7

Back to Basics: Reforming Australia’s Private Sector Whistleblowing Laws

Kath Hall and Heather Cork¹

I. Introduction

The important role that whistleblowers play in exposing corporate misconduct in Australia has been highlighted by a number of recent scandals. Whistleblowers have been central to uncovering impropriety in leading Australian companies including the Reserve Bank of Australia, Note Printing Australia, Leighton Holdings, Tabcorp, the Commonwealth Bank, the NAB, CommInsure and 7-Eleven.² Many of the whistleblowers involved in these cases experienced retaliation, redundancy, dismissal, workplace ostracism and negative publicity as a result. Regrettably these consequences are not unusual, and have led to pressure for reform of Australia’s private sector whistleblowing laws, contained in Pt 9.4AAA of the Corporations Act 2001 (Cth).³ While most of the calls for reform have focused on the narrow definitions of ‘discloser’ and ‘wrongdoing’, the lack of protection for anonymous disclosures and disclosures to third parties, and the lack of incentives or compensation for reporting in the Act, no-one has so far asked: do we have the basic framework right for regulating whistleblowing?

This chapter answers that question by focusing on two fundamental assumptions underlying the research and the regulation of whistleblowing: that whistleblowing involves a person making an identifiable disclosure of wrongdoing. These assumptions – that whistleblowers act alone and that reporting involves one identifiable act of disclosure – remain largely unchallenged in the dominant narrative on whistleblowing. As a result, the reality that whistleblowing often involves more than one person engaged in multiple acts of disclosure is not reflected in the current policy or legislative suggestions for reform.

Embracing the factual complexity of whistleblowing could improve corporate and regulatory responses in a number of ways. First, debunking the myth that whistleblowing involves one person reporting misconduct could improve the way that corporate whistleblowing systems and policies are framed and implemented. Psychological research confirms that group membership is important, particularly in the work context; encouraging employees to discuss wrongdoing concerns with others and make group reports could increase the rate of reporting and reduce the likelihood and/or severity of retaliation.⁴ Second, expanding the legislative definition of a ‘disclosure’ could result in employees qualifying for protection earlier and enable different types of discussions on wrongdoing (including seeking advice). Finally, challenging the dominant narrative that whistleblowers act alone in making formal reports on wrongdoing could lead to new research questions and better answers on how to encourage, manage and support whistleblowing.

II. The Importance of Whistleblowing

It is widely understood that employees play a key role in detecting and reporting corporate misconduct. In the private sector, wrongdoing is often difficult to uncover because it occurs away from the public eye, and can involve multiple actors and events over an extended period of time.⁵ Given employees’ access to information and knowledge on organisational behaviour, they are best placed to detect and report misconduct.⁶ As Pascoe and Welsh note, ‘providing a workable framework to encourage and protect whistleblowers is a vital aspect of companies’ corporate governance and risk management strategies’ and provides ‘assistance to regulators in the detection and enforcement of corporate crimes’.⁷

Numerous surveys have qualitatively demonstrated the value of whistleblowing. In a 2008 Australian public sector survey, managers rated employee reporting as the most important means of bringing wrongdoing to light.⁸ The survey confirmed that ‘the unique position of employees within organisations gives them a strategic role as quality information sources’.⁹ Similarly, PricewaterhouseCoopers’ 2010 report on public sector fraud found that 31 per cent of cases detected in the previous 12 months were reported internally by employees,¹⁰ and 5 per cent were reported using formal internal whistleblowing systems.¹¹ In the private sector, PricewaterhouseCoopers’ 2016 Global Economic Crime Survey reported that 54 per cent of respondents used management reporting to ensure compliance with their programs and that 42 per cent had whistleblowing hotlines.¹²

International support for protecting and supporting whistleblowers has also grown significantly. Since 2012, the OECD has published five guides to assist governments and corporates to facilitate whistleblowing. In 2015, the UN published a comprehensive Resource Guide on Good Practices in the Protection of Reporting Persons.¹³ Furthermore, the 2013–14 G20 Anti-Corruption Action Plan now requires G20 countries that do not already have whistleblower protections to enact and implement whistleblower protection rules and to take specific actions ‘to ensure that those reporting on corruption can exercise their function without fear of any harassment or threat or of private or government legal action’.¹⁴

III. Challenging the ‘One Whistleblower’ Narrative

Despite these developments, almost every discussion of whistleblowing, whether by government, academics, the media or corporates, assumes that whistleblowers act alone. In Australia, the main provisions dealing with private sector whistleblowing contained in the Corporations Act 2001 (Cth) contemplate a single ‘discloser’ of information.¹⁵ Similarly, the US Sarbanes-Oxley Act of 2002 protects ‘an employee’ of a private company who reports suspected violations of federal law,¹⁶ and the UK Public Interest Disclosure Act 1998 entitles ‘a worker’ to make a protected disclosure.¹⁷

The assumption that whistleblowers are alone in raising concerns within organisations is also prevalent in social science research. Vandekerckhove, one of the leading researchers on whistleblowing, uncritically comments that ‘what is common to all possible definitions … is that whistleblowing is always about individuals disclosing information’.¹⁸ Similarly, Gundlach, Douglas and Martinko note that ‘there are two primary parties involved in whistle-blowing: the wrongdoer and the whistle-blower’.¹⁹ Miceli and Near, in their famous 1992 book Blowing the Whistle, asked research questions such as: Who is the whistleblower? What are their individual characteristics? What are the costs and benefits to the whistleblower? And is motive relevant?²⁰ Since then, behavioural research has continued to focus on the effect of personal factors such as gender, age, education, religiosity and ethics on a person’s likelihood to report.²¹ None of this research, however, has considered the possibility of groups of persons blowing the whistle.

Basic research, however, reveals that many famous whistleblowers were not alone in raising concerns within their organisations. For example, in the Enron collapse, Sherron Watkins, Vice President of Corporate Development, is credited with having blown the whistle when she wrote a letter to senior management warning of improper accounting practices.²² Watkins later assisted investigators, testified before Congressional Committees, and in 2008 was named one of Time Magazine’s Persons of the Year.²³ However, evidence shows that other Enron employees also took steps to raise their concerns: Cliff Baxter, a senior Enron employee, complained to Enron’s President and CEO and ‘all who would listen’ about the company’s inappropriate transactions;²⁴ Margaret Ceconi, an employee of Enron Energy Services, wrote a 10-page letter to the board warning of excessive spending and the prospect of customer lawsuits;²⁵ and Vince Kaminski, head of Enron’s Research Group, raised concerns about corporate dealings.²⁶ Yet subsequent discussions of Enron’s collapse rarely acknowledge the actions of these individuals, and focus almost exclusively on Watkins.

Similarly, in the famous Challenger Shuttle Disaster, Roger Boisjoly, a mechanical engineer, is credited with being ‘the whistleblower’ after he tried to alert NASA executives of design faults in the Shuttle the day before the launch took place.²⁷ However, again, Boisjoly was not the only employee who voiced such concerns: Joe Kilminster, Vice President of the Space Booster Program, and George Hardy, a NASA employee, both recommended that the launch not go ahead, and another engineer, Arnie Thompson, tried to explain the structural defects.²⁸ Allan MacDonald, who was at the Kennedy Space Center, argued for delay even after the decision was made, saying that if the mission failed he would not know how to explain to a board of inquiry the decision to launch. Yet only Boisjoly was awarded the Prize for Scientific Freedom and Responsibility by the American Association for the Advancement of Science.²⁹ Only he is was recognised as ‘the whistleblower’ in this case.

Closer to home, in 2013, three senior Australian employees exposed serious misconduct in the financial planning unit of the Commonwealth Bank.³⁰ These employees used the pseudonym ‘The Three Ferrets’;³¹ however, only one, Jeff Morris, is consistently identified as the whistleblower in this case.³²

These cases echo psychological research that suggests that people prefer to act as part of a group than alone, and that unethical conduct rarely goes unnoticed. Research indicates that even when a majority of people acquiesce to misconduct, there will still be a minority who are concerned enough to complain or question the behaviour.³³ Research on whistleblowing also shows that co-workers’ opinions are paramount in a whistleblower’s decision to report. According to Noelle-Neumann, employees test their interpretation of the situation against others’ and, if theirs is not met with approval, often remain silent.³⁴ Milliken et al suggest that employees mentally ‘test out’ certain behaviours by either imagining their co-workers’ responses or discussing courses of action with colleagues.³⁵ Yet corporate or regulatory policies on whistleblowing fail to recognise that employees may feel more confident in acting as part of a group in speaking up than acting alone.

IV. Challenging the ‘One Disclosure’ Narrative

The idea that there is a single act of disclosure by a whistleblower is also included in most legislative and scholarly discussions on whistleblowing. Section 1317AA of the Corporations Act confers protection on an individual who makes ‘a disclosure’. Similarly, s 10 of the Public Interest Disclosure Act 2013 (Cth) protects employees who make ‘a public interest disclosure’, while s 337A of the Fair Work (Registered Organisations) Act 2009 (Cth) protects an officer, member or employee of a trade union who makes ‘a disclosure of information’.

The dominant narrative surrounding whistleblowing also contains the language of one disclosure. Jubb characterises whistleblowing as ‘a dissenting act of public accusation’³⁶ and ‘a deliberate, non-obligatory act of disclosure’.³⁷ Miceli and Near consider whistleblowing involves ‘the disclosure … of illegal, immoral or illegitimate practices’,³⁸ while Vandekerckhove suggests that a key element of whistleblowing is always ‘the act of … disclosure’.³⁹

However, case studies reveal that whistleblowers often make multiple disclosures. Brian Hood, who publicly exposed improper payments made to foreign agents by subsidiaries of the Reserve Bank of Australia (RBA) stated that, ‘[w]hile there were one or two key events, lots of things happened over quite a period of time’.⁴⁰ Hood reported his concerns about the payments at least five times, including to one of the subsidiary’s boards, the Deputy Governor of the RBA, the media and ASIC. Similarly, in the Commonwealth Bank case referred to above, the ‘Three Ferrets’ made six disclosures to the media, the regulator and the company.

These cases are consistent with research that suggests that employees frequently raise concerns internally before reporting externally.⁴¹ Moreover, they accord with an emerging body of research that suggests that reporting wrongdoing involves an ongoing decision-making process, with whistleblowers often vacillating between action and inaction. As Blenkinsopp and Edwards note, deciding to report requires ‘an iterative process shaped by multiple factors, including events unfolding in real-time’ in a complex and ever changing employment environment.⁴²

The process of reporting may be protracted, as evidence is often obtained over a period of time. Employees can face challenges determining whether they have actually observed wrongdoing,⁴³ and cultural attitudes may conflict with an employee’s sense of what amounts to impropriety.⁴⁴ Further, misconduct that is seemingly endorsed by management can become ‘normalised’ as standard organisational practice, challenging a whistleblower’s perception that something is wrong.⁴⁵ Research also indicates that employees’ responses to wrongdoing are influenced by their perception of the causal link between the wrongdoer and the outcome of the wrongdoing.⁴⁶ It usually takes time for a whistleblower to gather sufficient information to properly evaluate blame attributions, which explains why whistleblowers often act gradually.

V. Where to from Here

There is currently considerable momentum, both nationally and globally, to improve processes and protection for people who report corporate misconduct. Acknowledging the reality that there may often be more than one employee willing to raise concerns within an organisation can influence both the narrative about, and the strategies that support, whistleblowing. Because individuals experience safety in numbers, encouraging employees to work with others, and ensuring they are protected when they do, may increase rates of whistleblowing and reduce negative consequences, including isolation and retaliation. Express recognition that group reporting may make the process easier can also encourage and improve corporate reporting.

Further, legislative reform can remove the need to identify a single disclosure, and ensure that protection is available from the start of the reporting process. A broader definition of ‘reporting’ in the Corporations Act is required to cover both disclosure to a supervisor and reporting to the media. The Act should also provide protection for whistleblowers who seek advice from the regulator, regardless of whether a formal disclosure of information is subsequently made. Currently, to qualify for protection, a person must make an official report to ASIC. However, employees should be able to contact ASIC for advice on the strength of their information, and protection from retaliation should be available from that point.

This chapter argues that the dominant narrative on whistleblowing is currently limiting the discussion and research on reform. There is value in getting back to basics when it comes to designing improvements to law and practices in this context, and making sure that we appreciate that the process of whistleblowing is not as simple as is often assumed.