How to Build a Whistleblower Policy Australia Businesses Can Actually Run

Quick answer: A whistleblower policy australia businesses can rely on is not a single document you download and file away. It is a build sequence. You start from a compliant template, tailor it to how your company actually works, stand up a real reporting channel, train your people, protect confidentiality in practice, and keep proper records of what comes in and what you do about it. Get the sequence right and the policy holds up. Skip a stage and you have a page, not a protection.

If you are the HR or compliance lead who has just been handed this job, this guide walks you through it in the order you would actually do it.

Why a whistleblower policy in Australia is a build, not a download

Since 1 January 2020, the Corporations Act has required public companies, large proprietary companies, and corporate trustees of APRA-regulated superannuation entities to have a compliant whistleblower policy. Those policies have to meet the standard ASIC sets out in Regulatory Guide 270 (RG 270). In plain terms, RG 270 expects the policy to explain the protections available, who can receive a disclosure, how to make one (including anonymously), how the company supports people who speak up, how disclosures get investigated, how identity is kept confidential, and how the policy is made available to staff.

A large proprietary company is one that meets at least two of three tests at year end. Consolidated revenue of $50 million or more, consolidated gross assets of $25 million or more, or 100 or more employees. Small not-for-profits and charities that are companies limited by guarantee with annual revenue under $1 million are given relief by ASIC.

Here is the practical point for a growing business. Plenty of companies adopt a policy before they cross the threshold, because a trusted way to report problems is simply good governance. Tip-offs are the leading way wrongdoing is caught. The ACFE 2024 Report to the Nations, an international study of occupational fraud across 138 countries, found tips detected 43 per cent of frauds, at least three times more than any other method, and most tips came from employees. That is the business case in one line. If people have a safe way to speak up, you find problems while they are still cheap to fix.

The scenario: a growing Australian business setting up its first policy

Picture a services company of about 90 staff across two states. Revenue is climbing, a raise is on the table, and the board has started asking governance questions it never used to. The people leader (call her the compliance lead) has been asked to put a whistleblower policy in place before the next audit. She has never built one from scratch. This is the example we will follow. It is illustrative, not a real company.

Her instinct is to search "how to write a whistleblower policy Australia", copy something that looks official, and move on. That gets her a document. It does not get her a working policy. What she needs is the sequence below.

The stage-by-stage build

Work through these in order. Each stage produces something concrete you should be able to point to when the board, an auditor, or a regulator asks.

Step	What you do	What you should hold at the end
1. Start from a compliant template	Begin with a template built to the RG 270 content requirements rather than a blank page. Check it names the protections, the eligible recipients, the anonymous option, the support and investigation process, and how confidentiality is protected.	A base policy that already covers the required content, so tailoring is editing, not inventing.
2. Tailor it to your business	Insert your real reporting contacts and roles, your investigation steps, your escalation lines, and language your staff will actually understand. Remove anything that does not match how you operate.	A policy that reflects your company, not a generic sample, and that a staff member could follow.
3. Set up a confidential or anonymous channel	Give people a genuine way to report that protects their identity, including an anonymous route. A named person, a secure form, or a managed intake tool. Make sure disclosures do not land in a shared inbox.	A live channel with defined access, so a report reaches the right people and no one else.
4. Train staff and managers	Brief all staff on what the policy covers and how to use it. Train managers separately on receiving a disclosure, what they must not do, and their confidentiality and no-detriment duties.	Completion records showing who was trained and when, for staff and for managers.
5. Protect confidentiality in practice	Limit who can see a disclosure, control how it is stored, and handle any investigation on a need-to-know basis. Confidentiality of a whistleblower's identity is a legal protection, and breaching it can carry serious consequences.	A handling process that keeps identity restricted from intake through to close, in practice and not just on paper.
6. Investigate and keep records	Assess each disclosure, investigate where warranted, close the loop with the discloser where you can, and document decisions and dates throughout.	A dated record for each matter, plus the acknowledgements and training logs that show the policy is running.

Notice what the last column adds up to. By the time you reach stage six you are not holding a document. You are holding evidence that a policy exists, that people were told about it, that a channel works, and that reports are handled properly. That evidence is the difference between having a policy and being able to prove one.

Who this protects, and who can use the channel

It helps to know who the policy is for before you brief anyone. The people who can make a protected disclosure include current and former employees, officers, contractors and suppliers, and their relatives and dependants. A disclosure qualifies when it concerns misconduct or an improper state of affairs in relation to the company, or a breach of the Corporations Act or other specified laws. Personal work-related grievances on their own generally do not qualify, and your training should make that distinction clearly so the channel is used for what it is meant for.

An eligible person who makes a qualifying disclosure has their identity kept confidential, is protected from detriment such as dismissal or harassment, and has legal immunity for making the disclosure. Causing or threatening detriment, or breaching confidentiality, can attract penalties for the company and for individuals. That is exactly why stages five and six matter as much as stage one.

Where the tooling fits

You can build all of this manually. Many teams start there. The reason a lot of growing businesses move to a platform is that the six stages above are hard to keep running by hand, especially the training records and the confidential handling.

Sentrient is an Australian-built GRC platform that covers the whole lifecycle. There is a tailorable whistleblower policy template with staff acknowledgement, legally endorsed whistleblower training written with Australian law firms, and a way to receive and manage disclosures with the confidentiality the law requires, alongside incident and breach records. It is Australian owned, data is held in Australia, support is Australian based, and it is trusted by more than 1,000 businesses across Australia and New Zealand.

Being honest about scope matters here. No software makes you compliant. What a platform does is give you a compliant policy you can tailor and run, training you can prove people completed, and a channel that protects identity, so the sequence above actually holds together. It does not replace legal advice on your specific obligations.

For the original explainer on who needs a policy and what it must include, see Sentrient's guide to whistleblower policy australia. For the regulator's own standard, ASIC sets it out in RG 270.

General information, not legal advice. Whistleblower obligations depend on your company type and circumstances. Confirm with ASIC guidance or a qualified lawyer. Correct as at September 2026.

Frequently Asked Questions

1. Do we need a whistleblower policy in Australia if we are still small?

Not necessarily as a legal requirement. The obligation applies to public companies, large proprietary companies, and corporate trustees of APRA-regulated super entities. A large proprietary company meets at least two of three tests, revenue of $50 million or more, gross assets of $25 million or more, or 100 or more employees. Many smaller businesses adopt a policy voluntarily because a trusted reporting channel catches problems early.

2. How do I write a whistleblower policy Australia regulators will accept?

Start from a template built to the RG 270 content requirements, then tailor it to your actual roles, contacts and investigation steps. The policy needs to cover the protections, who can receive a disclosure, how to make one including anonymously, how you support and investigate, how confidentiality is protected, and how the policy is made available.

3. Can someone report anonymously?

Yes. The ability to make a disclosure anonymously is part of what a compliant policy provides, and your reporting channel should support it. Anonymity does not remove your duty to protect the person's identity if it becomes known.

4. What counts as a protected disclosure?

Broadly, a disclosure about misconduct or an improper state of affairs in relation to the company, or a breach of the Corporations Act or other specified laws. Personal work-related grievances on their own generally do not qualify.

5. What happens if we breach confidentiality or someone suffers detriment?

Confidentiality of a whistleblower's identity and protection from detriment are legal protections. Causing or threatening detriment, or breaching confidentiality, can attract penalties for the company and for individuals, which is why careful handling and record-keeping matter.