Whistleblower Policy
1. Purpose
1.1 Application
This Policy applies to Pinnacle People and its services regardless of entity name or type and encompasses all directors and personnel including executives, senior management, managers, permanent staff, temporary staff, and contractors. It also extends to clients and suppliers.
1.2 Requirement
This policy is required by s.1317AI of the Corporations Act 2001 (Cth)
1.3 Purpose
At Pinnacle People we are committed to upholding a safe and fair work environment, as well as upholding high standards of ethical conduct and to promote and support a culture of honest and ethical behaviour, corporate compliance and good corporate governance. The objective of this policy is to encourage the reporting of wrongdoing that is of legitimate concern by providing a convenient and safe reporting mechanism, and protection for people who make serious wrongdoing disclosures.
It is often those who have a working relationship with Pinnacle People, who are often the first to realise that there may be something wrong. However, they may not wish to speak up for fear of appearing disloyal or may be concerned about being victimised or subject to reprisals for reporting wrongdoing.
Pinnacle People encourage the reporting of any instances of suspected unethical, illegal, fraudulent or undesirable conduct involving Pinnacle People and provides protections and measures so that those persons who make a report may do so confidentially and without fear of intimidation, disadvantage or reprisal.
Pinnacle People do so in support of our commitment to the RCSA Code for Professional Conduct; and to support our commitment to the StaffSure
1.4 Whistleblower Definition
A whistleblower is a person, who could be an employee of a company, or a government agency, disclosing information to the public or some higher authority about any wrongdoing.
2. Who is Able to Make a Protected Disclosure
2.1 Overview
1) You will be protected if you are an “eligible whistleblower” AND you have disclosed information about a “disclosable matter” to a correct recipient.
2) This section identifies the different types of people, both within and outside Pinnacle People who can make a disclosure that qualifies for protection under the Corporations Act 2001 (i.e. “eligible whistleblowers”).
3) For information about what is a “disclosable matter”, see section 3 of this Policy.
4) For information about who is a correct recipient to receive a disclosure see section 4 of this Policy.
5) For information about the protections available to eligible whistleblowers under the Corporations Act 2001, see section 6 of this Policy.
2.2 Who can be an eligible whistleblower
2.2.1. “Insiders” as Eligible Whistleblowers
1) An individual is an eligible whistleblower in relation to an entity to which this Policy applies if the individual is or has been any of the following:
a) an officer or employee of the entity (e.g. current and former employees who are permanent, part-time, fixed-term or temporary, on-hire, interns, secondees, managers, and directors);
b) a supplier of services or goods to the entity (whether paid or unpaid), including their employees (e.g. current and former (independent) contractors, consultants, service providers and business partners);
c) an associate of the entity; and
d) a relative, dependant or spouse of an individual in paragraphs(a) to (c) (e.g. relatives, dependants or spouse of current and former employees, contractors, consultants, service providers, suppliers and business partners)
2.2.2. Competitors are NOT Eligible Whistleblowers
1) Although a competitor might be affected by misconduct or an improper state of affairs or circumstances, they mostly cannot access the whistleblower protections under the Corporations Act because those protections are targeted at “insiders” of companies.
2) However, competitors may have rights under other laws (or they may also be suppliers). If you are a competitor, we encourage you to report your concerns to ASIC if they relate to matters within our regulatory responsibilities or to RCSA if they relate to our professional conduct responsibilities. Remember, reports made to RCSA do not attract whistleblower protections under the Corporations Act but they may be confidential under other measures. We also encourage you to seek your own independent legal advice.
2.2.3. Customers and Clients are NOT Eligible Whistleblowers
1) Although a customer or client might be affected by misconduct or an improper state of affairs or circumstances, they mostly cannot access the whistleblower protections under the Corporations Act because those protections are targeted at “insiders” of companies.
2) However, customers and clients may have rights under other laws. Some customers may also be suppliers in some circumstances. If you are a customer or client, we encourage you to report your concerns to ASIC if they relate to matters within our regulatory responsibilities, or to RCSA if they relate to our professional conduct responsibilities. We also encourage you to seek your own independent legal advice.
3. Disclosable Matters Covered by this Policy
3.1 Overview
1) Disclosable matters involve information which a whistleblower has reasonable grounds to suspect concerns misconduct or an improper state of affairs or circumstances in relation to an entity to which this Policy applies.
2) Disclosures made by an “eligible whistleblower” about “disclosable matters” to a correct recipient qualify for protection under the Corporations Act.
3) A disclosure may still qualify for protection even if it turns out to be incorrect. However, disclosures that are made without reasonable grounds – e.g. by way of a personal opinion or mere allegation with no supporting information are unlikely to qualify for protection.
4) Disclosures that are not about disclosable matters do not qualify for protection under the Corporations Act (or the Taxation Administration Act, where relevant).
5) Some types of disclosures – e.g. personal work-related grievances – do not qualify for protection under the Corporations Act 2001. However, they might be protected under other legislation, such as the Fair Work Act 2009.
6) This section provides more information about the types of matters that can be disclosed under this Policy.
7) For information about who is an eligible whistleblower, see section 2 of this Policy.
8) For information about who is a correct recipient see section 4 of this Policy.
9) For information about the protections available to eligible whistleblowers under the Corporations Act, see section 6 of this Policy.
3.2. Misconduct and an improper state of affairs or circumstances
1) Misconduct includes fraud, negligence, default, breach of trust and breach of duty.
2) Many different types of conduct could amount to an “improper state of affairs” concerning an entity to which this Policy applies.
3) For example, an “improper state of affairs or circumstances” might not involve unlawful conduct in relation to the entity but may indicate a systemic issue that a relevant regulator should know about to properly perform its functions. It may also relate to business behaviour and practices that might cause consumer harm.
3.2.1. Broad Examples
Some broad examples of misconduct or an improper state of affairs or circumstances would be:
a) illegal conduct, such as theft, dealing in, or use of illicit drugs, violence or threatened violence, and criminal damage against property;
b) fraud, money laundering or misappropriation of funds;
c) offering or accepting a bribe;
d) financial irregularities;
e) failure to comply with, or breach of, legal or regulatory requirements;
f) engaging in or threatening to engage in detrimental conduct against a person who has made a disclosure or is believed or suspected to have made, or be planning to make, a disclosure;
g) conduct that constitutes a significant risk to public safety; and
h) misconduct or an improper state of affairs or circumstances in relation to the tax affairs of an entity to which this Policy applies (e.g. involvement in tax avoidance through cash payments).
3.2.2. Specific Examples
Some more specific examples of misconduct or an improper state of affairs or circumstances would be:
a) unsafe work practices;
b) unsafe or unhealthy accommodation provided or procured in connection with work;
c) exploitation within the meaning of s. 271.1A of the Schedule to the Criminal Code Act including:
-
- slavery, or a condition similar to slavery;
- servitude;
- forced labour;
- forced marriage;
- debt bondage;
d) threats to have a person’s visa cancelled by authorities;
e) withholding of a visa holder’s passport;
f) pressure to work beyond the restrictions of a visa;
g) prohibited up-front payment or ‘deposit’ for a job;
h) involvement in people trafficking;
i) “wage theft”;
j) “sham contracting”;
k) involvement in unlicensed labour hire supply arrangements or avoidance schemes (where licences are required);
l) involvement in unlicensed private employment agency activity (where licences are required);
m) unconscionable conduct either within the meaning of the common law or under the Australian Consumer Law, including:
-
- exploitation of vulnerability or weakness;
- abuse of positions of trust or confidence;
- insistence upon rights in circumstances which make that insistence harsh or oppressive;
- unequitable denial of legal obligations; or
- unjust retention of property;
n) misleading or deceptive conduct – e.g. in relation to job ads or job “scams”; and
o) cartel and other anti-competitive conduct in contravention of the Competition and Consumer Act.
3.2.3. RSCA Code Disclosures
1) As RCSA Members, we are bound by a Code for Professional Conduct and are under a duty to bring any material concern about our conduct in Professional Practice to the attention of RCSA.
2) Under RCSA's new code, which has been authorised by the ACCC to commence on 8 August 2020, we also accept a professional responsibility of continuous disclosure of events in which we are involved and findings made against us which could reasonably be expected to reflect adversely on our character or reputation or that of the Association or the Industry. Such matters can result in the imposition on us of sanctions in the form of suspension or expulsion from RCSA.
3) Our commitment to being bound by the RCSA Code is also a matter that a Court could take into account in determining whether conduct in which we are engaged or involved could be characterised as “unconscionable” under the Australian Consumer Law.
4) As such, we consider that conduct involving serious breaches of the RCSA Code could have significant implications for us and could be characterised in some cases as “misconduct or an improper state of affairs or circumstances”.
5) Subject to section 3.3.1 (Personal Work-Related Grievances) of this Policy, such matters will be treated, under this Policy, as disclosable matters depending on how serious they are even though they may not qualify for Whistleblowers' Protections under the Corporations Act. But keep in mind that reports made to RCSA do NOT qualify for whistleblower protections under the Corporations Act even though other confidentiality provisions may apply.
6) If you wish to claim whistleblower protections in relation to a matter arising under RCSA’s Code for Professional Conduct, you might have to disclose it to a proper recipient first and authorise them to liaise with RCSA. You are encouraged to seek your own independent legal advice if you think this might apply to you.
3.2.4. StaffSure Accreditation Certificate AU18/81841161 SGS
1) Staff Sure are certified under RCSA’s Service RCSA StaffSure:2017. Our certifications underpin important supply arrangements with our customers. Serious or critical non-conformances can result in withdrawal or suspension of certification.
2) As such, we consider that conduct involving serious or critical non-conformances could have significant implications for us and could be characterised as “misconduct or an improper state of affairs or circumstances”.
3) Subject to section 3.3 (Disclosures not covered by this Policy), such matters will be treated, for the purposes of this Policy, as disclosable matters depending on how serious they are even though they may not qualify for whistleblowers' protections under the Corporations Act.
3.2.5. Tax Disclosures
1) To qualify for protection under the tax whistleblower regime, an eligible whistleblower must have reasonable grounds to suspect that the information indicates misconduct or an improper state of affairs or circumstances with respect to the tax affairs of the entity.
2) For further information about the protections under the tax whistleblower regime, see the Australian Taxation Office’s webpage on tax whistleblowers.
3.3 Disclosures about matters not covered by this policy
Some types of disclosure are not covered by this policy. However, they may still be protected under other legislation such as the Fair Work Act 2009.
3.3.1. Personal Work-Related Grievances
1) Disclosures relating to “personal work related grievances” do not qualify for protection under the Corporations Act.
2) Personal work related grievances are those that relate to the whistleblower’s current or former employment and have, or tend to have, implications for the whistleblower personally, but do not:
a) have any other significant implications for the entity (or another entity); or
b) relate to any conduct, or alleged conduct, about a disclosable matter.
3) Some examples of personal work related grievances would be a grievance about:
a) an interpersonal conflict between the whistleblower and another employee;
b) a decision that does not involve a breach of workplace laws;
c) a decision about the engagement, transfer or promotion of the whistleblower;
d) a decision about the terms and conditions of engagement of the whistleblower; and
e) a decision to suspend or terminate the engagement of the whistleblower, or otherwise to discipline the whistleblower.
4) A disclosure about such a matter will still qualify for protection if:
a) it includes information about misconduct, or information about misconduct includes or is accompanied by a personal work-related grievance (mixed report);
b) the entity has breached employment or other laws punishable by imprisonment for a period of 12 months or more, engaged in conduct that represents a danger to the public, or the disclosure relates to information that suggests misconduct beyond the whistleblower’s personal circumstances;
c) the whistleblower suffers from or is threatened with detriment for making a disclosure; or
d) the whistleblower seeks legal advice or legal representation about the operation of the whistleblower protections under the Corporations Act.
5) Pinnacle People team members should report any misgivings directly to their state managers. Often day to day issues are resolved on the day and the state manager is the best point of contact for such issues. Where a team member does not feel comfortable speaking with their direct manager, they should report any reportable offenses directly with the Director of People and Culture
4. Who Can Receive a Disclosure (Proper Recipients)
4.1 Overview
1) This section sets out information about who can receive disclosures that qualify for protection by identifying the types of people within and outside Pinnacle People who can receive information about disclosable matters.
2) You need to make a disclosure directly to a proper recipient to be able to qualify for protection as a whistleblower under the Corporations Act (or Taxation Administration Act, where relevant).
3) Proper recipients include:
a) people within and outside our organisation who have statutory authority because of their position to receive disclosures or whom we have expressly authorised. We refer to these people as eligible recipients - see section 4.2 of this Policy;
b) legal practitioners in some circumstances – see section 4.3 of this Policy;
c) certain regulatory bodies – see section 4.4 of this Policy; and
d) for public interest disclosures or emergency disclosures, in limited circumstances, certain journalists or parliamentarians – see section 4.5 of this Policy.
4) You can find out more information (e.g. before making a disclosure) by contacting:
a) our whistleblower protection officer – see section 11.1 of this Policy
b) our external independent whistleblowing service provider (if any) – see section 11.1 of this Policy; or
c) an independent legal adviser.
5) We would like to identify and address concerns about misconduct or an improper state of affairs or circumstances as early as possible. We therefore encourage you to make your disclosures to one of our authorised internal or external eligible recipients identified in section 4.2 of this Policy in the first instance if you feel comfortable to do so.
4.2. Authorised internal and external eligible recipients
1) Eligible recipients authorised to receive disclosures relating to Pinnacle People include:
a) a director, officer or senior manager of Pinnacle People or
b) a person authorised by the Managing Director to receive disclosures that may qualify for protection.
2) Persons authorised by Pinnacle People for the purposes of paragraph 4.2(1) above include:
a) Wendy Mead – Managing Director
b) Flami Hobbs – Director of People & Culture
4.3. Legal practitioners
1) Disclosures to a legal practitioner for the purposes of obtaining legal advice or legal representation in relation to the operation of the whistleblower provisions in the Corporations Act are protected (even if the legal practitioner concludes that a disclosure does not relate to a “disclosable matter”).
4.4. Regulatory bodies
1) Disclosures of information relating to disclosable matters can be made to ASIC, the Australian Prudential Regulation Authority (APRA) or another Commonwealth body prescribed by regulation and qualify for protection under the Corporations Act.
2) You can also make disclosure about tax affairs to the ATO and qualify for protection.
4.5. Public interest disclosures and emergency disclosures
1) Information about disclosable matters can be disclosed to a journalist or parliamentarian under certain circumstances and qualify for protection.
2) Public Interest Disclosures (i.e. where you have reasonable grounds to believe your disclosure is in the public interest) and Emergency Disclosures (i.e. where you have reasonable grounds to believe that your information concerns a substantial and imminent danger to the health or safety of one or more people or the natural environment) must have previously been made to ASIC, APRA, or a prescribed body and written notice needs to have been provided to the body to which the disclosure was made.
3) In the case of a public interest disclosure, at least 90 days must have passed since the previous disclosure.
4) It is important that you understand the conditions for making such disclosures and you should contact an independent legal adviser before making a public interest disclosure or an emergency disclosure.
5. How to Make a Disclosure
5.1. Overview
1) This section sets out how to make a disclosure and includes a range of internal and external disclosure options to allow disclosures to be made anonymously and/or confidentially, securely and outside business hours.
2) The information which you provide should be factual and should be supported by evidence. For example, do not say merely, “I was bullied”. Describe the conduct that constituted the bullying, being as specific as you can. Do not say, merely, “I was exploited” or, “I was discriminated against”. Describe the conduct that amounted to the exploitation or the discrimination.
3) It will help if you can provide details of times, dates, conversations, people involved and places where events occurred. It will also help us to focus on the substance of your disclosure if you can provide documents that support your disclosure.
4) Providing accurate and good quality information can help us to understand the substance of your disclosure and will result in a greater likelihood that it will be accepted as eligible for protection, rather than being dismissed as a false disclosure or one that is trivial, frivolous, or vexatious.
5.2. Anonymous disclosures
1) Disclosures can be made anonymously and still be protected under the Corporations Act.
2) You can choose to remain anonymous while making a disclosure, over the course of the investigation and after the investigation is finalised.
3) You can also refuse to answer questions that you feel could reveal your identity at any time, including during follow-up conversations.
4) In order to protect your anonymity, we:
a) have set up measures for protecting anonymity by providing of an anonymised email address: whistleblower@pinnaclepeople.com.au
b) encourage you, before you make a disclosure, to speak with:
our Whistleblower Protection Officer/s (see section 5.3.1 of this Policy)
5.3. Contact information
5.3.1. Our Whistleblower Protection Officer/s
Wendy Mead- Managing Director
Email | wmead@pinnaclepeople.com.au
Phone | 03 8624 1701
Mobile | 0417 502 343
Helene Sexton – CEO
Email | hsexton@pinnaclepeople.com.au
Phone | 03 8624 1714
Mobile | 0420 928 796
Flami Hobbs – Director of People & Culture
Email | fhobbs@pinnaclepeople.com.au
Phone | 03 8624 1701
Mobile | 0412 608 309
6. Legal Protections for Whistleblowers
This section sets out information about the protections under the Corporations Act that are available to eligible whistleblowers.
6.1. Overview
Whistleblower protections apply not only to internal disclosures, but also to disclosures to legal practitioners, regulatory and other external bodies, and public interest and emergency disclosures that are made in accordance with the Corporations Act.
6.2. Identity protection (confidentiality)
1) We are under legal obligations to protect the confidentiality of a whistleblower’s identity.
2) Subject to some exceptions, it is illegal to identify a whistleblower or to disclose information that is likely to lead to the identification of a whistleblower whose identity is protected by the obligation of confidentiality.
3) There are some exceptions that allow a whistleblower’s identity to be disclosed to certain regulators, a legal practitioner (for the purpose of obtaining advice about the whistleblower protections under the Corporations Act), and persons or bodies prescribed by regulations.
4) A whistleblower’s identity can also be disclosed with proper consent of the whistleblower.
5) We may disclose information that a whistleblower has given us without the whistleblower’s consent provided that:
a) the information does not include the whistleblower’s identity;
b) we have taken all reasonable steps to reduce the risk that the whistleblower will be identified from the information; AND
c) it is reasonably necessary for investigating the issues raised in the disclosure.
6) You can raise concerns or a grievance about our handling of the confidentiality of your identity or disclosure with:
a) one of our Whistleblower Protection Officers – see section 5.3.1 of this Policy;
b) a legal practitioner; or
c) a relevant regulator – e.g. ASIC, APRA or the ATO.
6.3. Protection from detrimental acts or omissions
1) Eligible whistleblowers have the benefit of legal protections from detrimental acts or omissions (detriment) in relation to a disclosure.
2) A person is not permitted to engage in conduct that causes detriment to a whistleblower (or another person), in relation to a disclosure, if:
a) the person believes or suspects that the whistleblower (or another person) made, may have made, proposes to make or could make a disclosure that qualifies for protection; AND
b) the belief or suspicion is the reason, or part of the reason, for the conduct.
3) In addition, a person cannot make a threat to cause detriment to a whistleblower (or another person) in relation to a disclosure.
4) Detriment is a broad concept that could include any of the following and more:
a) dismissal of an employee;
b) injury of an employee in his or her employment;
c) alteration of an employee’s position or duties to his or her disadvantage;
d) discrimination between an employee and other employees of the same employer;
e) harassment or intimidation of a person;
f) harm or injury to a person, including psychological harm;
g) damage to a person’s property;
h) damage to a person’s reputation; or
i) damage to a person’s business or financial position.
5) On the other hand, some conduct may have adverse consequences for a whistleblower, but would not be regarded as detriment. Examples could include:
a) administrative action that is reasonable for the purpose of protecting a whistleblower from detriment (e.g. moving a whistleblower who has made a disclosure about their immediate work area to another office to prevent them from detriment); or
b) managing a whistleblower’s unsatisfactory work performance, if the action is in line with the entity’s usual performance management framework.
6.4. Compensation and Other Remedies
1) A whistleblower (or any other employee or person) can seek compensation and other remedies through the courts if:
a) they suffer loss, damage or injury because of a disclosure; and
b) the entity in relation to which the disclosure was made failed to take reasonable precautions and exercise due diligence to prevent the detrimental conduct.
2) If you think you might have a right to compensation or other remedies, you should seek independent legal advice.
6.5. Civil, Criminal and Administrative Liability Protection
1) An eligible whistleblower is protected from any of the following in relation to their disclosure:
a) civil liability (e.g. any legal action against the whistleblower for breach of an employment contract, duty of confidentiality or another contractual obligation);
b) criminal liability (e.g. attempted prosecution of the whistleblower for unlawfully releasing information, or other use of the disclosure against the whistleblower in a prosecution (other than for making a false disclosure)); and
c) administrative liability (e.g. disciplinary action for making the disclosure).
2) However, the protections do not grant immunity for any misconduct a whistleblower has engaged in that is revealed in their disclosure.
3) If you think you might be entitled to claim immunity – e.g. by claiming a “marker” and immunity under the ACCC’s immunity and cooperation policy for cartel conduct - October 2019 – you should seek independent legal advice about how to protect your rights and advance your claim.
7. Support & Practical Protection
This section sets out information about the support and protective measures Pinnacle People have in place to ensure particulars risks of disclosure of identity or detriment to that you identify in relation to the whistleblowing incident
7.1. Overview
1) This section sets out information about how we will support eligible whistleblowers and protect them against disclosure of their identity and detriment.
2) You can raise concerns or a grievance about our handling of the confidentiality of your identity or disclosure or about the risk of detriments arising from disclosure with:
- a) one of our Whistleblower Protection Officers – see section 5.3.1 of this Policy;
- c) a legal practitioner; or
- d) a relevant regulator – e.g. ASIC, APRA or the ATO.
7.2. Identity protection (confidentiality)
In practice, we will protect the confidentiality of an eligible whistleblower’s identity by:
a) storing original documents securely and using sanitised, redacted and anonymised/ pseudonymised PDF documents in their place wherever is practicable to do so when handling a whistleblowing matter;
b) using gender neutral language;
c) ensuring that disclosures are handled by trained and qualified internal staff or external providers;
d) limiting access to information about the whistleblowing matter on a “need-to-know” basis;
e) confirming appropriateness and consent to use designated communication channels when handling whistleblowing matters;
f) labelling documents produced in the course of handling whistleblowing matters, “Whistleblowing Confidential”;
g) encouraging within the organisation a culture of respect for disclosure and whistleblowers;
h) taking appropriate action, within our power to do so, against anyone involved in breaching or compromising confidentiality;
i) encouraging whistleblowers to engage with our Whistleblower Protection Officers and other relevant persons (e.g. their lawyers) about any concerns they might have regarding the risk of identity disclosure or detriment;
j) proactively discouraging speculation, guessing, and gossip about the identity of whistleblowers if it should come to our attention;
k) encouraging engagement with external providers – e.g. lawyers, risk & governance consultants, external independent whistleblowing service providers, and your authorised external eligible recipients – where our risk assessment procedures indicate that it is advisable and practicable to do so;
l) taking appropriate action, including legal action as may be indicated and advised, against any person involved in a breach of confidentiality in order to minimise and remediate any harm that may be suffered in consequence of the breach;
7.3. Protection from Detrimental Acts or Omissions
1) Upon receiving notice of a disclosable matter, we will:
a) undertake, or procure to be undertaken, a preliminary risk assessment with regard to the likelihood and severity of risks of identity disclosure and detriment;
b) determine (in consultation with you) a strategy to control the risks and provide support;
c) seek your consent to the risk control and support strategy.
2) Risk controls and support measures are likely to vary from case to case but may include:
a) referral to appropriate support services (including counselling or other professional or legal services);
b) variation in duties, reporting arrangements, times or the place where work is to be performed;
c) separation of people and processes involved in any concurrent performance review or disciplinary process;
d) appropriate use of “ethical walls”;
e) encouraging within the organisation a culture of respect for disclosure and whistleblowers;
f) taking appropriate action, within our power to do so, against anyone involved in causing detriment to a whistleblower, or compromising whistleblower protections;
g) encouraging whistleblowers to engage with our Whistleblower Protection Officers and other relevant persons (e.g. their lawyers) about any concerns they might have regarding the risk of detriment;
h) encouraging engagement with external providers – e.g. lawyers, risk & governance consultants, external independent whistleblowing service providers, and authorised external eligible recipients – where our risk assessment procedures indicate that it is advisable and practicable to do so;
i) taking appropriate action, including legal action as may be indicated and advised, against any person involved in causing or contributing to detriment to a whistleblower in order to minimise and remediate any harm that may be suffered in consequence of the detriment;
3) Please note that some circumstances may require us to implement risk controls without your consent, and with only limited consultation – e.g. in cases of urgency.
4) Our risk assessments will be reviewed regularly as may be necessary during the handling of a whistleblower disclosure.
8. Handling (and Investigating) Disclosures
8.1. Overview
This section sets out how Pinnacle People handle and investigate whistleblowing disclosures.
8.1.1. Not every disclosure will require or warrant formal investigation
1) Not every disclosure will require or warrant a formal investigation and not every disclosure will be amenable to formal investigation because the scope of our power (and that of our external eligible recipients and service providers) is limited – i.e. they have no statutory powers of investigation such as a regulator (e.g. ASIC or the ACCC) may have.
2) Some disclosures may warrant only a broad review of the subject matter or work area disclosed.
3) Some disclosures might be appropriately addressed by corrective action procedures applicable under our quality management and professional service delivery management systems and certifications.
4) Some disclosures may raise professional conduct matters under RCSA’s Code for Professional Conduct (by which we are bound) and might be appropriately addressed by pathways available under RCSA’s Professional Conduct Grievance Intervention Guidelines.
5) Regardless of whether a disclosure is formally investigated or not, we will take the measures outlined in section 7.2 (Identity protection (Confidentiality)) of this Policy to ensure the confidentiality of information collected in the course of handling the matter.
8.2. Key steps on receipt of disclosure
1) The steps which we would take on receipt of a disclosure, and the sequence in which we would take them, may vary depending on the source from which we receive notice of the disclosure – e.g. notice that a disclosure has been made might come to us from an authorised external eligible recipient or from a regulator.
2) If notice of a disclosure comes to us directly from you, being the person making it, we would take the steps outlined below within the indicated timeframes wherever practicable.
3) If there are circumstances that warrant greater urgency, you are encouraged to tell us (or an eligible recipient) about them when providing your notification.
8.2.1. First response (within 1 business day)
1) Log the time and date the disclosure was received.
2) Decide if, on the face of it, it qualifies for protection under the Corporations Act (or the Tax Administration Act, where relevant). We will adopt a “precautionary approach” assuming, until we can confirm otherwise, that it does qualify.
3) Immediately commence to apply confidentiality measures outlined in section 7.2 of this Policy.
4) Appoint an internal case manager.
5) Confirm the suitability of communication channels and protocols with you.
6) Confirm as soon as practicable whether the disclosure qualifies for protection under the Corporations Act and advise you accordingly.
8.2.2. Additional steps if the disclosure qualifies for protection (within 3 business days of receipt)
1) Decide upon the appropriate means of addressing the matters raised in your disclosure and advise you accordingly.
2) Seek from you any additional information that may be necessary to allow us to undertake the preliminary risk assessment described in section 7.3.1(a) of this Policy.
3) Undertake the preliminary risk assessment with regard to the likelihood and severity of risks of identity disclosure and detriment.
4) Determine (in consultation with you) a strategy to control the risks and provide support.
5) Seek your consent to the risk control and support strategy.
6) Commence to implement the risk control and support strategy and other protective measures outlined in section 7.3 (Protection from Detriments) of this Policy.
7) Inform RCSA (or another professional or industry body to whom we might owe disclosure obligations), subject to observing protections against disclosure of identity, if not contra-indicated by our preliminary risk assessment and otherwise required of us, of the misconduct or improper state of affairs or circumstances raised by the disclosure.
8) Inform our insurers, subject to observing protections against disclosure of identity, if not contra-indicated by our preliminary risk assessment and otherwise required of us, of the misconduct or improper state of affairs or circumstances raised by the disclosure BUT ONLY IF we are required to do so under terms of our relevant insurance policy – e.g. a directors & officers policy of insurance.
9) Provide an indicative timeframe for taking any additional steps required to address the matters raised in the disclosure.
8.3. Key steps in investigating a disclosure
1) Depending on the circumstances, investigation of information provided in an eligible disclosure might proceed as:
a) a formal investigation carried out by a regulator – e.g. ASIC or the ACCC, in which case the relevant regulator would be best placed to provide information about the key steps;
b) an investigation carried out by a third party certification body – e.g. the certifier of a quality management system, in which case the certification body would be best placed to provide information about the key steps;
c) an investigation or other intervention conducted by RCSA under its Code for Professional Conduct and Professional Conduct Grievance Intervention Guidelines – in which case RCSA would be best placed to provide information about the key steps;
d) an investigation carried out by us or on our behalf by our lawyers or an external independent whistleblowing service provider – in which case the key steps would be as set out at sub-section 8.3.1 below.
2) The steps may vary depending on the nature of the matters disclosed and the ability to obtain information that may be needed to complete an investigation.
8.3.1. Investigations by us or conducted on our behalf
1) Appoint a suitably qualified independent investigator.
2) Confirm measures to ensure confidentiality.
NOTE: Investigations are to be conducted confidentially bearing in mind that, subject to some exceptions, it is illegal to identify a whistleblower or to disclose information that is likely to lead to the identification of a whistleblower whose identity is protected by the obligation of confidentiality – see sub-section 6.2 of this Policy.
3) Confirm measures to protect against detriments.
4) Prepare an investigation plan that states its objective and any particular question or issue that needs to be answered or resolved. The principal objective of an investigation is to determine whether there is enough evidence to substantiate or refute the matters reported.
5) Confirm a timetable for the investigation plan.
6) Obtain information and advice in accordance with the investigation plan, including conducting necessary witness interviews and obtaining technical, financial or legal advice to support the investigation.
7) Review the evidence.
8) Prepare an investigation report.
9) Review and sign-off on the report.
8.3.2. Timeframe
We would aim to complete an investigation conducted by us or on our behalf within one calendar month of determining that the disclosure is appropriate for investigation. Some investigations may take longer depending on what is involved and upon the level of co-operation with our investigation.
8.4. Keeping Whistleblowers Informed
1) We will ensure that whistleblowers are provided with regular updates, if they can be contacted (including through anonymous channels). The frequency and timeframe for updates may vary depending on the nature of the disclosure and the progress of the investigation.
2) You might expect updates at key milestones during the investigation. Key milestones for updates would usually be:
a) decision to investigate;
b) appointment of investigator;
c) commencement of investigation;
d) completion of investigation;
e) sign off on report.
8.5. Documentation and Reporting of Findings
8.5.1. Record and Document Control
Information collected in the course of an investigation conducted under sub-section 8.3.1 will be recorded and documented in accordance with the following controls:
8.5.1.1. Distinctive
Records and documents should be distinctively identified and described – including by time, date and version.
8.5.1.2. Format and Media
Records and documents should be kept in formats and media appropriate to their content, intended use, and archival needs.
8.5.1.3. Integrity
Records and documents should be appropriately protected from loss of integrity – e.g. loss of integrity by corruption, loss of confidentiality, improper use.
8.5.1.4. Source & Authorship
Source and authorship of records and documents are recorded and assured.
8.5.1.5. Retention
Records and documents are preserved in accordance with relevant retention and preservation requirements.
8.5.2. Report findings
1) Findings of investigations conducted under sub-section 8.3.1 will be documented in a confidential in PDF format, suitably sanitised, redacted, anonymised/ pseudonymised and password protected.
2) Reports are to include:
a) a timeline of the steps taken in the investigation.
b) any findings of fact and any expert opinion adopted in reaching any conclusions;
c) sufficient reasons leading to the answers or resolutions to questions and issues posed in the investigation plan or subsequently arising in the course of the investigation;
d) what portions may be disclosed and to whom (including the whistleblower), consistently with the need to preserve confidentiality and protect against detriments.
3) Reports may, but need not, include recommendations for further actions.
9. Fair Treatment of Individuals Mentioned in Disclosures
9.1. Overview
This section describes how we ensure the fair treatment of our employees who are mentioned in a disclosure that qualifies for protection, including those who are the subject of a disclosure.
9.2. Fair treatment measures
1) Disclosures will be handled confidentially, when it is practical and appropriate in the circumstances.
2) Each disclosure made to us will be assessed as provided in section 8.2 of this Policy and may be the subject of an investigation.
3) Investigations will be conducted within the scope of the objectives, questions and issues identified in the investigation plan (see sub paragraph 8.3.1(4) of this Policy) and otherwise in the manner described in section 8.3 of this Policy.
4) An employee who is the subject of a disclosure will be advised about the subject matter of the disclosure as and when required by principles of natural justice and procedural fairness and, if reasonably practicable to do so, prior to any actions being taken—for example, if the disclosure will be the subject of an investigation.
5) An employee who is the subject of a disclosure may contact our Whistleblower Protection Officer to enquire about support services that are available and is encouraged to seek independent legal advice.
10. Availability, Education & Training, and Accessibility
10.1. Overview
This section sets out information about how this Policy will be made available to internal and external whistleblowers
10.2. Internal whistleblowers
1) The CEO (or specifically delegated Senior Management) shall ensure that this Policy is widely disseminated to, and easily accessible by, our officers and employees (including its staff in overseas based operations) by suitable measures including:
a) holding staff briefing sessions and/or smaller team meetings;
b) posting the Policy on the staff intranet or other communication platform;
c) posting information on staff noticeboards;
d) setting out the Policy in the employee handbook;
e) incorporating the Policy in employee induction information packs and training for new starters; and
f) providing upfront and regular ongoing education and up-to-date training to all staff suitable to their responsibilities and training needs.
10.3. External whistleblowers
1) We will ensure that this Policy is available to external whistleblowers by providing a version of it on our website.
2) The website version may have information removed that would not be suitable for external publication (e.g. the names and contact phone numbers of internal eligible recipients for employees).
11. Governance
This section sets out roles and responsibilities as well as contact information.
11.1. Roles & responsibilities
11.1.1. Senior Executive Management Team
responsible for approving the Policy and any updates.
11.1.2. Whistleblower policy owner- Managing Director
responsible for oversight and monitoring of the Policy.
11.1.3. Whistleblower policy review committee
responsible for reviewing the Policy.
11.1.4. Staff members who are authorised internal eligible recipients
responsible to receive disclosures.
11.1.5. Auditors (if any)
authorised as external eligible recipients.
11.1.6. Whistleblower Protection Officer (internal)
responsible for safeguarding and protecting the rights of whistleblowers.
11.1.7. Disclosure investigation officers (internal)
responsible for conducting investigations.
11.1.8. Disclosure investigation officers (external)
responsible for conducting investigations.
11.1.9. External Independent Whistleblowing Service Provider (if any)
responsible for handling disclosures on our behalf.
11.2. Monitoring & Review
11.2.1. Overview
We will monitor this Policy at monthly intervals to ensure its continuing suitability, adequacy and effectiveness.
11.2.2. Monitoring Procedures
Monitoring shall be planned and carried out taking into account:
a) the status of actions from previous reviews;
b) changes in the organisation and its context relevant to this Policy
c) information on the performance and effectiveness of this Policy
d) the adequacy of resources required for effective operation of this Policy
e) the effectiveness of actions taken to address risks- see section 7.3 (Protection from Detriments) of this Policy; and
f) opportunities for improvement.
Reviewed September 2025