When Protections Fail: Why Whistleblowers Still Fall Through the Cracks

From financial scandals to public service misconduct, Australia’s whistleblowers are central to exposing wrongdoing. Yet for every high-profile disclosure, there are countless others that never surface and despite formal legal protections, many fall through the cracks - unsupported, unheard and often left worse off for speaking up.

The fundamental problem isn't just legal frameworks, but critical gaps in systems, capability, advice and practical support across regulators and organisations.

The Silent Majority

Many potential whistleblowers never make a formal report. They fear reprisal, doubt action will be taken - or simply don't know where to go. But there's a deeper issue: fundamental confusion about what constitutes whistleblowing versus routine business complaints.

True whistleblowing relates to serious matters - fraud, corruption or misconduct - carrying potentially severe consequences such as legal action or dismissal. Too often, everyday workplace grievances are wrongly framed as whistleblowing, while in other cases, genuine wrongdoing goes unrecognised and unreported.

This confusion is intensified by natural conflict avoidance, with employees doing nothing about serious issues and allowing problems to escalate until formal whistleblowing becomes the only remaining option.

Regulator Case Study: The NACC's Jurisdictional Confusion

In its first year, Australia’s National Anti-Corruption Commission (NACC) received around 5,500 complaints, with many falling outside its jurisdiction. A stark illustration of systemic confusion, clearly demonstrating that people still don't understand which body to approach, what qualifies for protection, or how different agencies operate.

Without clear pathways and effective triage systems, whistleblowers are left in limbo, risking loss of protection by reporting to the ‘wrong’ recipient. The NACC experience reinforces the urgent need for better education, clearer support systems and more intuitive reporting pathways.

Organisational Capacity Gaps

The support gap runs deep, with smaller organisations often lacking basic infrastructure and no formal HR function or Risk and Compliance teams to handle disclosures properly. While bigger organisations may have the resources in place, some lack proper training in whistleblower engagement - gathering evidence, building trust and showing genuine empathy during traumatic disclosure processes.

Despite new workplace health and safety laws requiring organisations to actively prevent psychosocial harm, psychosocial risks are still poorly understood in many workplaces. Issues such as bad change management, inadequate role design, weak leadership skills and unethical behaviours can all create toxic cultures that make things worse for whistleblowers, presenting both a compliance risk and a human cost.

What Better Looks Like: NSW PID Act 2022

New South Wales has pioneered a comprehensive solution with the Public Interest Disclosures Act 2022. Fully replacing the 1994 law from 1 October 2023, this reform demonstrates how systematic overhaul can address multiple failure points simultaneously.

1. Expanded Coverage and Clear Categories

Under the new Act, the definition of who qualifies as a ‘public official’ has been significantly expanded and now includes agency employees, contractors, subcontractors - even volunteers providing services for agencies.

More importantly, it defines three distinct Public Interest Disclosure categories (PIDs):

• Voluntary PID – made by public officials of their own accord when they reasonably and honestly believe serious wrongdoing has occurred.
  
  
• Mandatory PID – required when public officials are legally or functionally obliged to report serious wrongdoing as part of their role.
  
  
• Witness PID – made by someone providing information during an investigation, whether related to another PID or not.

All three types now receive legal protections, although with subtle differences. Notably, mandatory and witness disclosures are not always afforded the same confidentiality guarantees as voluntary ones, an important nuance that agencies must manage with care.

2. Flexible Reporting Without Penalty

Unlike the 1994 Act, under the 2022 Act, protections no longer depend on reporting to the ‘right’ person. Disclosures can go to agency heads, disclosure officers, managers - even MPs or journalists (albeit under strict conditions) - without automatically losing protection.

Crucially, managers who receive disclosures now have a positive duty to forward them promptly to disclosure officers. This requirement creates systematic escalation and reduces the risk of the matter stalling or being mishandled at line management level.

3. Strengthened Anti-Reprisal Protections

The legal threshold for unlawful reprisals has been lowered. In the past, action had to be ‘substantially in reprisal’. Now, if speaking up was simply a ‘contributing factor’ in harmful action, it’s enough to trigger liability.

Criminal penalties have also been toughened with higher fines and the possibility of up to five years imprisonment. This recognises that reprisals are often subtle and cumulative, and that people need stronger, earlier protection.

4. Mandatory Agency Infrastructure

The new framework means agencies can’t just tick the box on whistleblower protection, they need real systems in place to properly manage public interest disclosures (PIDs). This includes:

• A comprehensive policy – covering clear procedures for receiving and handling whistleblower disclosures, who the disclosure officers are (with contact details) and how risks of reprisal will be managed.
• Proper training – for disclosure officers, managers and agency heads must receive appropriate training so they know exactly how to respond and support people who speak up.
• Reporting duties – every year, agencies must submit an annual return on all PIDs received and alert the Ombudsman immediately if serious matters arise, like investigations being shut down or reprisals being alleged.
• Contractor requirements – whistleblowing rules now apply to contractors and subcontractors too. Contracts must include PID clauses, and suppliers need to understand their rights, reporting pathways, and responsibilities, with the possibility of contracts being terminated if they don’t comply.
  
  

Together, these changes shift PID management from a reactive, policy-on-paper approach to a proactive compliance and accountability framework, making whistleblower protection part of everyday agency operations.

Closing the Support Gap Inside Organisations

Even with stronger laws in place, things can still fall apart without the organisational capability to back them up. All too often, managers avoid confrontation rather than handle sensitive disclosures properly. Signs of psychosocial harm get overlooked and support services like Employee Assistance Programs (EAPS) aren’t used adequately to provide the necessary aftercare.

Many organisations compound these problems with ineffective training – clunky e-learning on bullying and harassment - and policies that are overly long, confusing and badly communicated to staff. If policies aren’t clear, simple and accessible, whistleblowers simply won’t give confidence to speak up.

Implications for Leadership

Laws set the minimum standard, but it’s culture and systems that decide how well things really work. NSW demonstrates that clearer rules, multiple reporting options, stronger anti-reprisal protections and clear agency responsibilities can help cut confusion and risk. But unless organisations back this up with proper training, accessible reporting channels and strong mental health support, the ‘silent majority’ will remain silent - and serious wrongdoing will persist unchecked.

Real progress requires both legislative reform and organisational transformation. Protecting whistleblowers goes beyond compliance; now, it's about creating workplace cultures where speaking up is seen as a strength, not a career risk.

‍