Whistleblowing and speaking up

Lesson 9 noted that tips are the most common way fraud is discovered. Behind almost every major corporate scandal is someone who saw something wrong: an accountant at WorldCom who found billions of dollars of improper entries and took them to the audit committee, an Enron vice-president who warned the chairman that the company might 'implode in a wave of accounting scandals', engineers who raised safety concerns, employees who refused to sell products customers did not need. Some were heard; many were ignored or punished. This lesson examines why people speak up or stay silent, how organizations can encourage and handle concerns, the legal protections and reward programs available in Canada and the United States, and the ethical questions whistleblowers face.

Speaking up, whistleblowing and silence

Speaking up means raising a concern internally through ordinary channels: telling a supervisor, a colleague, human resources, compliance or an ethics hotline. Whistleblowing usually means reporting wrongdoing to someone who can act on it, inside or outside the organization, often after internal channels have failed or when the person fears retaliation. External whistleblowing goes to regulators, law enforcement, the media or the public. The distinction matters because most organizations would far rather hear about a problem internally, early, than learn of it from a regulator or a newspaper.

Silence is common. Surveys of employees consistently find that a substantial share of people who observe misconduct do not report it. The main reasons are futility, the belief that nothing will be done, and fear of retaliation: being labeled disloyal, losing promotions, being isolated or fired. People also stay silent because they are unsure whether what they saw is really wrong, do not know how to report, or feel loyalty to colleagues. BUS-130's discussion of psychological safety explains why: when people fear being embarrassed or punished for raising issues, they keep quiet.

The ethics of whistleblowing

Whistleblowing raises genuine ethical tensions. Employees owe duties of loyalty and confidentiality to their employers, and reporting externally can damage the organization, its employees and shareholders, sometimes on the basis of incomplete information. On the other hand, loyalty does not require complicity in wrongdoing, and the public has a strong interest in learning about serious harms such as fraud, safety hazards and environmental damage.

Philosopher Richard De George proposed conditions under which whistleblowing is morally permitted and when it becomes obligatory. It is permitted when the organization's product or policy will do serious and considerable harm to the public, the employee has reported the concern to an immediate supervisor, and, if that fails, has exhausted internal procedures. It becomes obligatory when, in addition, the employee has accessible, documented evidence that would convince a reasonable, impartial observer, and has good reason to believe that going public will bring about the necessary change. Critics argue that these conditions place too heavy a burden on individuals, especially when internal channels are themselves compromised or when reporting internally would tip off wrongdoers. Modern legal protections recognize that in some cases going directly to a regulator is appropriate.

Designing speak-up systems

Effective organizations make speaking up easy, safe and worthwhile. They offer several channels, so that employees can bypass a supervisor who is part of the problem: managers, human resources, compliance, an ombudsperson and an independent hotline that accepts anonymous reports by phone or web. They publicize the channels and explain what happens after a report. They triage reports promptly, investigate independently and keep reporters informed, as far as confidentiality allows. They protect reporters' identities and prohibit retaliation, and they investigate and discipline retaliation as serious misconduct. They also analyze reporting data to spot patterns, such as clusters of concerns in one department.

Managers are usually the first channel, and their response determines whether employees try again. A manager who thanks the person, takes the concern seriously, escalates appropriately and follows up encourages future reporting. A manager who dismisses, minimizes or reveals the reporter's identity teaches the whole team to stay silent. Training managers to receive concerns well is one of the most effective investments an organization can make.

Legal protection and reward programs

US whistleblower protection is extensive but fragmented across many statutes. The Sarbanes-Oxley Act (section 806) protects employees of public companies who report securities fraud internally or to regulators; complaints go to the Occupational Safety and Health Administration within 180 days. The Dodd-Frank Act protects people who report securities violations to the SEC; in Digital Realty Trust v. Somers (2018) the Supreme Court held that its anti-retaliation provision covers only those who report to the SEC. The False Claims Act allows private 'qui tam' plaintiffs to sue on the government's behalf over fraud against federal programs and receive 15 to 30 % of the recovery. Dozens of other federal laws, covering areas such as workplace safety, the environment and transportation, contain their own protections, as do many state laws.

The SEC's whistleblower program, created by the Dodd-Frank Act, pays awards of 10 to 30 % of monetary sanctions exceeding US$1 million to individuals who voluntarily provide original information that leads to a successful enforcement action. Since its first award in 2012 the program has paid more than US$2 billion; in fiscal 2025 it issued about US$60 million in awards, down sharply from earlier years. The Commodity Futures Trading Commission and the Internal Revenue Service have similar programs, and in 2024 the Department of Justice launched a pilot whistleblower award program for corporate crimes. SEC rules prohibit companies from impeding employees from communicating with the SEC, including through confidentiality agreements, and the SEC has fined companies whose agreements did so.

Reward programs are controversial. Supporters argue that rewards compensate whistleblowers for serious career risks and encourage reports that detect fraud regulators would otherwise miss. Critics worry that rewards may encourage people to bypass internal channels, delay reporting to increase sanctions, or file weak claims. Programs address these concerns by allowing higher awards for those who report internally first and lower awards for unreasonable delay, and by giving companies a chance to investigate internal reports.

Handling a report well

How an organization responds to a concern is a test of its culture. Good practice begins with acknowledging the report promptly and assessing urgency, especially for safety risks. An investigator independent of the people involved gathers evidence, interviews witnesses and documents findings, respecting the rights of people accused, who are presumed not to have done wrong until the facts are established. The reporter's identity is protected and shared only as necessary. The organization communicates outcomes as far as confidentiality allows, takes corrective and disciplinary action, monitors for retaliation and fixes the root cause. Reports that are not substantiated still deserve thanks, because a culture that punishes good-faith reports that turn out to be mistaken will lose the reports that matter.

Speaking up in smaller organizations and internationally

Small and mid-sized organizations cannot always fund a dedicated compliance team, but the principles still apply. An owner or senior manager can designate a trusted person outside the line of management to receive concerns, use an external hotline provider, which is relatively inexpensive, and ask the board, an adviser or the external accountant to receive reports about senior leaders. Clear written commitments not to retaliate, and visible follow-through when concerns are raised, matter more in a small organization, where anonymity is hard to preserve and everyone notices how the first report is handled.

Multinational companies must also navigate different legal regimes. The European Union's Whistleblower Protection Directive requires organizations with 50 or more employees in member states to maintain internal reporting channels, acknowledge reports within seven days and provide feedback within three months, and it protects reporters who go directly to authorities. Privacy laws in some countries restrict anonymous reporting or the processing of reporters' and subjects' personal data. A global speak-up program therefore needs a common policy with local adaptations, translation, and channels that work in every country where the company operates.

Retaliation and its costs

Retaliation takes many forms beyond dismissal: exclusion from meetings, poor performance reviews, reassignment, surveillance, legal threats and social isolation. It is often subtle and hard to prove, and it is devastating for whistleblowers, many of whom report lasting damage to their careers, finances and health. For organizations, retaliation sends a message to every employee that reporting is dangerous, destroying the early warning system on which good governance depends. Boards should ask management how retaliation is prevented and monitored, and should treat substantiated retaliation as serious misconduct regardless of the retaliator's seniority.