The tough new regime imposes significant obligations on organisations, including:

• disclosures can now be made about a very broad range of issues, such as misconduct and an ‘improper state of affairs’ - although ‘personal work-related grievances’ will not be protected disclosures
• disclosures can be made by a much wider group of people, including former officers, employees and their relatives and those providing unpaid services (e.g. volunteers)
• disclosures can be made to more people including ‘senior managers’
• anonymous disclosures can now be made – this is a significant departure from the previous regime and will likely greatly increase an individual’s willingness to blow the whistle
• there is no longer a requirement to make disclosures ‘in good faith’
• emergency disclosures can be made to the media or politicians – this is also significant as it means that whistleblowers can bypass the relevant organisation when making a disclosure and still receive protections under the new regime
• the protection from victimisation for whistleblowers has been expanded and clarified to include ‘injury’ and alteration of an employee’s position
• penalties for disclosing a whistleblower’s identity or retaliating against a whistleblower of up to $1 million for individuals and $10.5 million for organisations and/or up to 2 years in prison.

The cornerstone of the new regime is the requirement for public and large proprietary companies to have a whistleblower policy which contains certain content prescribed in the legislation. A compliant policy must be in place by 1 January 2020. Failure to have such a policy will be a strict liability offence, resulting in a fine.

To be compliant with the new regime, an organisation which is required to have a whistleblower policy, must ensure that it contains the following elements:

• how and to whom an individual can make a disclosure
• how the company will support whistleblowers and protect them from detriment
• how the company will investigate disclosures that qualify for protection under the legislation
• how the company will ensure fair treatment of employees who are mentioned in whistleblower disclosures

On 13 November 2019, ASIC released guidance material to assist stakeholders with the development and implementation of a whistleblower policy that meets the requisite legislative requirements.

Are not for profit organisations covered by the new regime?

The whistleblower reforms will apply to NFP organisations that are ‘trading or financial corporations’, including incorporated organisations registered with the Australian Charities and Not-for-profits Commission. Generally, an organisation will be a trading or financial corporation if its trading or financial activities are a significant proportion of its overall activities. Trading activities involve buying and selling goods or services. Financial activities that involve borrowing, lending, investing or providing financial advice.

ASIC exemption from policy requirement

Not-for-profits structured as public companies or large proprietary companies must also have a compliant whistleblower policy by 1 January 2020, unless they are an ‘eligible public company’ covered by one of the exemptions identified by ASIC.

An ‘eligible public company’ means a public company that is limited by guarantee, is operated on a not-for-profit basis and that is not the trustee of a registrable superannuation entity. There are three exemptions that can apply:

• Main exemption - where an eligible public company has a consolidated revenue below $1 million it does not need to have a whistleblower policy
• Deferral exemption - where an eligible public company has had a consolidated revenue below $1 million and then exceeds this threshold in the subsequent year, the eligible public company will not have to have a whistleblower policy until six months after the subsequent year
• Transitional deferral exemption - an eligible public company whose first financial year ends on or after 1 January 2020 will not have to have a whistleblower policy until 6 months after the end of its first year.

It is important to note that an eligible public company must still comply with the whistleblower laws, regardless of whether they are required to have a whistleblower policy.

If you are unclear about whether your organisation needs a policy, you should seek advice before 1 January 2020 to avoid potential penalties.

What does this mean for NFPs?

With the commencement of the new regime, we expect there to be an increase in whistleblower claims, as well as increased enforcement activity by ASIC regarding whistleblower policies.

Businesses and organisations, including not-for-profits, should identify whether they are required to have a whistleblower policy and if so, ensure that the policies are compliant with the content requirements. In addition to having a comprehensive whistleblower policy, organisations should ‘road test’ and review their internal processes, to ensure a robust system is in place which ensures appropriate protections around confidentiality and minimises the exposure of whistleblowers to detrimental treatment.

Whilst encouraging a ‘#SpeakUp’ culture may seem counterintuitive, a best practice whistleblower system should encourage disclosures to be made internally, which may minimise the potential for external involvement and adverse public scrutiny.

Maddocks is currently advising a range of corporate and NFP clients on their obligations under the scheme, as well as providing training on how to manage protected disclosures.