Overview
In September 2025, the Failure to Prevent Fraud (“FTPF”) offense will come into force in the UK. In preparation, many large firms will need to assess their fraud risk and response frameworks, especially as they relate to whistleblowing, which enjoys its own section – 3.5.2 – within the FTPF government guidance; highlighting its importance in managing fraud risk.
Indeed, it seems whistleblowing is enjoying a moment in the regulatory spotlight. A private members’ bill – the ‘Office of the Whistleblower’ bill (“OWB”) – drafted by not-for-profit organization Whistleblowers UK, seeks to expand on the protections offered under the Public Interest Disclosure Act (“PIDA”), which established the current UK legal framework responsible for whistleblower protections in 1998. After its first reading in Parliament in December 2024, the OWB bill was passed unanimously. It has a second reading in April 2025. While the OWB is still at an early stage, organizations can learn from its intentions.
What are the benefits of having an effective whistleblowing program?
Government guidance on FTPF identifies whistleblowing as a critical control. Other than ensuring compliance, there are several benefits in maintaining effectual whistleblowing procedures.
- Uncover misconduct: A formal whistleblowing channel provides insiders an efficient method to report wrongdoing within the organization.
- Protect reputation: Knowledge of wrongdoing allows an organization to address problems internally before such matters are escalated to third parties or leaked publicly.
- Prevent growth of problematic behavior: Knowledge of wrongdoing allows an organization to address problems in their inchoate stages, before they become too large, or ingrained in an organization’s operations or culture.
- Foster an open, honest culture: A formal whistleblowing channel enables organization members to feel heard and valued, which fosters loyalty and can improve productivity.
Cost vs. Investment
Corporate whistleblowing policies are often viewed through a compliance lens. Companies understand the theoretical benefit, but see it as a cost; a regulatory necessity. This mindset fails to recognize the true value of an effective whistleblowing infrastructure, which can be an efficient and cost-effective way to learn from those who understand the business best: its people.
Among other provisions, the OWB seeks to introduce a public whistleblowing oversight body – the independent Office of the Whistleblower, which will protect whistleblowers and prevent retaliation against them. The Office of the Whistleblower will work with regulators and law enforcement agencies or through private-public partnerships to ensure received complaints are independently and consistently investigated. At present, investigation of protected disclosures is not required by the PIDA.
In the investigation of significant matters, organizations often perceive the involvement of a third party, such as a regulator, as less than ideal – particularly if such involvement is the first indication the firm receives of a potential criminal breach, as it might be under the FTPF. Far preferable would it be for the organization to be alerted to, and thus able to act to mitigate, problems though a channel for insiders to report concerns. Third parties may still need to be involved, but organizations, forewarned, will be in a much better position to manage any subsequent action.
Who can blow the whistle?
A common criticism of PIDA is it protects disclosures made by employees only, not those made by others who might be exposed to internal matters requiring investigation: contractors, trustees, partners, temporary staff, and non-executive directors. The OWB resolves this by defining a whistleblower as one who makes or is intending to make a protected disclosure under the law. Whistleblowers as defined are then protected from detriment under the OWB.
In general, there are two types of whistleblowers, the unknowing and the reluctant, each with different needs. The unknowing do not consider themselves whistleblowers and may not realize the protected status of their disclosure. In their minds, they merely seek to bring a problem to the attention of an authority. The reluctant bring a problem to the attention of an authority only as a last resort. One requires convenience, the other trust. An effective whistleblowing framework will appeal to both by presenting an internal reporting mechanism as the most appropriate avenue for reporting rather than forcing them to use an external channel or to leak the information.
Cultivating Trust
A whistleblowing channel that is not used will not add value to an organization; it will be only a compliance cost. Whistleblowing channels are used only if trusted. If not, employees seek alternative avenues or resort to silence as a tool of self-preservation. Yet, as discussed, it is in a business’s best interest to identify and respond to problems before they escalate; an opportunity made possible by whistleblowers. Therefore, to build trust, organizations need to show a clear commitment to the whistleblower program, and especially to confidentiality.
FTPF guidance holds that there should be board level accountability and oversight. Those assigned oversight responsibility should be seen to be engaged, championing the right behaviors and adding to the process gravitas, legitimacy, and, where possible, transparency.
To help cultivate trust:
- Organizations must establish and maintain secure and confidential reporting channels and ensure complaints are routed appropriately.
- They must communicate the policy’s existence, highlighting the safeguards built into the process. At minimum, the whistleblower program must be included in cyclical training.
- They must confirm receipt of complaints and update whistleblowers as to investigative progress, where appropriate and in line with legal restrictions on information sharing, as recognized in the 2019 EU Whistleblowing Directive. At minimum, whistleblowers need to understand they have been heard and are being taken seriously.
Collation of Information
The Office of the Whistleblower will collate data on risks emerging across organizations, industry, and geography. Organizations should seek to do the same. One incident in isolation may not be indicative of a wider problem, but repeated or connected incidents may well be. Only when reports are centrally collated and reviewed for patterns can an organization spot emerging trends and act on the information to prevent matters from escalating.
Summary
Whistleblowing should be a focus of the anti-fraud compliance framework assessments many organizations are undertaking in anticipation of the FTPF implementation. Firms with a whistleblowing infrastructure should evaluate its effectiveness and ensure reported matters are escalated appropriately. All other firms should plan to implement a whistleblowing infrastructure.
Given the opportunity provided by the FTPF, our experienced practitioners are here to help firms consider how best to structure their anti-fraud controls. The Nardello & Co. team, expert in conducting independent investigations of whistleblower matters to the highest legal and ethical standards, can also provide proportionate, actionable advice to maximize the benefit organizations can obtain from essential compliance tools.
In the same way the Office of the Whistleblower is anticipated to be self-financing after initial investment, an effective whistleblowing framework can add value to your organization far in excess of its cost. A commitment to recognizing its importance can turn your organization’s last line of defense into your most effective early warning tocsin.
