Whistleblowing programmes Part 2

What is an "open culture"

An open culture helps to foster positivity, which can bring in clear thinking, a long-term view and innovation, but also empathy for each other, all of which can push a business forward.

“Fundamentally, culture is the behavior of management,” writes Chris Hirst for Fast Company. “Too often, people accept change needs to happen, but believe it’s someone else that needs to behave differently to make it a reality. What you do as a manager, not what you say, is what really counts. Only your actions and leading by example will bring about a change in the way your whole organisation behaves.” Again, Willis Towers Watson employee research highlights this as an area of concern with only 64% of UK employees believing that senior leaders act in a way consistent with the company’s values.

Change too often consists of one-off initiatives that are quickly forgotten or abandoned. Continual progress must be the mandate, a process of ongoing collaboration through workshops, training, social events and company-wide challenges. And the drivers of that progress must be regularly reviewed for effectiveness. Test, learn and iterate is the key.

The role of speaking up in an open culture

However, transforming an organisational culture is not a simple nor straightforward task; it requires vision, courage and urgency, as well as leadership from across all levels of the business – a cover message as part of the code of conduct from the CEO no longer cuts the mustard.

It takes focusing on action rather than words; ‘walking the talk’ and not just issuing documentation and policies. Be prepared for the long road ahead; an open culture is delivered as part of a journey and is not a one-off event.

While it may seem intangible, a bit of putting your finger in the air and asking “does this feel different”, cultural progress can be measured. Set metrics - employees and customer satisfaction scores are a good place to start - as well as a timeline, and identify key stakeholders to take the programme forward. Buy-in from all levels is essential.

Yet there is a common theme when discussing the concept of an open culture in any organisation: fear. Business leaders and employees alike fear the regulators, and think they’re “out to get them” with obscure rules. There’s a fear of being first, of leading the way and potentially losing customers. And there’s a fear that shareholders will reject any move away from a short-term focus on profit - after all, the majority of financial KPIs and reporting revolves around only the next quarter.

But it’s this very fear that shows an open culture is needed. Employees and other stakeholders are the eyes and ears of all organisations, and the value of the knowledge they hold should not be dismissed nor underestimated; those who speak up are assets to a business and should be treated as such.

Whistleblowing systems and financial services:
The FCA’s rules and views

The regulator expects FS organisations to encourage a culture of speaking up

“Blowing the whistle” is one of those evocative phrases that have passed into both regulatory and everyday terminology, but what does it mean exactly?

In the context of a workplace, whistleblowing is the term used “when a worker passes on information concerning wrongdoing”, according to the UK government guidance. That wrongdoing will typically, although not necessarily, be something they have witnessed at work.

The whistleblower must reasonably believe they are acting in the public interest - that they are not acting on a personal grievance or for personal gain - and that the activity or wrongdoing falls into one or more of the following categories:

• Criminal offences, including fraud
• Failure to comply with an obligation set out in law
• Miscarriages of justice
• Endangering someone’s health and safety
• Damage to the environment
• Covering up wrongdoing in the above categories

In order for employees to feel safe and able to blow the whistle or make a disclosure, companies must instill a culture of openness and transparency. Employees must feel able to speak up when they see wrongdoing or believe wrongdoing to be happening without the fear of losing their job or being victimised in any way.

While organisations are not generally compelled by law to have a whistleblowing policy in place, the existence of such a policy shows an employer’s commitment to listen to the concerns of workers. It helps to send a positive message that the company they work for has an open culture, wants its people to be able to speak up and most importantly the company welcomes what they have to say and will listen.

And, it’s been mandated by the FCA and PRA since 2016: organisations such as large banks, building societies and insurers must put in place internal whistleblowing arrangements that can handle all types of disclosures from all people; and this obligation relates to “reportable concerns”, which is wider than those listed above. Increasingly the expectation that firms will have such arrangements as part of a healthy culture is expanding to all FCA regulated firms.

What does the FCA say about whistleblowing?

“We have always been clear that we aren’t going to prescribe a one-size-fits-all culture for the industry. With more than 59,000 firms at last count, the population of firms we regulate is diverse, and their cultures should also be,” writes Jonathan Davidson, Executive Director of Supervision - Retail and Authorisations, in the FCA’s Driving Purposeful Cultures report.

“However, while healthy cultures can be diverse, the consensus is that they can also share some common elements. Two particular elements have come up in our conversations time and again: healthy cultures are purposeful, and they are safe.”

When the FCA says “safe”, they are talking about psychological safety - the sort of culture with a shared belief that interpersonal risk-taking is encouraged, and that the team will not embarrass, reject or punish someone for speaking up. In this sort of culture, speaking up is not just encouraged; it is our duty to say something if we witness unfairness, foul play, or something that makes us or others feel uncomfortable or unsafe in their workplace. The regulator is clear that a firm’s individual purpose is “their own responsibility”, and it is not going to prescribe what purpose or culture should be. Instead, the FCA is clear on the benefits of a culture where purpose and safety are central tenets. They are also clear that leaders at all levels need to foster an environment in which employees can not only raise concerns but also express their opinion, and crucially, are listened to when they do and so corrective and supportive action is taken.

However, it also says that having a whistleblowing policy is not enough; an open culture means publicising the avenues open to employees if they feel a need to raise concerns – in short, your whistleblowing programme needs to be effective.

Sarah Jackman, Counsel,
Dentons UK and Middle East
"A high level of staff awareness of how to access the whistleblowing policy is highly desirable. Equally, firms should aspire to equip their leaders to have the confidence to listen to their people and take action in response to what they hear."

"We can draw inspiration from some of the larger banks who have taken staff on a journey of understanding their organisation's purpose, and have empowered their people to use purpose to guide the way they do business, whatever their role. "

Would you rather hear about wrongdoing from your employees - or the regulator?

While it is not a requirement for all FCA regulated firms to have a whistlebowing programme in place, both the FCA and the PRA expect firms to have an effective risk management system along with appropriate whistleblowing arrangements as best practice and a key part of good culture. However, having a policy and effectively communicating or enforcing it are two very different things. If employees don’t feel safe to speak up - and especially if employees don’t even know how to speak up in the first place because policies are hidden or forgotten about - then it risks those employees going elsewhere to make the disclosure. This could be a professional body, or even the FCA itself; there is a list of “prescribed persons” available on the gov.uk website, and each has its own policies and procedures for handling concerns.

However, an employee may also choose to go to the media. While many may think they will lose their rights under whistleblowing laws if they do this, that is not always the case and in in most cases they feel they have no other option. And of course an action such as this leads to a lot of attention on the firm - attention that will negatively impact shareholders, business reputation, customers and employees alike.

This is why it’s beneficial for a business to have a whistleblowing programme that is effective, one which is clearly spelled out, is accessible to all its employees and other stakeholders and encourages people to speak up. Many organisations opt to outsource part of their overall programme to an independent third party as an added layer of protection for employees, and to ensure that all concerns are captured and handled in a sensitive and compliant way.

How can financial services organisations meet regulatory expectations?

The FCA's Senior Management Arrangements, Systems and Controls Sourcebook (SYSC) was created to encourage firms to vest responsibility for effective and responsible organisations and to create a common platform for organisational and system controls requirements for all firms.

In essence, to meet the expectations of the regulator, a financial services organisation should set the tone for an open culture, one where employees feel safe to speak up. And that generally means at the very least having a whistleblowing policy that is easily accessible and known by employees.

Of course, given the link to regulatory expectations, Safecall’s CEO Graham Long suggests undertaking a regular review of efficacy, looking at the following elements:

• Is the current system used?
• Can employees report anonymously, if appropriate?
• Do employees trust the programme?
• How easy is it to raise concerns if an employee has only a suspicion of wrongdoing?
• Would employees feel comfortable raising corporate governance matters when they may be reporting to those
  suspected of wrongdoing?
• Are you made aware of health and safety concerns, inappropriate behaviour, discrimination or racism?
• How often do you bring the programme to the attention of employees?
• Would it stand the test of the ‘adequate procedures’ defence under The Bribery Act 2010?
• What do you have in place to ensure that those raising concerns are supported and protected from victimisation?
• What, if any, feedback mechanism do you make available to employees?

If you haven’t reviewed your whistleblowing procedure in the last six months, now is the time to act. Your programme should include:

• An explanation of what whistleblowing is, particularly in relation to the organisation
• A clear explanation of the procedure for handling whistleblowing
• A commitment to training workers at all levels in relation to whistleblowing law and the internal policies
• A commitment to treat all disclosures consistently and fairly
• A commitment to take all reasonable steps to maintain the confidentiality of the whistleblower where it is requested (unless there is a legal requirement to break that confidentiality)
• Clarification that any so-called “gagging clauses” in settlement agreements do not prevent workers from making disclosures in the public interest
• An idea about what feedback a whistleblower might receive
• An explanation that anonymous whistleblowers will not ordinarily be able to receive feedback and any investigation on anonymous information could be limited
• Clear commitments that victimisation of or retaliation towards a whistleblower will not be tolerated within the organisation
• An idea of the time frame for handling disclosures
• Clarification that the whistleblower does not need to provide evidence for the concerns raised to be investigated – their suspicion of wrongdoing is enough
• Signposting information and advice from external bodies that might help those thinking of making a disclosure; guidance is freely available from the government, Acas and trade unions, and from third party independent whistleblowing service providers
• Confirmation that raising a concern is welcomed and valued by the organisation

Sarah Jackman, Counsel,
Dentons UK and Middle East
"Creating a whistleblowing policy is not, on its own, enough. Once it is in place the policy should be reviewed regularly to make sure it remains fit for purpose and continues to reflect the organisation's culture and purpose. The policy should
be communicated to employees with the message that employees are encouraged to raise concerns and will not be penalised for doing so.

"Awareness can be tested through pulse checks. There may be a need to adapt how an organisation engages with staff on this topic, to ensure the best fit with remote working, do business, whatever their role."