Whistleblowing and speaking up

Lesson 9 noted that tips are the most common way fraud is discovered. Behind almost every major corporate scandal is someone who saw something wrong: an accountant at WorldCom who found billions of dollars of improper entries and took them to the audit committee, an Enron vice-president who warned the chairman that the company might 'implode in a wave of accounting scandals', engineers who raised safety concerns, employees who refused to sell products customers did not need. Some were heard; many were ignored or punished. This lesson examines why people speak up or stay silent, how organizations can encourage and handle concerns, the legal protections and reward programs available in Canada and the United States, and the ethical questions whistleblowers face.

Speaking up, whistleblowing and silence

Speaking up means raising a concern internally through ordinary channels: telling a supervisor, a colleague, human resources, compliance or an ethics hotline. Whistleblowing usually means reporting wrongdoing to someone who can act on it, inside or outside the organization, often after internal channels have failed or when the person fears retaliation. External whistleblowing goes to regulators, law enforcement, the media or the public. The distinction matters because most organizations would far rather hear about a problem internally, early, than learn of it from a regulator or a newspaper.

Silence is common. Surveys of employees consistently find that a substantial share of people who observe misconduct do not report it. The main reasons are futility, the belief that nothing will be done, and fear of retaliation: being labelled disloyal, losing promotions, being isolated or fired. People also stay silent because they are unsure whether what they saw is really wrong, do not know how to report, or feel loyalty to colleagues. BUS-130's discussion of psychological safety explains why: when people fear being embarrassed or punished for raising issues, they keep quiet.

The ethics of whistleblowing

Whistleblowing raises genuine ethical tensions. Employees owe duties of loyalty and confidentiality to their employers, and reporting externally can damage the organization, its employees and shareholders, sometimes on the basis of incomplete information. On the other hand, loyalty does not require complicity in wrongdoing, and the public has a strong interest in learning about serious harms such as fraud, safety hazards and environmental damage.

Philosopher Richard De George proposed conditions under which whistleblowing is morally permitted and when it becomes obligatory. It is permitted when the organization's product or policy will do serious and considerable harm to the public, the employee has reported the concern to an immediate supervisor, and, if that fails, has exhausted internal procedures. It becomes obligatory when, in addition, the employee has accessible, documented evidence that would convince a reasonable, impartial observer, and has good reason to believe that going public will bring about the necessary change. Critics argue that these conditions place too heavy a burden on individuals, especially when internal channels are themselves compromised or when reporting internally would tip off wrongdoers. Modern legal protections recognize that in some cases going directly to a regulator is appropriate.

Designing speak-up systems

Effective organizations make speaking up easy, safe and worthwhile. They offer several channels, so that employees can bypass a supervisor who is part of the problem: managers, human resources, compliance, an ombudsperson and an independent hotline that accepts anonymous reports by phone or web. They publicize the channels and explain what happens after a report. They triage reports promptly, investigate independently and keep reporters informed, as far as confidentiality allows. They protect reporters' identities and prohibit retaliation, and they investigate and discipline retaliation as serious misconduct. They also analyse reporting data to spot patterns, such as clusters of concerns in one department.

Managers are usually the first channel, and their response determines whether employees try again. A manager who thanks the person, takes the concern seriously, escalates appropriately and follows up encourages future reporting. A manager who dismisses, minimizes or reveals the reporter's identity teaches the whole team to stay silent. Training managers to receive concerns well is one of the most effective investments an organization can make.

Legal protection and reward programs

Canadian whistleblower protection is a patchwork. Section 425.1 of the Criminal Code makes it an offence for an employer to retaliate against an employee who provides information about an offence to law enforcement, or to threaten to do so. The federal Public Servants Disclosure Protection Act protects federal public servants who disclose wrongdoing, through the Public Sector Integrity Commissioner, and provinces have similar laws for their public sectors; proposals to strengthen the federal regime have been debated for years. Securities laws in Ontario and several other provinces prohibit reprisals against employees who report possible securities violations, and environmental, health and safety and competition laws contain their own protections. Private-sector employees outside these areas rely mainly on employment law, such as wrongful dismissal claims.

The Ontario Securities Commission launched Canada's first whistleblower reward program in 2016. Whistleblowers who provide original information that leads to sanctions or voluntary payments of $1 million or more may receive 5 to 15 % of the amount, up to $5 million. By 2023 the OSC reported awarding more than $9 million to 11 whistleblowers. The Canada Revenue Agency's Offshore Tax Informant Program pays rewards for information on major international tax non-compliance. The Competition Bureau's whistleblowing initiative protects informants' identities but does not pay rewards.

Reward programs are controversial. Supporters argue that rewards compensate whistleblowers for serious career risks and encourage reports that detect fraud regulators would otherwise miss. Critics worry that rewards may encourage people to bypass internal channels, delay reporting to increase sanctions, or file weak claims. Programs address these concerns by allowing higher awards for those who report internally first and lower awards for unreasonable delay, and by giving companies a chance to investigate internal reports.

Handling a report well

How an organization responds to a concern is a test of its culture. Good practice begins with acknowledging the report promptly and assessing urgency, especially for safety risks. An investigator independent of the people involved gathers evidence, interviews witnesses and documents findings, respecting the rights of people accused, who are presumed not to have done wrong until the facts are established. The reporter's identity is protected and shared only as necessary. The organization communicates outcomes as far as confidentiality allows, takes corrective and disciplinary action, monitors for retaliation and fixes the root cause. Reports that are not substantiated still deserve thanks, because a culture that punishes good-faith reports that turn out to be mistaken will lose the reports that matter.

Speaking up in smaller organizations and internationally

Small and mid-sized organizations cannot always fund a dedicated compliance team, but the principles still apply. An owner or senior manager can designate a trusted person outside the line of management to receive concerns, use an external hotline provider, which is relatively inexpensive, and ask the board, an adviser or the external accountant to receive reports about senior leaders. Clear written commitments not to retaliate, and visible follow-through when concerns are raised, matter more in a small organization, where anonymity is hard to preserve and everyone notices how the first report is handled.

Multinational companies must also navigate different legal regimes. The European Union's Whistleblower Protection Directive requires organizations with 50 or more employees in member states to maintain internal reporting channels, acknowledge reports within seven days and provide feedback within three months, and it protects reporters who go directly to authorities. Privacy laws in some countries restrict anonymous reporting or the processing of reporters' and subjects' personal data. A global speak-up program therefore needs a common policy with local adaptations, translation, and channels that work in every country where the company operates.

Retaliation and its costs

Retaliation takes many forms beyond dismissal: exclusion from meetings, poor performance reviews, reassignment, surveillance, legal threats and social isolation. It is often subtle and hard to prove, and it is devastating for whistleblowers, many of whom report lasting damage to their careers, finances and health. For organizations, retaliation sends a message to every employee that reporting is dangerous, destroying the early warning system on which good governance depends. Boards should ask management how retaliation is prevented and monitored, and should treat substantiated retaliation as serious misconduct regardless of the retaliator's seniority.