Quick Answer:
A whistleblower policy sets out how people can safely report serious wrongdoing in a business, and how they are protected when they do. Under the Corporations Act, public companies, large proprietary companies and corporate trustees of APRA-regulated super funds have been required to have one since 1 January 2020. The policy must explain who can make a disclosure and how, the legal protections available, and how the company will support whistleblowers and investigate reports. Even businesses not legally required to have one benefit from a clear, trusted reporting channel.
In this article
- What Is a Whistleblower Policy?
- Who Must Have a Whistleblower Policy in Australia?
- What a Whistleblower Policy Must Include
- The Legal Protections for Whistleblowers
- Who Can Blow the Whistle, and About What
- Why Smaller Businesses Should Have One Too
- How to Make a Whistleblower Policy Work
- Where Sentrient Fits
- Frequently Asked Questions
- Sources
A whistleblower policy is one of those documents businesses either take seriously or forget they need until something goes wrong.
It is the framework that lets people report serious misconduct safely, and for many Australian companies it is a legal requirement, not a nice-to-have.
This guide covers what a whistleblower policy is, who must have one, what it must contain, and the protections the law gives the people who speak up.
Sentrient is an Australian-built GRC platform for compliance, risk and HR. See our workplace compliance system and compliance courses, built for Australian and New Zealand workplaces.
What Is a Whistleblower Policy?
A whistleblower policy is a formal document that explains how someone can report serious wrongdoing in an organisation, such as fraud, corruption, illegal activity or a danger to the public, and what happens after they do. Its purpose is to make speaking up safe and structured rather than risky and ad hoc.
It matters because the alternative is silence. Without a trusted channel and clear protection, people who see wrongdoing often say nothing, and the problem grows.
A good policy of this kind is part of sound corporate governance, which is why it sits naturally within a wider governance, risk and compliance approach.
The evidence backs this up. In the ACFE 2024 Report to the Nations, a global study of occupational fraud, tip-offs were the single most common way fraud was caught, uncovering 43 per cent of cases, far more than internal audit or management review, and most of those tips came from employees.
A whistleblower policy is what turns that instinct to speak up into a safe, usable channel.
Who Must Have a Whistleblower Policy in Australia?
Under the Corporations Act, three types of entity have been legally required to have a compliant whistleblower policy since 1 January 2020:
- Public companies
- Large proprietary companies, meaning a company that meets at least two of: consolidated revenue of $50 million or more, consolidated gross assets of $25 million or more, or 100 or more employees
- Corporate trustees of APRA-regulated superannuation entities
ASIC has granted relief to public companies limited by guarantee that are not-for-profits or charities with annual revenue under $1 million. Where a charity adopts a policy anyway, the sign-off and whistleblower training record sit against each person in our HR software for charities.
Every other entity in the categories above must have a policy that meets the law, and directors and officers can face consequences if it does not.
What a Whistleblower Policy Must Include
ASIC’s Regulatory Guide 270 (RG 270) sets out what a compliant policy must cover. A policy that leaves any of these out is not compliant, however polished it looks.
| Required content | What it covers |
|---|---|
| Protections available | The legal protections whistleblowers have, including from detriment |
| Who can receive a disclosure | The people or roles that can take a report, inside and outside the company |
| How to make a disclosure | The channels available, including how to report anonymously |
| How the company supports whistleblowers | The steps taken to protect them from detriment and keep them safe |
| How disclosures are investigated | The process for handling and investigating a qualifying disclosure |
| How confidentiality is protected | How the whistleblower’s identity is kept confidential |
| How the policy is made available | How staff and officers can access the policy |
The Legal Protections for Whistleblowers
The Corporations Act whistleblower protections are strong, and breaching them is a serious matter.
An eligible whistleblower who makes a qualifying disclosure is protected in several ways: their identity must be kept confidential, they are protected from detriment such as dismissal or harassment for speaking up, and they have legal immunity from civil, criminal or administrative liability for making the disclosure.
The teeth are real. Causing or threatening detriment to a whistleblower, or breaching their confidentiality, can attract criminal offences and civil penalties for the company and for individuals.
This is not a policy you write and forget. It describes protections the law will enforce.
Who Can Blow the Whistle, and About What
Eligible whistleblowers are a wider group than just current employees. They include former employees, officers, contractors and suppliers, and in each case their relatives and dependants.
The protections do not require the person to be an insider in the narrow sense.
A disclosure qualifies for protection when it concerns misconduct, or an improper state of affairs, in relation to the company, or conduct that breaches the Corporations Act or other specified laws.
Personal work-related grievances, on their own, generally do not qualify. The point is serious wrongdoing that affects the organisation or the public, not routine workplace complaints.
Why Smaller Businesses Should Have One Too
If your business is not a public or large proprietary company, you are not legally required to have a whistleblower policy.
That is not a reason to skip it. A clear, trusted reporting channel surfaces problems early, when they are cheap to fix, rather than late, when they are a crisis or a headline.
Because tip-offs are the leading way wrongdoing comes to light, the businesses that give people a channel are simply the ones that hear about problems first.
A whistleblowing channel also signals a healthy speak-up culture, the kind regulators, clients and good staff increasingly expect.
Many growing businesses put a policy in place before they are required to, precisely so the habit and the trust are already there when they cross the threshold.
How to Make a Whistleblower Policy Work
- Start from a compliant template, then tailor it to how your business actually operates
- Give people a real channel, including a way to report confidentially or anonymously
- Train staff and managers so they know the policy exists, what it protects, and how to handle a disclosure
- Protect confidentiality in practice, not just on paper, because a single breach destroys trust
- Investigate and close the loop, and keep records that show you did
Where Sentrient Fits
Sentrient covers the whole whistleblower policy lifecycle for Australian businesses.
It provides a whistleblower policy template you can tailor and have staff acknowledge, legally endorsed whistleblower training written with Australian law firms, and a platform to receive and manage disclosures with the confidentiality the law requires, alongside your incident and breach records.
Being straight about scope: for legal questions on your specific obligations, get advice. For putting a compliant policy, training and reporting channel in place and proving they run, that is exactly what Sentrient is built for.
See your policy, training and reporting channel in one place.
Speak-Up, Made Safe
This is not paperwork for its own sake. It is how a business hears about serious problems from the people best placed to see them, and protects those people when they take the risk of speaking. If you are legally required to have one, make sure it meets ASIC’s guidance. If you are not, have one anyway, because the cost of silence is always higher than the cost of a policy.
Disclaimer: General information for Australian businesses, not legal advice. Whistleblower obligations depend on your company type and circumstances. Confirm your specific requirements with ASIC guidance or a qualified lawyer before relying on this. Correct as at August 2026.
Frequently Asked Questions
1. What is a whistleblower policy?
A whistleblower policy is a formal document that explains how someone can report serious wrongdoing in an organisation, such as fraud, corruption or illegal activity, and how they are protected when they do. It sets out the reporting channels, the protections available, and how the company investigates and supports whistleblowers.
2. Who is legally required to have a whistleblower policy in Australia?
Under the Corporations Act, public companies, large proprietary companies and corporate trustees of APRA-regulated superannuation entities have been required to have one since 1 January 2020. ASIC grants relief to small not-for-profits and charities limited by guarantee with annual revenue under $1 million.
3. What makes a company a large proprietary company?
A proprietary company is large if it meets at least two of three tests: consolidated revenue of $50 million or more, consolidated gross assets of $25 million or more, or 100 or more employees. Large proprietary companies must have a compliant whistleblower policy.
4. What must a whistleblower policy include?
Under ASIC’s Regulatory Guide 270, it must cover the protections available to whistleblowers, who can receive a disclosure and how, how the company supports whistleblowers and protects them from detriment, how disclosures are investigated, how confidentiality is maintained, and how the policy is made available.
5. What protections do whistleblowers have?
Eligible whistleblowers who make a qualifying disclosure have their identity kept confidential, are protected from detriment such as dismissal or harassment, and have legal immunity for making the disclosure. Causing detriment or breaching confidentiality can attract criminal offences and civil penalties.
6. Who can be a whistleblower?
Eligible whistleblowers include current and former employees, officers, contractors and suppliers, and their relatives and dependants. The disclosure must concern misconduct or an improper state of affairs in relation to the company. Personal work-related grievances alone generally do not qualify.
7. Does my small business need a whistleblower policy?
Not unless you are a public or large proprietary company or a super trustee. But a clear, trusted whistleblowing channel surfaces problems early and signals a healthy speak-up culture, so many growing businesses adopt one before they are required to.
8. How does Sentrient help with a whistleblower policy?
Sentrient provides a tailorable whistleblower policy template with staff acknowledgement, legally endorsed whistleblower training, and a platform to receive and manage disclosures confidentially alongside incident and breach records, so the policy is not just written but running and provable.
Sources
- ASIC, Whistleblower rights and protections
- ASIC, Regulatory Guide 270 Whistleblower policies
- ASIC, Protections for corporate sector whistleblowers
- ASIC, Company officer obligations under the whistleblower protection provisions
- ACFE, Occupational Fraud 2024: A Report to the Nations
