Whistleblowers and Not-for-Profits: Managing Legal Risk, Mental Health and Reputation

Few words can shift the mood in a boardroom as quickly as the term “whistleblowing.”

Whistleblowing can feel confronting for an organisation, often forcing organisations to confront uncomfortable realities. These could be concerns in the form of unaddressed legal risk, reputational threats, substandard staff wellbeing, and breaches of public trust.

However, when handled well, whistleblowing can also help organisations identify problems early, protect people and strengthen governance.

For not-for-profits and charities, whistleblowing is in equal parts a governance, cultural, workplace safety, and legal issue. How boards, executives, and HR teams respond can either increase legal and reputational risk, or build trust and reduce harm.

Key Takeaways

This article discusses:

• What is a whistleblower?
• Is my company or incorporated association captured under whistleblower protection laws?
• What types of reports and disclosures are protected by whistleblowing laws?
• How does the law protect whistleblowers making protected disclosures?
• Does my organisation need a whistleblowing policy? What should it contain?
• What are practical steps for managing whistleblowing well and reducing risk?

What is a whistleblower?

A whistleblower is someone who reports misconduct, illegal activity or an improper state of affairs within an organisation. Whistleblowers can come in many different shapes and forms. Officers, employees, suppliers (and their employees), and associates of an organisation, including select family members of such persons, can all be whistleblowers.

In a not-for-profit context, whistleblowers will often report concerns relating to:

• financial and taxation mismanagement;
• potential breaches of directors’ duties or Commonwealth laws;
• instances of fraud or corruption;
• serious governance or compliance failures;
• conduct which endangers public safety or poses arisk to the natural environment.

Is your organisation subject to the whistleblower protection laws?

The Corporations Act 2001 (Cth) (Corporations Act) and the Taxation Administration Act 1953 (Cth) provide protections for whistleblowers who report in good faith on certain kinds of misconduct (the Fair Work Act 2009 (Cth) can also operate to provide indirect safeguards to whistleblowers exercising “workplace rights”).

Relevantly, these laws generally apply to companies limited by guarantee, and to incorporated associations that carry out significant trading or financial activities – both being organisational structures commonly utilised by not-for-profit and charitable entities.

Why whistleblowing matters to not-for-profits and charitable entities

Not-for-profits and charities operate under intense public scrutiny. Because these organisations benefit from substantial community goodwill, their donors, members, regulators, and the broader community expect them to uphold high standards of ethical conduct and workplace safety.

Charities and not-for-profits which do not understand their roles regarding whistleblower protections are at greater risk of:

• psychological injury claims from victimised workers (especially if the whistleblower has been unfairly dismissed or has experienced harm because of their whistleblowing);
• regulatory investigations deriving from organisational mismanagement;
• disclosures being made to journalists or Members of Parliament who can publicly expose organisational failures; and
• loss of funding, donor confidence and community trust stemming from the organisation failing to uphold community expectations of safety and moral conduct.

For boards and HR leaders, the mental health dimension of whistleblowing is a critical consideration. For example, if there is unlawful workplace retaliation against a whistleblower, and psychological harm is caused to the whistleblower as a result, this may cause the organisation to breach its obligations under Work Health and Safety laws to minimise psychosocial hazards.

What types of reports and disclosures are protected?

Not every complaint made by a whistleblower is a protected disclosure. Whether legal protections apply generally depends on who makes the disclosure, to whom it is made, and the content of the disclosure.

For example, under the Corporations Act, a disclosure is generally protected if:

1. The organisation is one to which the whistleblower protection laws apply;
2. The person making the disclosure is an eligible whistleblower (this requires the person to have a particular relationship with the organisation – such as being an employee, officer or associate of the entity);
3. The disclosure is made to an eligible recipient (such as a director, senior manager, auditor, or a regulator like ASIC or APRA – and can include legal practitioners in some instances); and
4. The person (whistleblower) has reasonable grounds to suspect, on the part of the organisation or its officers or employees:
   
   1. misconduct or an improper state of affairs;
   2. certain legislative breaches (including breaches of specifically named legislation or other Commonwealth laws punishable by imprisonment for at least 12 months); or
   3. conduct posing a danger to the public or the financial system.

What is not usually protected?

Disclosures which are ‘personal work-related grievances’ are normally excluded from protection. These are complaints that relate only to the individual’s employment or former employment and do not have broader implications for the organisation or another regulated entity (e.g. interpersonal conflicts, promotion decisions, or disciplinary actions affecting only the individual).

Public interest and emergency disclosures

In limited circumstances, a whistleblower may also disclose information to a journalist or a Member of Parliament and still receive protection. This can occur where:

• the whistleblower reasonably believes the organisation has not acted on a previous disclosure, and there are reasonable grounds to suggest making a further disclosure would be in the public interest (public interest disclosure); or
• a previous disclosure has been made, and there are reasonable grounds to believe there remains a substantial and imminent danger to health, safety or the environment (emergency disclosure).

For not-for-profits, the reputational impact of public disclosures can be severe and long-lasting, so acting promptly and with due care is essential.

What protections are afforded to whistleblowers?

Whistleblowers who make a protected disclosure are afforded the following protections:

• Identity protection: A person must not disclose a whistleblower’s identity (including any information that may lead to identification), without the whistleblower’s consent; ‍
• Protection from retaliation: A person must not cause, or threaten to cause, detriment to a whistleblower because they made a protected disclosure;‍
• Immunity from liability: A whistleblower cannot be sued or prosecuted, nor can their contract be terminated, for making a qualifying disclosure;‍
• Compensation: If a whistleblower suffers harm because they made a protected disclosure, they may have access to court remedies such as compensation, injunctions, reinstatement and even exemplary damages.

Does your not-for-profit need a whistleblower policy?

Under the Corporations Act, public companies (including not-for-profits structured as public companies limited by guarantee) and large proprietary companies must have a written whistleblower policy and make it available to all staff and officers.

However, there is an exemption for smaller organisations. Charities and not-for-profits structured as public companies limited by guarantee with an annual consolidated revenue of less than $1 million are not required to have a formal policy. Importantly, this exemption does not relieve the organisation from otherwise complying with the whistleblower protections discussed above.

Even when not legally required, having a clear, well-implemented whistleblower policy can help facilitate a healthy workplace culture in which workers feel comfortable raising instances of risk and poor practice with management. For ACNC-registered charities in particular, adopting a whistleblower policy also supports compliance with the ACNC Governance Standards by embedding good governance practices and demonstrating transparency and accountability.

What should be included in a whistleblower policy?

A well-designed whistleblower policy will set out:

• the protections available to whistleblowers;
• who can receive protected disclosures and how disclosures can be made;
• how the organisation will support whistleblowers and protect them from detriment;
• how disclosures will be investigated;
• how people named in disclosures will be treated fairly;
• how the policy will be made available to officers and employees; and
• any other matters required by law or regulation.

Practicalsteps for boards, executives and HR

To managewhistleblowing well and reduce risk, organisations should:

1. Treat whistleblowing as a governance and culture issue: Include whistleblower reporting in board risk discussions and seek assurances that reports are handled properly.‍
2. Review policies and procedures: Check that organisational policies and procedures reflect current legal requirements, clearly identify reporting channels, and explain how confidentiality will be protected.‍
3. Train leaders and managers: Help your staff recognise protected disclosures, avoid retaliation, escalate concerns and support psychological safety.‍
4. Monitor wellbeing risks: Consider risks to the whistleblower, to the people named in the disclosure, and to others affected by the process.‍
5. Document key decisions: Keep clear records of how disclosures were assessed, what action was taken, and how detriment was prevented.‍
6. Build a speak-up culture: Encourage the early-raising of concerns, respond constructively, and avoid treating whistleblowers as troublemakers.

Need help navigating NFP or charity law?

We exclusively support charities and NFPs, so we have a specialised and in-depth knowledge of the practical legal, regulatory, and governance needs of these organisations.

Contact us today to review your compliance and ensure you are up to date.

Call us on 07 3160 0010, email reception@nfplawyers.com.au, or submit a contact form to arrange a consultation.