Policies) Instrument 2019/1146. RG 270.21 The revenue threshold for the relief is consistent with: (a) the threshold for the full financial reporting and auditing requirements that apply to companies limited by guarantee under the Corporations Act; and (b) the threshold for large charities registered with the Australian Charities and Not-for-profits Commission. RG 270.22 We have provided this relief to take a similar approach for proprietary companies and public companies, while accounting for the differences in the regulatory requirements that apply to these corporate structures. Small proprietary companies are not required to have a whistleblower policy: see s1317AI(2). However, s1317AI(1) requires all public companies, including small companies limited by guarantee, to have a policy. Penalty for non-compliance RG 270.23 ASIC is responsible for administering the whistleblower protection provisions in the Corporations Act, including the whistleblower policy requirement. Periodically, ASIC will conduct surveillance activities to ensure compliance with the obligations and pursue non-compliance in accordance with our enforcement approach and operational priorities. For further information, see Information Sheet 151 ASIC’s approach to enforcement (INFO 151). RG 270.24 Failure to comply with the requirement to have and make available a whistleblower policy is an offence of strict liability with a penalty of 60 penalty units for individuals and companies (currently $12,600), enforceable by ASIC: see s1317AI(4) and 1311(1). Page 13 REGULATORY GUIDE 270: Whistleblower policies © Australian Securities and Investments Commission November 2019 Page 13 B Guidance on establishing a whistleblower policy Key points This section provides guidance to help entities establish a whistleblower policy that complies with their legal obligations. We have included examples of content for a whistleblower policy where relevant. Entities should adapt the examples to their circumstances when establishing their whistleblower policy. This section also includes a series of ‘good practice tips’. Each of the good practice tips is contained in a grey box. It is not mandatory for entities to follow these tips when establishing their whistleblower policy. Approach to our guidance Matters that must be addressed by an entity’s whistleblower policy RG 270.25 This section covers the following matters that must be addressed by an entity’s whistleblower policy: (a) purpose of the policy (see RG 270.39–RG 270.40); (b) who the policy applies to (see RG 270.41–RG 270.46); (c) matters the policy applies to (see RG 270.47–RG 270.63); (d) who can receive a disclosure (see RG 270.64–RG 270.78); (e) how to make a disclosure (see RG 270.79–RG 270.86); (f) legal protections for disclosers (see RG 270.87–RG 270.105); (g) support and practical protection for disclosers (see RG 270.106– RG 270.110); (h) handling and investigating a disclosure (see RG 270.111–RG 270.124); (i) ensuring fair treatment of individuals mentioned in a disclosure (see RG 270.125–RG 270.127); and (j) ensuring the policy is easily accessible (see RG 270.128–RG 270.139). RG 270.26 The matters we have included reflect all stages of the whistleblowing process: (a) receiving a disclosure (including providing advice to individuals who are considering making a disclosure); (b) assessing how a discloser should be supported and protected; (c) assessing whether a disclosure should be investigated; Page 14 REGULATORY GUIDE 270: Whistleblower policies © Australian Securities and Investments Commission November 2019 Page 14 (d) undertaking an investigation; (e) supporting and protecting a discloser during and after the investigation; (f) communicating with a discloser, including about the outcome of an investigation; and (g) ensuring oversight and monitoring by the entity’s board. RG 270.27 Our guidance reflects that, if a discloser seeks compensation and other remedies through the courts because they have suffered detriment, including because a discloser’s employer failed to prevent detriment from occurring, the court may take into account the extent to which the employer gave effect to their whistleblower policy (if the entity has a policy in place): see s1317AE(3)(b). RG 270.28 In addition, the guidance is consistent with research on whistleblowing management. Research indicates that an entity’s whistleblower policy plays a critical role in the overall management of whistleblowing by the entity; however: (a) having a formal whistleblower policy is not enough; and (b) even if the objectives and approach of a whistleblower policy are correct, the policy will not be meaningful and effective unless it is implemented consistently and applied throughout the entity in practice. Note: See AJ Brown et al, Clean as a whistle: A five step guide to better whistleblowing policy and practice in business and government—Key findings and actions of Whistling While They Work 2 (PDF 4.95MB), Griffith University, August 2019. ASIC is a member of the Whistling While They Work 2 research project. Structuring, drafting and presenting a whistleblower policy RG 270.29 This section is also intended to provide entities with a potential structure from which to develop their own whistleblower policy. Entities may wish to use the list of ‘matters that must be addressed by an entity’s whistleblower policy’ in RG 270.25 as headings for the different sections of their policy. RG 270.30 Entities, particularly smaller entities, may wish to refer to relevant materials on whistleblowing from ASIC, the Australian Prudential Regulation Authority (APRA) or the Australian Taxation Office (ATO) in their policy. RG 270.31 The way an entity drafts its whistleblower policy (including any processes and procedures it may have to support the policy) will influence how its employees comprehend and retain the policy. RG 270.32 As the users of a whistleblower policy may have different requirements and needs, an entity should consider them when planning and developing the document. RG 270.33 This section uses the language of the legal requirements under the Corporations Act to help entities establish a whistleblower policy that complies with their Page 15 REGULATORY GUIDE 270: Whistleblower policies © Australian Securities and Investments Commission November 2019 Page 15 legal obligations. To ensure an entity’s whistleblower policy is clear and easy to understand for the users of the document, we encourage entities to: (a) use plain English and avoid legal or industry jargon; (b) adopt a simple structure, including a contents list and clear headings; and (c) include diagrams and/or flowcharts, where relevant. RG 270.34 The requirement to have a whistleblower policy applies to entities of varying sizes that operate in different sectors. We recognise that there is no one-size- fits-all whistleblower policy. We expect an entity to analyse how best to structure, draft and present its policy. We also expect an entity to consider other standards and guidelines to ensure its whistleblower policy, processes and procedures incorporate current developments in preventing and responding to misconduct. RG 270.35 Regardless of how an entity structures, drafts and presents its whistleblower policy, we expect the content to cover the information required under s1317AI(5) and this guidance. Examples of content for a whistleblower policy RG 270.36 This section includes examples of content for a whistleblower policy, including examples that relate to measures and/or mechanisms for receiving, handling, and investigating disclosures. Entities should adapt these examples to their circumstances when establishing their whistleblower policy. Good practice tips RG 270.37 This section also includes ‘good practice tips’ relating to some of the matters that must be addressed by an entity’s whistleblower policy. RG 270.38 Each of the good practice tips is contained in a grey box. Entities are not required to follow the tips when establishing their whistleblower policy. We encourage entities to incorporate them into their whistleblower policy and whistleblower processes and procedures, if they are relevant to their circumstances and/or would benefit the users of their policy. Purpose of the policy RG 270.39 Section 1317AI requires entities to have a whistleblower policy. RG 270.40 To assist users of an entity’s whistleblower policy, the policy must include a brief explanation about the purpose of the policy. Page 16 REGULATORY GUIDE 270: Whistleblower policies © Australian Securities and Investments Commission November 2019 Page 16 Examples: Purpose of a policy An entity’s policy may include the following as the purpose of its policy (where applicable): • to encourage more disclosures of wrongdoing; • to help deter wrongdoing, in line with the entity’s risk management and governance framework; • to ensure individuals who disclose wrongdoing can do so safely, securely and with confidence that they will be protected and supported; • to ensure disclosures are dealt with appropriately and on a timely basis; • to provide transparency around the entity’s framework for receiving, handling and investigating disclosures; • to support the entity’s values, code of conduct and/or ethics policy; • to support the entity’s long-term sustainability and reputation; • to meet the entity’s legal and regulatory obligations; and • to align with the ASX Corporate Governance Principles and Recommendations (which applies to listed companies) and relevant standards. Good practice tip 1: State the importance of the entity’s whistleblower policy An entity’s policy may explain that the entity’s whistleblower policy is an important tool for helping the entity to identify wrongdoing that may not be uncovered unless there is a safe and secure means for disclosing wrongdoing. Good practice tip 2: Encourage those who are aware of wrongdoing to speak up An entity’s policy may include specific statements encouraging the entity’s employees (and non-employees) who are aware of possible wrongdoing to have the confidence to speak up. Who the policy applies to RG 270.41 An entity’s whistleblower policy must include information about the protections under the Corporations Act that are available to disclosers who qualify for protection as a whistleblower: see s1317AI(5)(a). RG 270.42 To assist users of an entity’s whistleblower policy, the policy must identify the different types of disclosers within and outside the entity who can make a disclosure that qualifies for protection under the Corporations Act (i.e. ‘eligible whistleblowers’). Page 17 REGULATORY GUIDE 270: Whistleblower policies © Australian Securities and Investments Commission November 2019 Page 17 RG 270.43 If an entity is a body corporate, an eligible whistleblower is an individual who is, or has been, any of the following in relation to the entity: (a) an officer or employee (e.g. current and former employees who are permanent, part-time, fixed-term or temporary, interns, secondees, managers, and directors); (b) a supplier of services or goods to the entity (whether paid or unpaid), including their employees (e.g. current and former contractors, consultants, service providers and business partners); (c) an associate of the entity; and (d) a relative, dependant or spouse of an individual in RG 270.43(a)– RG 270.43(c) (e.g. relatives, dependants or spouse of current and former employees, contractors, consultants, service providers, suppliers and business partners). Note: See s1317AAA of the Corporations Act. Also see s14ZZU of the Taxation Administration Act. RG 270.44 If an entity is a superannuation entity, an eligible whistleblower is an individual who is, or has been, any of the following in relation to the entity: (a) a trustee, custodian or investment manager, including their employees; (b) a supplier of services or goods to the trustee, custodian or investment manager (whether paid or unpaid), including their employees; (c) an officer, employee or supplier of services or goods (whether paid or unpaid, including their employees) of a body corporate that is a trustee, custodian or investment manager of a superannuation entity; or (d) a relative, dependant or spouse of an individual in RG 270.44(a)– RG 270.44(c). Note: See s1317AAA. RG 270.45 An entity’s policy must set out that a discloser qualifies for protection as a whistleblower under the Corporations Act if they are an eligible whistleblower in relation to the entity and: (a) they have made a disclosure of information relating to a ‘disclosable matter’ directly to an ‘eligible recipient’ or to ASIC, APRA or another Commonwealth body prescribed by regulation; (b) they have made a disclosure to a legal practitioner for the purposes of obtaining legal advice or legal representation about the operation of the whistleblower provisions in the Corporations Act; or (c) they have made an ‘emergency disclosure’ or ‘public interest disclosure’. Note: See s1317AA, 1317AAA, 1317AAC and 1317AAD of the Corporations Act. ‘Disclosable matters’ and ‘eligible recipients’ are explained in RG 270.50–RG 270.57 and RG 270.67–RG 270.71. Also see s14ZZT, 14ZZU and 14ZZV of the Taxation Administration Act. Disclosures pertaining to tax matters are referred to as ‘disclosures qualifying for protection’. Disclosures qualifying for protection may be made to the ATO, an eligible recipient or a legal practitioner under the Taxation Administration Act. Page 18 REGULATORY GUIDE 270: Whistleblower policies © Australian Securities and Investments Commission November 2019 Page 18 RG 270.46 In practice, the types of disclosers who are covered by an entity’s policy will depend on the entity’s business operations, practices and organisational structure and set-up. Whistleblower protection legislation varies across jurisdictions and multinational entities should take this into account when establishing their whistleblower policy. Matters the policy applies to RG 270.47 Section 1317AI(5)(a) requires an entity’s whistleblower policy to include information about the protections under the Corporations Act that are available to disclosers who qualify for protection as a whistleblower. RG 270.48 To assist users of an entity’s whistleblower policy, the policy must identify the types of wrongdoing that can be reported under the policy, based on the entity’s business operations and practices. In addition, the policy must outline the types of matters that are not covered by the policy. RG 270.49 An entity’s policy must state that disclosures that are not about disclosable matters do not qualify for protection under the Corporations Act (or the Taxation Administration Act, where relevant). The policy may note that such disclosures may be protected under other legislation, such as the Fair Work Act 2009 (Fair Work Act). Note 1: An entity may choose to establish a whistleblower policy that covers a broader range of reports about issues and concerns (e.g. breaches of the entity’s code of conduct) as part of the entity’s ‘speak up culture’. However, the policy must clearly explain that disclosers who submit reports about issues and concerns will not be able to access the whistleblower protections under the Corporations Act (or the Taxation Administration Act, where applicable). Note 2: Disclosable matters are explained in RG 270.50–RG 270.57. Disclosable matters RG 270.50 An entity’s policy must cover the types of disclosures that qualify for protection under the Corporations Act (i.e. ‘disclosable matters’): see s1317AA. RG 270.51 Disclosable matters involve information that the discloser has reasonable grounds to suspect concerns misconduct, or an improper state of affairs or circumstances, in relation to: (a) an entity; or (b) if the entity is a body corporate, a related body corporate of the entity. Note: See s1317AA(4) of the Corporations Act. Also see s14ZZT of the Taxation Administration Act. To qualify for protection under the tax whistleblower regime, the eligible whistleblower must have reasonable grounds to suspect that the information indicates misconduct or an improper state of affairs or circumstances in relation to tax affairs of the entity. The eligible whistleblower may assist the eligible recipient to perform its functions or duties in relation to those tax affairs. Page 19 REGULATORY GUIDE 270: Whistleblower policies © Australian Securities and Investments Commission November 2019 Page 19 RG 270.52 The term ‘misconduct’ is defined in s9 to include ‘fraud, negligence, default, breach of trust and breach of duty’. The phrase ‘improper state of affairs or circumstances’ is not defined and is intentionally broad. For example, ‘misconduct or an improper state of affairs or circumstances’ may not involve unlawful conduct in relation to the entity or a related body corporate of the entity but may indicate a systemic issue that the relevant regulator should know about to properly perform its functions. It may also relate to business behaviour and practices that may cause consumer harm. RG 270.53 The term ‘reasonable grounds to suspect’ is based on the objective reasonableness of the reasons for the discloser’s suspicion. It ensures that a discloser’s motive for making a disclosure, or their personal opinion of the person(s) involved, does not prevent them from qualifying for protection. In practice, a mere allegation with no supporting information is not likely to be considered as having ‘reasonable grounds to suspect’. However, a discloser does not need to prove their allegations. RG 270.54 Disclosable matters also involve information about an entity in RG 270.51, if the discloser has reasonable grounds to suspect that the information indicates those entities (including their employees or officers) have engaged in conduct that: (a) constitutes an offence against, or a contravention of, a provision of any of the following: (i) the Corporations Act; (ii) the Australian Securities and Investments Commission Act 2001; (iii) the Banking Act 1959; (iv) the Financial Sector (Collection of Data) Act 2001; (v) the Insurance Act 1973; (vi) the Life Insurance Act 1995; (vii) the National Consumer Credit Protection Act 2009; (viii) the SIS Act; (ix) an instrument made under an Act referred to in RG 270.54(a)(i)– RG 270.54(a)(viii); (b) constitutes an offence against any other law of the Commonwealth that is punishable by imprisonment for a period of 12 months or more; (c) represents a danger to the public or the financial system; or (d) is prescribed by regulation. Note: See s1317AA(5) of the Corporations Act. The more specific categories of conduct set out in s1317AA(5) do not limit the range of misconduct covered by s1317AA(4). Rather, they make clear that certain forms of conduct qualify for protection. Also see s14ZZT of the Taxation Administration Act. Disclosures pertaining to tax matters are referred to as ‘disclosures qualifying for protection’. Page 20 REGULATORY GUIDE 270: Whistleblower policies © Australian Securities and Investments Commission November 2019 Page 20 RG 270.55 An entity’s whistleblower policy must include examples of disclosable matters that relate specifically to the entity’s business operations and practices. Examples: Types of wrongdoing that could be covered by an entity’s policy An entity’s policy may cover the following types of wrongdoing (where relevant to its business operations and practices): • illegal conduct, such as theft, dealing in, or use of illicit drugs, violence or threatened violence, and criminal damage against property; • fraud, money laundering or misappropriation of funds; • offering or accepting a bribe; • financial irregularities; • failure to comply with, or breach of, legal or regulatory requirements; and • engaging in or threatening to engage in detrimental conduct against a person who has made a disclosure or is believed or suspected to have made, or be planning to make, a disclosure. RG 270.56 The policy should highlight that disclosable matters include conduct that may not involve a contravention of a particular law. It should also highlight that information that indicates a significant risk to public safety or the stability of, or confidence in, the financial system is also a disclosable matter, even if it does not involve a breach of a particular law. RG 270.57 An entity’s policy must state that a discloser can still qualify for protection even if their disclosure turns out to be incorrect. Personal work-related grievances RG 270.58 Disclosures that relate solely to personal work-related grievances, and that do not relate to detriment or threat of detriment to the discloser, do not qualify for protection under the Corporations Act: see s1317AADA(1) and 1317AC. RG 270.59 Personal work-related grievances are those that relate to the discloser’s current or former employment and have, or tend to have, implications for the discloser personally, but do not: (a) have any other significant implications for the entity (or another entity); or (b) relate to any conduct, or alleged conduct, about a disclosable matter (as set out in RG 270.51 and RG 270.54). Note: See s1317AADA(2) of the Corporations Act. Workplace grievances remain the jurisdiction of the Fair Work Act. RG 270.60 An entity’s policy must clarify that disclosures relating to personal work-related grievances do not qualify for protection under the Corporations Act. The policy should explain the meaning of ‘personal work-related grievance’ by including some examples. Page 21 REGULATORY GUIDE 270: Whistleblower policies © Australian Securities and Investments Commission November 2019 Page 21 RG 270.61 Section 1317AADA(2) includes specific examples of grievances that may be personal work-related grievances. These examples include: (a) an interpersonal conflict between the discloser and another employee; (b) a decision that does not involve a breach of workplace laws; (c) a decision about the engagement, transfer or promotion of the discloser; (d) a decision about the terms and conditions of engagement of the discloser; or (e) a decision to suspend or terminate the engagement of the discloser, or otherwise to discipline the discloser. RG 270.62 The policy must outline when a disclosure about, or including, a personal work- related grievance still qualifies for protection. RG 270.63 A personal work-related grievance may still qualify for protection if: (a) it includes information about misconduct, or information about misconduct includes or is accompanied by a personal work-related grievance (mixed report); (b) the entity has breached employment or other laws punishable by imprisonment for a period of 12 months or more, engaged in conduct that represents a danger to the public, or the disclosure relates to information that suggests misconduct beyond the discloser’s personal circumstances; (c) the discloser suffers from or is threatened with detriment for making a disclosure (see RG 270.96–RG 270.97); or (d) the discloser seeks legal advice or legal representation about the operation of the whistleblower protections under the Corporations Act (see RG 270.72). Good practice tip 3: Provide information about how to internally raise grievances that are not covered by the policy An entity’s policy may provide information about how its employees can internally raise personal work-related grievances and other types of issues or concerns that are not covered by the policy. It could also encourage employees to seek legal advice about their rights and protections under employment or contract law, and to resolve their personal work-related grievance. Discouraging false reporting Good practice tip 4: Include a statement discouraging deliberate false reporting An entity’s policy may include a statement discouraging deliberate false reporting (i.e. a report that the discloser knows to be untrue). However, an entity needs to ensure that they do not unintentionally deter staff from making disclosures (e.g. disclosers who have some information leading to a suspicion, but not all the details). Page 22 REGULATORY GUIDE 270: Whistleblower policies © Australian Securities and Investments Commission November 2019 Page 22 Who can receive a disclosure RG 270.64 Section 1317AI(5)(b) requires an entity’s whistleblower policy to include information about: (a) who can receive disclosures that qualify for protection; and (b) how disclosures may be made. RG 270.65 To assist users of an entity’s whistleblower policy, the policy must identify the types of people within and outside the entity who can receive disclosures that qualify for protection. RG 270.66 Taking into consideration that some disclosers may wish to seek additional information before formally making their disclosure, an entity’s whistleblower policy must also include information about how a discloser can obtain additional information (e.g. by contacting the entity’s whistleblower protection officer or equivalent (see RG 270.145) or an independent legal adviser). Eligible recipients in relation to the entity RG 270.67 An entity’s policy must explain the role of ‘eligible recipients’—that is, to receive disclosures that qualify for protection. The policy must highlight that a discloser needs to make a disclosure directly to one of the entity’s eligible recipients to be able to qualify for protection as a whistleblower under the Corporations Act (or the Taxation Administration Act, where relevant). RG 270.68 If an entity is a body corporate, an eligible recipient includes: (a) an officer or senior manager of the entity or related body corporate; (b) the internal or external auditor (including a member of an audit team conducting an audit) or actuary of the entity or related body corporate; and (c) a person authorised by the entity to receive disclosures that may qualify for protection. Note: See s1317AAC(1) of the Corporations Act. As set out at paragraph 2.60 in the Revised Explanatory Memorandum to the Whistleblower Protections Bill, ‘a reference to an auditor in the Bill includes both internal and external auditors’. Also see s14ZZT(2) of the Taxation Administration Act. RG 270.69 If an entity is a superannuation entity, an eligible recipient includes: (a) an officer of the entity; (b) the entity’s internal or external auditor (including a member of an audit team conducting an audit), or actuary; (c) an individual who is the trustee of the entity; (d) a director of a body corporate that is the trustee of the entity; and (e) a person authorised by the trustee(s) to receive disclosures that may qualify for protection. Note: See s1317AAC(2) of the Corporations Act. Also see s14ZZV of the Taxation Administration Act. Page 23 REGULATORY GUIDE 270: Whistleblower policies © Australian Securities and Investments Commission November 2019 Page 23 RG 270.70 Generally, an ‘officer’ includes a director or company secretary of an entity. RG 270.71 A ‘senior manager’ is generally a senior executive within an entity, other than a director or company secretary, who: (a) makes or participates in making decisions that affect the whole, or a substantial part, of the business of the entity; or (b) has the capacity to significantly affect the entity’s financial standing. Note: See s9 of the Corporations Act. Good practice tip 5: Encourage disclosures to the entity in the first instance An entity’s policy may encourage its employees and external disclosers to make a disclosure to one of the entity’s internal or external eligible recipients in the first instance. The policy could include a statement that the entity would like to identify and address wrongdoing as early as possible. In addition, it could highlight that the entity’s approach is intended to help build confidence and trust in its whistleblower policy, processes and procedures. The policy may also acknowledge that a discloser can make a disclosure directly to regulatory bodies, or other external parties, about a disclosable matter and qualify for protection under the Corporations Act without making a prior disclosure to the entity: see RG 270.73. Legal practitioners RG 270.72 An entity’s policy must highlight that disclosures to a legal practitioner for the purposes of obtaining legal advice or legal representation in relation to the operation of the whistleblower provisions in the Corporations Act are protected (even in the event that the legal practitioner concludes that a disclosure does not relate to a ‘disclosable matter’): see s1317AA(3). Note: See s14ZZT(3) of the Taxation Administration Act. Good practice tip 6: Use independent whistleblowing service providers when necessary A smaller entity may consider authorising an independent whistleblowing service provider as an eligible recipient for directly receiving disclosures (i.e. by its employees and non-employees), where it is financially viable for them to do so. The entity may also consider engaging an independent investigation firm. Alternatively, the entity may consider referring disclosers to the entity’s external eligible Page 24 REGULATORY GUIDE 270: Whistleblower policies © Australian Securities and Investments Commission November 2019 Page 24 recipients (e.g. auditor or actuary to provide better protections to disclosers). A larger entity may also consider authorising an independent whistleblowing service provider as an eligible recipient for directly receiving some of its disclosures (e.g. a telephone hotline or online platform). This may help provide greater confidence to the entity’s employees. It may also provide better access for the entity’s external disclosers. By authorising an independent whistleblower service provider, an entity may encourage more disclosures since disclosers can:  make their disclosure anonymously, confidentially, and outside of business hours;  receive updates on the status of their disclosure while retaining anonymity; and  provide additional information to the entity while retaining anonymity. Responsibility for outsourced functions It is important to note that the entity remains responsible for meeting its legal obligations for outsourced functions (e.g. obligations relating to confidentiality). The entity should ensure it undertakes appropriate due diligence before engaging an independent whistleblowing service provider and other third-party service providers. The entity should also ensure that it has mechanisms for monitoring the services outsourced. Regulatory bodies and other external parties RG 270.73 An entity’s policy must state that disclosures of information relating to disclosable matters can be made to ASIC, APRA or another Commonwealth body prescribed by regulation and qualify for protection under the Corporations Act: see s1317AA(1). Note: See s14ZZT(1) of the Taxation Administration Act. A discloser can make a disclosure to the ATO and qualify for protection. Good practice tip 7: Provide advice about how to make a disclosure to an external party An entity’s policy may provide advice about how an employee can make a disclosure outside the entity and qualify for protection. The policy could include links to whistleblowing information provided by ASIC, APRA or the ATO, such as ASIC Information Sheet 239 How ASIC handles whistleblower reports (INFO 239). Page 25 REGULATORY GUIDE 270: Whistleblower policies © Australian Securities and Investments Commission November 2019 Page 25 Public interest disclosures and emergency disclosures RG 270.74 An entity’s policy must state that disclosures can be made to a journalist or parliamentarian under certain circumstances and qualify for protection: see s1317AAD. RG 270.75 A ‘public interest disclosure’ is the disclosure of information to a journalist or a parliamentarian, where: (a) at least 90 days have passed since the discloser made the disclosure to ASIC, APRA or another Commonwealth body prescribed by regulation; (b) the discloser does not have reasonable grounds to believe that action is being, or has been taken, in relation to their disclosure; (c) the discloser has reasonable grounds to believe that making a further disclosure of the information is in the public interest; and (d) before making the public interest disclosure, the discloser has given written notice to the body in RG 270.75(a) (i.e. the body to which the previous disclosure was made) that: (i) includes sufficient information to identify the previous disclosure; and (ii) states that the discloser intends to make a public interest disclosure. Note: See s1317AAD(1). A Commonwealth body had not yet been prescribed when this regulatory guide was published. RG 270.76 An ‘emergency disclosure’ is the disclosure of information to a journalist or parliamentarian, where: (a) the discloser has previously made a disclosure of the information to ASIC, APRA or another Commonwealth body prescribed by regulation; (b) the discloser has reasonable grounds to believe that the information concerns a substantial and imminent danger to the health or safety of one or more persons or to the natural environment; (c) before making the emergency disclosure, the discloser has given written notice to the body in RG 270.76(a) (i.e. the body to which the previous disclosure was made) that: (i) includes sufficient information to identify the previous disclosure; and (ii) states that the discloser intends to make an emergency disclosure; and (d) the extent of the information disclosed in the emergency disclosure is no greater than is necessary to inform the journalist or parliamentarian of the substantial and imminent danger. Note: See s1317AAD(2). A Commonwealth body has not been prescribed at the time of publication of this guidance. RG 270.77 The policy must highlight that it is important for the discloser to understand the criteria for making a public interest or emergency disclosure. It should clarify Page 26 REGULATORY GUIDE 270: Whistleblower policies © Australian Securities and Investments Commission November 2019 Page 26 that a disclosure must have previously been made to ASIC, APRA or a prescribed body and written notice provided to the body to which the disclosure was made. It should also clarify that, in the case of a public interest disclosure, at least 90 days must have passed since the previous disclosure. RG 270.78 An entity’s policy should state that a discloser should contact an independent legal adviser before making a public interest disclosure or an emergency disclosure. How to make a disclosure RG 270.79 An entity’s whistleblower policy must include information about how to make a disclosure: see s1317AI(5)(b). RG 270.80 To assist users of an entity’s whistleblower policy, the policy must include a range of internal and external disclosure options. The options should allow for disclosures to be made anonymously and/or confidentially, securely and outside of business hours. RG 270.81 Providing an external option will help ensure that employees who are not comfortable making a disclosure internally, or feel it is inappropriate to do so, can still make a disclosure to the entity. It also sends a positive message that the entity values all disclosures and that employees should not be deterred by barriers such as threat of detriment. In addition, it better enables the entity’s non-employees (e.g. former employees and current and former suppliers) to make a disclosure to the entity. RG 270.82 An entity’s policy must include information about how to access each option, along with the relevant instructions. Examples: Information about accessing internal and external disclosure options An entity’s policy may include the following information, depending on the options available to disclosers: • information on how to contact the entity’s eli