Whistleblower Policies in Australia: Requirements, Protections and Best Practices
                     COMPLIANCE GUIDE FOR AUSTRALIAN ORGANISATIONS
Would Someone Tell 
You First?
Whistleblower policies in Australia: who needs one, 
what it must include, and how it protects your 
business before a problem becomes a headline
www.sentrient.com.au
WHY IT MATTERS
People who speak up catch more fraud 
than any audit does
The ACFE 2024 Report to the Nations found tip-offs were the 
single most common way fraud was caught, ahead of internal 
43% audit and management review.
of fraud cases found What this means for you
through tip-offs
A trusted reporting channel surfaces problems early, before they grow 
into a crisis. A whistleblower policy is how you build that channel.
www.sentrient.com.au
THE BASICS
What a whistleblower policy actually is
A formal, written process that lets people report serious wrongdoing, such as fraud, 
corruption, illegal activity or a danger to the public, and know what protection they will 
get when they do.
A clear way to report Protection, not exposure A proper investigation
People know who to go to and how, The policy sets out how identity is Reports are looked into, recorded 
including the option to stay kept confidential and how people and closed out so the organisation 
anonymous. are shielded from payback. can act on what it learns.
www.sentrient.com.au
THE LEGAL REQUIREMENT
Three types of organisation must have one
Since 1 January 2020 under the Corporations Act whistleblower provisions
1 2 3
Public companies Large proprietary Corporate super trustees
companies
Every public company, listed or Corporate trustees of APRA-
not, regardless of size. Private companies that meet at regulated superannuation entities.
least two of the three size tests on 
the next slide.
www.sentrient.com.au
LARGE PROPRIETARY COMPANY TEST
Meet any two of these three, and the 
policy is mandatory
$50m $25m 100+
or more in consolidated 
revenue or more in consolidated employees
gross assets
For the financial year, including controlled Across the company and the entities it 
entities. At the end of the financial year. controls.
Close to two of these? Growing companies often cross the line without noticing. Check annually.
www.sentrient.com.au
EXEMPTIONS AND ACCOUNTABILITY
Who gets relief, and who carries the risk
2019 Whistleblower reforms pass 1 Jan 2020 Policies become RG 270 ASIC guidance sets the Today Enforcement 
Parliament mandatory content continues
ASIC relief for small not-for-profits Directors and officers are on the hook
Charities and not-for-profits limited by guarantee with Where a policy is required and missing, the 
annual revenue under $1 million are exempt from the consequences fall on the people who run the 
policy requirement. organisation, not just the entity itself.
www.sentrient.com.au
ASIC REGULATORY GUIDE 270
Seven things every compliant policy must 
cover
01 02 03 04
Legal protections Eligible recipients How to disclose Support and safety
The protections available to Who, inside and outside the The channels available, Steps the organisation takes 
whistleblowers, including organisation, can receive a including an anonymous to protect people from 
against detriment. disclosure. option. detriment.
05 06 07
Investigation process Confidentiality Accessibility Missing any one of these 
How disclosures are handled, How the whistleblower's How the policy is made and the policy does not 
assessed and investigated. identity is kept confidential. available to staff and officers. meet RG 270.
www.sentrient.com.au
THE LEGAL PROTECTIONS
Three protections the Corporations Act 
gives whistleblowers
When an eligible whistleblower makes a qualifying disclosure, these apply automatically. The policy 
explains them; the law enforces them.
Identity stays confidential No detriment Immunity from liability
The whistleblower's identity must be They cannot be dismissed, A good-faith disclosure cannot be 
protected. Sharing it without consent, harassed, demoted or otherwise used against them in civil, criminal 
outside the narrow exceptions, is 
punished for speaking up. or administrative proceedings.
unlawful.
www.sentrient.com.au
WHEN PROTECTIONS ARE BREACHED
The law has teeth, for organisations and 
individuals
Breach Type of liability Who is 
liable
It is personal
Causing detriment to a Criminal offence Entity and 
whistleblower individual A manager who retaliates, or who lets a 
name slip, can be pursued individually. The 
organisation's liability does not shield them.
Threatening detriment Criminal offence Entity and 
individual That is why training managers matters as 
much as writing the policy.
Breaching confidentiality of Civil penalty Entity and 
identity individual
No policy where one is Compliance Directors and 
wwrwe.qsuenirterident.com.au failure officers
WHO CAN SPEAK UP, AND ABOUT WHAT
Eligible whistleblowers go well beyond 
current staff
Who is covered
Qualifies
Current employees Former employees Officers Misconduct or an improper state of affairs in the 
organisation, or conduct that breaches the Corporations 
Contractors Suppliers Act or other specified laws.
Their relatives and dependants
Usually does not qualify
A supplier's spouse, or a contractor who finished last year, is 
A personal work-related grievance on its own. The 
still an eligible whistleblower.
disclosure must involve serious wrongdoing affecting the 
organisation or the public.
www.sentrient.com.au
NOT REQUIRED YET? STILL WORTH DOING
Why smaller businesses should have one 
anyway
Cost to fix (illustrative)
Hear about it first Cheaper to fix
Found late
Problems reach you before they Early identification keeps 
reach a regulator, a client or the remediation small and contained.
media.
Caught early
A visible speak-up culture Ready before the threshold
Time a problem goes unreported
Regulators, clients and good The habit is embedded by the time 
candidates all notice it. the law requires it.
www.sentrient.com.au
MAKING IT WORK
Five steps from a document on the shelf 
to a policy people trust
1 2 3 4 5
Start from a Set up real Train staff and Protect Investigate and 
compliant template channels managers confidentiality in close the loop
practice
Then tailor it to how Include a confidential Everyone knows the Look into every report 
your organisation and anonymous option policy exists, what it One breach destroys properly, keep records 
actually operates. people will use. protects and how to trust. Guard it and report back.
handle a report. operationally, not just 
on paper.
www.sentrient.com.au
HOW SENTRIENT HELPS
Everything you need to set up and run a 
whistleblower policy in one place
Policy templates Endorsed training Confidential Incident and 
disclosures breach records
A compliant whistleblower Online courses so staff 
policy template you can and managers A secure channel to Investigations, outcomes 
adapt and roll out quickly. understand the policy receive and manage and records kept 
and their obligations. disclosures with together, ready for audit.
confidentiality built in.
www.sentrient.com.au
KEY TAKEAWAYS
A good policy is the difference 
between hearing it first and 
reading about it later
3 7 43%
types of organisation must have a elements every policy must cover of fraud cases are uncovered by a 
policy by law under RG 270 tip-off
General information for Australian businesses, not legal advice. Obligations depend on your company type and circumstances. 
Check ASIC guidance or seek qualified legal advice before relying on it.
www.sentrient.com.au