A whistleblower risk assessment should stay live, because the risk does

Most organisations can point to a reporting channel and a policy. Fewer can explain how they assess risk to the whistleblower after a disclosure, and how they update that view as the case develops.

That gap matters because exposure changes as the case moves. More people become aware of the issue. The allegation touches seniority, money, or reputation. Workplace dynamics shift. A decision that looks routine on paper can feel like reprisal to the person who spoke up. If you only assess risk at intake, you end up running the rest of the case on assumptions.

Kirsten Trott, Co-founder of Veresure, puts it plainly: “I would actually recommend that employers do a risk assessment, on the risk of victimisation that whistleblowers may suffer.”

Why “one-and-done” assessment fails in real cases

A risk assessment at intake reflects what you know at that moment. Early disclosures can be incomplete, especially when the whistleblower is stressed or worried about consequences. As you follow up and gather context, the picture changes.

At the same time, the workplace reacts. Managers start making decisions. Rumours start. The subject may become defensive or start influencing the environment around the whistleblower. It becomes harder to separate ordinary workplace friction from behaviour that creates real harm.

David Morgan, Managing Director, Veremark Whistleblower Technology Solutions, calls this out directly when he talks about victimisation and reprisal, and how difficult it can be for a whistleblower to connect reprisal behaviour to what happens to them inside the workplace.

A lot of reprisal looks like normal workplace decisions, which makes it hard for whistleblowers to connect the dots.

That’s a practical reason to keep risk assessment live. You don’t want to wait for certainty before you act. You want a disciplined way to notice rising exposure and reduce it.

The factors that move victimisation risk

You don’t need a complex model. You need a consistent set of questions that force you to look at power and visibility.

Kirsten gives a clear set of contextual factors, including seniority of the subject, workplace dynamics, isolation, and vested interests.

Seniority matters because influence changes what people feel able to do. If the subject is a CEO, the power imbalance is obvious. If the subject is more junior, the exposure profile is different. Location matters too. An isolated site can make monitoring harder and social pressure stronger than head office.

This is where “trust is a system” becomes practical. Organisations get judged on how they act, not what they bought. A live risk assessment is one of the clearest ways to show duty of care through behaviour when a case becomes uncomfortable.

A practical way to run a live risk assessment

A live assessment works best as a rhythm, not a document. Keep it short and revisit it when conditions change. Here’s a simple structure.

1) Exposure profile‍

Ask how easy it is for the whistleblower’s identity to be inferred, even if the report is anonymous. Small teams, specialist roles, and detailed disclosures can narrow the field quickly.

2) Power and influence‍

Ask how much influence the subject has over the whistleblower’s day-to-day work. Look beyond reporting lines and consider informal networks.

3) Workplace conditions‍

Ask what the local environment will do to the whistleblower’s experience. Isolation, team politics, and past handling patterns all shape risk.

4) Case volatility‍

Ask how disruptive the case could become. Allegations involving senior leaders, revenue, suppliers, or public risk tend to attract pressure and attention.

5) Support plan‍

Ask what support reduces risk in this context. That usually includes a named owner, scheduled check-ins, and clear escalation routes if the whistleblower reports changes in treatment. If you adjust work arrangements, agree them with the whistleblower so they don’t feel like punishment.

This isn’t about removing all discomfort. It’s about reducing avoidable harm while you gather facts.

When to revisit the assessment

Risk usually shifts at predictable points:

• after the first follow-up with the whistleblower
• when scope changes or new allegations emerge
• when new stakeholders join the handling team
• when the subject becomes aware, or is likely to become aware
• before decisions that affect the whistleblower’s role, workload, access, or performance process
• before closure, when expectations and emotions can spike

You can keep these reviews short. What matters is consistency and clear notes on what changed and what you did next.

Where support and independence change the risk profile

David shares a useful observation from running a whistleblower programme. When a whistleblower knows you are independent, when you acknowledge their disclosure, and when you come back with updates, openness increases and the quality of information improves.

When the whistleblower knew the process was independent, and we acknowledged their disclosure and kept them updated, trust grew. They became far more open.

This is one of the clearest links between support and risk management. Better engagement usually means better detail. Better detail makes investigations more effective and reduces the chance that problems sit under the surface.

David also makes a second point by example. He describes a case involving a CEO where poor internal process and weak support slowed assessment and progression into an investigation step, with a lack of cross-collaboration adding friction. That kind of delay doesn’t just affect case outcomes. It raises exposure for the person who spoke up, especially when they had to put their name to the complaint.

A closing question worth keeping in mind

A live risk assessment won’t remove all risk. It does stop you relying on good intentions when the case becomes sensitive.

If you want one question to take away, it’s this: if someone asked later how you protected the person who spoke up, what would you point to beyond the policy.

{{wb-webinar-support-for-whistleblowers-inside-the-workplace="/components"}}

‍