When newly appointed Chief Ombudsman John Allen released his 2024/25 Annual Report, one headline figure stood out - a 39 per cent increase in protected disclosures made under the Protected Disclosures (Protection of Whistleblowers) Act 2022.
This saw 287 disclosures or enquiries made in the past year, up from 206 the year before.
Whilst this surge in protected disclosures indicates that public awareness of whistleblowing tools is increasing and societal tolerance for misconduct is not, the report highlights that it is a system under pressure.
The purpose of the Act is to provide workers with the ability to report serious wrongdoing in good faith, and to be legally protected from retaliation. But, in order to be protected, there are a number of pre-conditions.
To qualify as a protected disclosure, the whistleblower must be a current or former employee, contractor, volunteer, or secondee in a workplace, and they must reasonably believe that serious wrongdoing has occurred or is occurring in their organisation.
The disclosure must also be made in good faith and to an appropriate person, usually their employer, or directly to an appropriate authority such as the Ombudsman, Auditor-General, or Serious Fraud Office. The media or your local MP are not appropriate authorities.
The 2022 Act simplified and expanded the process by allowing whistleblowers to go directly to an external party without first reporting the concern internally. This was a deliberate move away from the “ladder” approach of the earlier 2000 Act, which had sometimes trapped whistleblowers within hostile workplaces.
Further the current Act defines serious wrongdoing broadly, to include corrupt or unlawful use of public funds, acts that pose a serious risk to health, safety, or the environment, and gross mismanagement or neglect of duty.
Importantly, even if an investigation later finds no wrongdoing, the disclosure remains protected if it was made on reasonable grounds.
The increase in reporting signals that the changes are working, but this has placed a strain on resources.
The Ombudsman’s office has had to recruit specialist staff to manage the growing complexity of cases, due to the nature of disclosures changing with many involving multiple agencies, blended public-private responsibilities, and complex employment relationship issues.
The Ombudsman also noted 25 formal complaints about how public sector agencies responded to disclosures, a sign that not all organisations have necessarily adapted to or embraced the requirements of the new law.
Perhaps most tellingly, the Office’s annual survey found that only 48 per cent of respondents believed they would be safe if they reported serious wrongdoing at work. Fear of retaliation and identity exposure remain the top deterrents.
So, whilst awareness of the Act has climbed to 36 per cent (up from 20 per cent two years ago), confidence still lags behind knowledge.
This is a crucial insight for employers, the law alone does not create trust, culture and process do.
As a result, the Ombudsman has now provided further guidance outlining what “good practice” looks like, and by implication, what the minimum expectations are of employers.
These requirements include having a clear protected disclosures policy that sets out what counts as serious wrongdoing, how disclosures can be made, and who will handle them.
Employers are required to communicate this policy regularly and make it visible. Additionally, employees should be provided multiple reporting channels, including the ability to receive and investigate anonymous disclosures, for instance, through an online form or dedicated email portal.
Employers will also need to clarify investigation processes, who will investigate, what updates the whistleblower can expect, and what confidentiality limits apply. They will need to explain decisions transparently, even if an investigation finds no action is required, and reassure the worker that they remain protected under the Act.
The Ombudsman suggests that these steps are not optional niceties but rather, are legal and moral essentials.
Fundamentally, the Act requires those receiving a disclosure to use their “best endeavours” to protect the discloser’s identity. Failure to do so may expose an employer to significant consequences.
The Ombudsman suggests that education is the missing link in the Act achieving its potential. As a result, the Office has been investing in public education, publishing guides for organisations and workers on the distinctions between ordinary complaints and protected disclosures, and on the protections available.
A failure to have a clear process may mean serious wrongdoing goes unreported, or worse, is mishandled in ways that breaches the Act. Workplace leaders should treat whistleblowing systems as part of broader risk management frameworks.
Ultimately, survey data suggests a growing willingness to report wrongdoing, with 84 per cent of respondents saying they would report serious wrongdoing to their employer, and two-thirds said they would approach the Ombudsman for advice.
This combination of internal and external pathways reflects an improved system where employees are aware of their rights and agencies are expected to respond professionally.
But it also highlights a tension. The more accessible the Ombudsman becomes, the greater the need for employers to lift their internal capability.
If organisations fail to handle disclosures competently, whistleblowers will increasingly bypass them, eroding internal trust and shifting the workload to oversight agencies.
As Allen put it, speaking up about concerns is often very stressful for whistleblowers. A supportive process, timely communication, and visible follow-through can make the difference between courage rewarded and trust betrayed.
Originally published in The Post
