First Reference company logo

Inside Internal Controls

News and discussion on implementing risk management

machine cogs image

Whistleblower protection: Employers need to create a speak-up environment

There is an inherent paradox at work with respect to whistleblower protection. In the workplace, whistleblowers often have little statutory protection and must rely on their employer’s policies, a situation that can be obviously problematic if the whistle is being blown on that very employer.

whistleblower protection

Businessman blowing whistle

“Organizations must understand that the success of their whistleblower system depends upon employee trust. Protecting whistleblowers through anonymity and confidentiality is an essential element in this.”

What should you be doing to help whistleblowers?

Historically, whistleblowers in Canada and around the world have been seen in a largely negative light. They are often perceived as meddling outsiders or self-serving snitches rather than as honest, forthright individuals who are simply trying to do the right thing. As a result, they have frequently been the victims of retaliation – job loss, reputation smearing and physical threats when their names have become known. Whistleblower retaliation is depriving organizations of the invaluable information that whistleblowers can provide.

This situation is beginning to change on a global scale, with the realization that whistleblowers are a critical part of the fight against fraud, corruption and other white collar crime. In fact, whistleblower systems have been shown to be the cheapest and most effective way to detect a wide range of wrongdoing.

While Canada has a number of laws designed to encourage and protect whistleblowers, and has international obligations to implement and maintain such protections, our legislation remains fragmented and provincially diverse, trailing much of the world in terms of comprehensiveness and effectiveness. With this in mind, it’s important to take a closer look at whistleblower issues in Canada and consider what can be done to better protect these rights going forward to benefit from this precious resource.

Ireland’s whistleblower legislation, for example, represents a new standard, protecting all employees who have a “reasonable belief” that they have uncovered wrongdoing in the workplace[1]. The US, UK, Australia, Ghana, Serbia and South Korea are other countries that have put similarly potent laws in place.

These laws are critical because whistleblower retaliation stories and cases are legion. In Montreal, for example, police officers who came forward with serious allegations against senior department members were fired, with the department’s internal affairs division allegedly “making up incriminating evidence to discredit them and justify their dismissal.”[2] The lack of confidentiality and absence of a system to enable it, in this case and in many others, puts whistleblowers at risk and discourages others from coming forward in the future.

The confidentiality challenge

In many cases, there is an inherent paradox at work with respect to whistleblower protection. In the workplace, particularly in the private sector, whistleblowers often have little statutory protection and must rely on their employer’s policies, a situation that can be obviously problematic if the whistle is being blown on that very employer. That’s why confidentiality, where the details of who made a report and what they reported is very closely guarded, is so vital to proper investigation and complaint resolution.

Putting in a whistleblower hotline and telling people to call it to report any wrongdoing simply isn’t enough. If a whistleblower’s name becomes known, as poorly managed systems can easily allow, their jobs, reputations and even lives can quickly be put at risk. Indeed, statistics show that 80 percent of all whistleblowers suffer negative consequences of some kind.[3]

Steps to protecting whistleblower confidentiality

Protecting the confidentiality of the whistleblower process relies on mindset as much as it does on practice and protocol. Despite the fragmented legal background to whistleblowing in Canada, there are effective steps that organizations can take to improve whistleblower protection, including the following:

  1. Minimize the number of people “in-the-know”
  2. Withhold the fact that an investigation is based upon whistleblower information (at least as far as possible);
  3. Ensure whistleblower reports are sanitized to remove information that could identify the whistleblower, including references to the specific department from which the report originated;
  4. Ensure investigators are committed to, and the investigative process is founded on, the concept of protecting whistleblower confidentiality; and
  5. Provide advice to whistleblowers about ways in which they can help protect themselves.

From confidentiality to anonymity

It should be clear that, even with the best intentions, an expectation of confidentiality is not enough. The only concrete step that whistleblowers can take to protect themselves is to maintain their own anonymity. Only through a system designed to maximize anonymity can confidentiality be effectively preserved.

Of course, even anonymous systems aren’t 100 percent secure. In many cases, when a whistleblower makes an anonymous report, their identity may never be known. Sometimes, however, the individual’s identity may be inadvertently revealed during the investigation. For instance, if their information can be connected to a specific department or function, it may be possible to narrow down the list of people who could be the whistleblower and it is quite common for the identity of a whistleblower to become a significant focus in their organization. This was highlighted in a recent UK case in the financial services industry.[4]

Despite this, many whistleblower systems in Canada do not allow anonymous reports, including some of those mandated for public employees. It is now widely recognized that the practical impact of such policies is that potential whistleblowers who fear retaliation if they are identified will simply choose not to make a report. As a result, the effectiveness of the system is undermined and valuable information may never be delivered to management.

Sometimes disclosure is unavoidable

In addition to unintended confidentiality and anonymity gaps in the system, there are circumstances when the law or courts can insist on disclosure of a whistleblower’s identity, even when companies have said that they will make all reasonable efforts to keep identity and information confidential. Despite a company’s best intentions and established policies, sometimes there is no choice but to disclose any information they may have regarding the whistleblower.

Protecting whistleblower anonymity

Organizations should take all possible lawful steps to protect whistleblowers’ identity and maintain employee trust in the security, confidentiality and integrity of their whistleblower policies by developing a system that allows anonymous reports.

In the event that a whistleblower’s identity is known, there are still concrete steps a company can take to build whistleblower confidence, such as:

  1. Review potential individual and organizational concerns that may arise if the whistleblower’s identity is released.
  2. Ensure whistleblower policies clearly explain that, in certain situations, the company may be legally required to reveal the identity of a whistleblower. The policy should further underline that, in such circumstances, everything possible will be done to support and protect the whistleblower.
  3. Obtain appropriate legal advice when necessary.
  4. If a legal proceeding or law enforcement action requires the disclosure of a whistleblower’s identity, the company should seek to understand: the reasons for wanting the information; the process the individual will to be subjected to; and the steps that will be taken to preserve the whistleblower’s anonymity and protect them from retaliation.
  5. Alert the whistleblower that their information is being sought as part of the legal process. Work with them to provide support, assistance and advice, thereby further demonstrating the organization’s support.
  6. When possible, wait for the legal process to be fully executed before handing over the whistleblower’s identity. This not only maximizes protection for the whistleblower, but it further demonstrates the organization’s support for them and establishes a legal basis for the hand-over of the information.

Simple premise, difficult execution

The idea that whistleblower protection is a key component in the fight against corruption seems like a straightforward premise and, fortunately, it’s one that is rapidly gaining support worldwide. However, when you look at the practical side, there are a number of issues for which Canadian organizations, even those with the best intentions, need to prepare.

The whistleblowing systems guide[5], recently developed by the CSA Group, and supported by Grant Thornton LLP, can be a helpful tool in navigating this complex terrain. The guide demonstrates that by creating a “speak-up environment” through effective whistleblower reporting systems, organizations may experience better governance, stakeholder confidence and financial results.

While progress is being made in Canada in this regard, the government will need to look at some of the laws in place in other countries if it hopes to strengthen the protection afforded whistleblowers. Following the “Phoenix fiasco” — a flawed, $140-million government payroll system implementation that many argue could have been avoided with more effective whistleblower policies in place[6]. The Parliamentary review of the Public Servants Disclosure Protection Act has just been completed. Their report[7] makes strong recommendations for change to protect whistleblowers. While this is a step in the right direction, Canada still has a way to go before its legislation reaches a standard designed to truly foster the confidentiality and anonymity that a safe, “speak-up environment” requires.

In the meantime, it is incumbent on Canadian employers to take whatever steps they can to implement systems that would allow whistleblowers to step forward without fear, and speak-up without punishment.


[1] Don Butler. “Guess which country is a surprising gold standard for whistleblowers,” in The Ottawa Citizen (December 6, 2016).

[2] Paul Cherry. “It was 10 years of living hell, former SPVM whistleblower says,” in the Montreal Gazette (February 24, 2017.

[3] Public Concern at Work, 2016. “Whistleblowing: Time for Change.”

[4] Ben Martin. “How the whistleblowing scandal at Barclays unfolded.” The Telegraph (April 10, 2017).

[5] Whistleblowing systems – A guide (2016). Toronto, ON: CSA Group Canada.

[6] Julie Ireton. “Who should shoulder the blame for Phoenix fiasco?” CBC News (Sept. 21, 2016).

[7] Julie Ireton. “Report calls for revamping of whistleblower law” CBC News (June 19, 2017).

Follow me

Sandy Boucher, Senior Investigator at Grant Thornton LLP

Senior Investigator at Grant Thornton LLP
Sandy Boucher is a seasoned investigator with 35 years of experience in both the public and private sectors.Starting his career with the Royal Hong Kong Police, where he worked for 12 ½years attaining the rank of Superintendent, Sandyspecialized in Asian organized crime, narcotics and money laundering investigations.During his time with the force, Sandy received both Commissioners and Commanding Officer’s commendations for his work, as well as commendations from eight overseas police forces.He managed and conducted a broad range of high level investigations including a number which involved corruption during this period.Read more here.
Follow me

Latest posts by Sandy Boucher, Senior Investigator at Grant Thornton LLP (see all)

Send to Kindle

, , , , , , , , ,

Leave a Reply

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.