Whistleblower Protections in 2026

What changed for Australian organisations this year?

In effect, two things shifted at once. In June 2026, Treasury opened an eight-week consultation on the statutory review of tax and corporate whistleblowing, with submissions closing on 29 July 2026. That review was triggered by section 1317AK of the Corporations Act 2001 and covers access to justice, remedies and penalties.

Meanwhile, the regulator had already moved first. In December 2025, ASIC published Report 827, benchmarking whistleblower policies and programmes across 134 entities in 18 industries. Together, these two developments signal that the current settings are no longer treated as settled.

Why ASIC now measures practice, not paperwork

Notably, Report 827 was the first exercise of its kind in Australia. Rather than reviewing policy wording alone, ASIC asked organisations how their programmes ran day to day: which channels existed, who received disclosures, and what happened afterwards. As a result, the answers varied widely.

Crucially, ASIC said it would write directly to organisations whose practices sat below the benchmarks. In other words, a compliant document no longer protects an organisation with a dormant programme. Regulatory attention has moved from the policy shelf to the reporting line.

Where WHS law enters the picture

Traditionally, most compliance teams file whistleblowing under corporate governance. However, the moment a worker fears reprisal for reporting misconduct, the issue also becomes a work health and safety matter. Reprisal, exclusion and poor support are recognised psychosocial hazards.

Therefore, two separate legal duties now converge on the same organisational behaviour. One duty sits with the Corporations Act. The other sits squarely with the WHS Act 2011 and the Model WHS Regulations.

Executive Summary

• What this blog covers: How whistleblower protections work in Australia, what the 2026 Treasury review and ASIC Report 827 changed, and how PCBUs build a speak-up programme that survives scrutiny.
• Who it’s for: Compliance officers, company secretaries, WHS managers, people and culture leads, and officers carrying due diligence obligations.
• Key regulatory context: Part 9.4AAA of the Corporations Act 2001, the Taxation Administration Act 1953, ASIC Regulatory Guide 270, and psychosocial duties under the WHS Act 2011.
• The central risk: Organisations hold a compliant policy while workers still believe that reporting misconduct will cost them their career.
• Primary action required: Test whether your disclosure channels, eligible recipients and reprisal controls work in practice, then train the people who receive disclosures.

Who counts as an eligible whistleblower?

Specifically, Part 9.4AAA of the Corporations Act 2001 defines a broad group. Current and former workers qualify, and so do officers, contractors, suppliers and their staff. Notably, relatives and dependants of those people can also fall within scope.

In practice, this breadth surprises many organisations. A supplier’s driver may hold protections that an internal grievance policy never contemplated. Accordingly, scoping the audience is the first practical step in any programme review.

What kinds of disclosures attract protection?

Broadly, protection attaches to disclosures about misconduct or an improper state of affairs, made to an eligible recipient. Personal work-related grievances generally sit outside the regime, although the boundary is not always obvious in practice.

In broad terms, the following categories commonly attract protection under the corporate regime:

• Conduct that breaches corporations or financial services legislation
• Fraud, bribery, corruption or theft affecting the organisation
• Conduct that represents a danger to the public or the financial system
• Serious misconduct or an improper state of affairs in the organisation’s operations
• Concealment or falsification of records relevant to the above

Which organisations must hold a whistleblower policy?

Section 1317AI requires public companies, large proprietary companies and corporate trustees of registrable superannuation entities to maintain a compliant policy and make it available to officers and workers. Failure to do so is a strict liability offence carrying 60 penalty units.

Smaller organisations sit outside that mandatory obligation. Nevertheless, the protections themselves still apply to their disclosers, and the WHS duty to manage psychosocial risk applies to every PCBU regardless of size.

The four barriers that stop a disclosure

Critically, silence rarely reflects ignorance of the policy. Instead, it reflects a rational calculation about consequences. Research and regulator commentary consistently point to four barriers:

• Fear of reprisal — workers expect exclusion, shift changes or a stalled career rather than formal dismissal
• Doubt about confidentiality — small teams make anonymity feel impossible, whatever the policy promises
• Low confidence in the outcome — previous reports disappeared without visible action or feedback
• Uncertainty about eligibility — people cannot tell whether their concern counts as misconduct or a personal grievance

How silence becomes a systemic risk

Over time, an unreported concern does not stay static. Over time, it either resolves informally, escalates into a regulatory matter, or reaches a journalist. Boards then learn about the problem at the worst possible moment.

ASIC found that organisations with visible reporting channels and recurring communication received more disclosures than those running one-off awareness activity. Higher disclosure volumes are therefore a health signal, not a warning light. A programme receiving nothing is usually a programme nobody trusts.

What under-reporting looks like in practice

Fortunately, under-reporting leaves recognisable fingerprints across the organisation. In particular, watch for these patterns:

• Zero or near-zero disclosures across multiple reporting periods
• Concerns surfacing first in exit interviews rather than through official channels
• Managers resolving serious allegations quietly, without recording them
• Workers escalating externally to a regulator before raising anything internally

Ultimately, each pattern points to the same root cause. People weighed the risk of speaking up and decided against it.

What the corporate regime requires

At its core, the Corporations Act 2001 sets three rules: protection of identity, immunity from certain legal actions, and remedies where an organisation causes detriment. ASIC Regulatory Guide 270 then explains what a compliant policy must contain and how it should be made available.

Additionally, the Taxation Administration Act 1953 runs a parallel regime for tax-related disclosures. Treasury’s 2026 review asks whether these two regimes should be consolidated, which is why the framework is worth watching closely this year.

How the WHS Act 2011 applies to reprisal risk

Under the WHS Act 2011, every PCBU must eliminate or minimise risks to health so far as is reasonably practicable. Health includes psychological health. Consequently, the treatment a discloser receives after reporting falls within the WHS duty.

The Model WHS Regulations require PCBUs to manage psychosocial risk, and Safe Work Australia’s Model Code of Practice on managing psychosocial hazards at work names poor support, harmful behaviours and exposure to conflict among the recognised hazards. Regulators such as SafeWork NSW apply that framework when they assess how an organisation handled a worker who raised a concern. Officer due diligence obligations sit alongside it.

Where regulators focus their scrutiny

Helpfully, Report 827 gave the market a clear view of what good and weak practice look like. Based on that benchmarking and existing guidance, scrutiny tends to concentrate on the following areas:

• Visible, dedicated reporting channels that demonstrably work rather than merely exist
• Two-way contact with an anonymous discloser throughout an investigation
• Role-specific training for every person who may receive a disclosure
• Structured board reporting on disclosures, outcomes and reprisal concerns
• Periodic effectiveness reviews of the programme, not simply the policy wording

None of these expectations requires new legislation. Each one already sits inside existing guidance, which is precisely why regulators can act on them now.

What officers must be able to demonstrate

Crucially, officer due diligence is an active obligation rather than a passive one. In practice, officers should be able to show a documented trail across four areas:

• Current knowledge of the organisation’s disclosure obligations and reprisal risks
• Adequate resourcing for investigation capacity and discloser support
• Verification that reporting channels function, tested rather than assumed
• Timely response to reported concerns, with decisions and reasons recorded

Why the first five minutes decide everything

Notably, most disclosures begin informally. A worker mentions something to a supervisor in a corridor, watches the reaction, and decides whether to continue. That reaction, far more than the policy, determines what happens next.

Managers therefore need practised responses for the opening moments:

• Listen without promising an outcome or debating the allegation
• Protect identity immediately, including from other managers
• Explain the next step and the realistic timeframe
• Escalate to an eligible recipient rather than investigating personally

Why training the receiver matters most

Typically, organisations invest heavily in telling workers that a hotline exists. Far fewer invest in preparing the people who answer it. Yet a single mishandled first conversation can close a channel for years.

Fortunately, targeted scenario-based training closes that gap quickly. Our Whistleblower in Australia course walks managers and eligible recipients through realistic disclosure scenarios, confidentiality decisions and reprisal red flags.

Defining the gap

Put simply, policy-as-written is the document the board approves and publishes on the intranet. It describes ideal conditions: clear channels, protected identities, impartial investigations and no detriment.

Policy-as-lived is what a worker actually experiences on a Tuesday afternoon. It includes the supervisor’s sigh, the rumour that spreads by Friday, and the roster change that follows a fortnight later.

Increasingly, regulators examine the second version instead. ASIC’s shift toward benchmarking real practice makes that priority explicit.

Signs the gap is widening in your organisation

Usefully, several early indicators appear well before a regulatory problem does:

• Workers describe the hotline as “the number nobody rings”
• Eligible recipients cannot name their obligations without opening the policy
• Investigation timeframes stretch without anyone updating the discloser
• Engagement survey comments reference fear of retaliation

Closing the gap deliberately

In practice, measurement closes gaps faster than redrafting does. Track disclosure volumes, time to first response, substantiation rates and post-disclosure retention, then report those figures to the board alongside the policy.

Ultimately, a speak-up culture is a behavioural outcome rather than a documentary one. Behaviour changes when leaders model it, training rehearses it, and reporting makes it visible.

The eCompliance Central Speak-Up Integrity Framework

Rebuilding trust in a reporting line requires sequence rather than enthusiasm. The following six steps translate the regulatory expectations above into work your team can complete this quarter. Each step produces evidence that an officer, an auditor or a regulator can inspect.

A 6-Step Framework for Speak-Up Integrity

Step 1

Map Every Disclosure Route

List every channel people actually use, including supervisors, the hotline and email. Then confirm each route reaches a trained recipient.

Step 2

Name Your Eligible Recipients

Identify by role who may lawfully receive a protected disclosure, because titles change but roles persist. Publish those roles so nobody guesses under pressure.

Step 3

Train The Receivers First

Rehearse the opening conversation with realistic scenarios before running any organisation-wide awareness push. Recipients set the tone for everything that follows.

Step 4

Engineer Confidentiality Controls

Restrict file access, separate investigation records, and also enable two-way contact with anonymous disclosers. Small teams need tighter controls, not looser ones.

Step 5

Treat Reprisal As A Hazard

Add detrimental conduct to your psychosocial risk register, alongside named controls and a review date. Monitor the discloser’s working conditions for six months afterwards.

Step 6

Report Upward And Repeat

Give the board structured data on volumes, timeframes, outcomes and reprisal concerns every cycle. Afterwards, act on what the numbers reveal.

How to sequence the framework across a year

Steps one to three suit a single quarter, because they rely on mapping and training rather than system change. By contrast, the fourth and fifth steps usually need technology and risk-register work, so allow a second quarter. Step six then becomes a standing agenda item.

The cost of a mishandled disclosure

Unfortunately, a failed disclosure rarely stays contained. Instead, it multiplies across legal, regulatory and cultural fronts at the same time.

A mishandled report typically escalates in three stages:

• Immediate: the discloser withdraws, colleagues observe the outcome, and internal reporting stops across the team
• Medium term: the underlying misconduct continues undetected while turnover rises in the affected area
• Long term: the matter surfaces externally through a regulator, a court, or media coverage, with compensation and reputational exposure attached

Why the WHS exposure is often missed

Understandably, legal teams focus on Corporations Act remedies. Meanwhile, the psychological injury caused by reprisal can generate a separate WHS exposure, a workers’ compensation claim and a notifiable incident question.

Officers who never connected whistleblowing to psychosocial risk find that gap difficult to explain afterwards. Accordingly, integrating both duties into one risk conversation avoids that outcome.

Compliance Intelligence: Key Insights

Treasury’s statutory review of tax and corporate whistleblowing ran an eight-week consultation that closed on 29 July 2026, so the framework may change.

ASIC Report 827 benchmarked 134 entities across 18 industries and found wide variation in programme maturity.

Failing to maintain a compliant policy under section 1317AI is a strict liability offence carrying 60 penalty units.

Reprisal against a discloser is a psychosocial hazard, which brings the WHS Act 2011 duty into every whistleblowing matter.

Organisations with visible channels and recurring communication receive more disclosures than those running one-off campaigns.

Zero disclosures across several reporting periods usually signals distrust, rather than an absence of misconduct.

Protections extend well beyond current workers, because former workers, contractors, suppliers and their relatives are also covered.

Key Takeaways

• Audit your whistleblower policy against ASIC Regulatory Guide 270 now, before the statutory review reports.
• Name your eligible recipients by role, then publish that list where workers can find it.
• Train the people who receive disclosures before you promote the reporting channel again.
• Add detrimental conduct and reprisal to your psychosocial risk register with named controls.
• Test in practice whether an anonymous discloser can hold a two-way conversation through your channel.
• Give the board structured reporting on volumes, timeframes, outcomes and reprisal concerns.
• Finally, monitor working conditions for at least six months after any disclosure closes.

About the Author

This comprehensive article was actively developed by the expert content team at eCompliance Central, under the highly skilled direction of Dr. Denise Meyerson. Dr. Meyerson is the successful founder, a PhD-qualified educator, and a leading learning innovation specialist boasting over 35 years of deep, practical experience in learning and development, strict compliance, and vocational education. She has consulted extensively for leading global organisations and currently remains a highly recognised authority on behaviour-based compliance training within the complex Australian context. We firmly help ambitious organisations meet their strict compliance obligations through highly customised, deeply engaging, SCORM-ready training modules. We proudly build these robust tools precisely around your specific policies, your unique people, and your actual, daily operational realities. Note: We are professional educators, absolutely not legal advisors. For specific legal advice tailored precisely to your exact situation, please consult a fully qualified legal professional.