ASIC's expectations for whistleblower programs: Critical findings from its recent whistleblower survey and next steps for Australian corporates in 2026

On 4 December 2025, the Australian Securities and Investments Commission (ASIC) released Report 827 “Insights from the ASIC Whistleblower Questionnaire: July 2024 to June 2025”. The survey, involving 134 companies who received over 8,000 disclosures collectively, offers the most comprehensive insight yet into the effectiveness of corporate whistleblower frameworks since the commencement of the whistleblower reforms under the Corporations Act 2001 (Cth) in mid-2019.

ASIC has made it clear that effective whistleblower policies and practices are essential for uncovering corporate misconduct. However, the adoption of good practices and the maturity of company whistleblower programs varies significantly across corporate Australia, including across disclosure rates, the percentage of anonymous disclosures received, investigation timeframes, and substantiation rates.

For companies looking to understand where their whistleblower program sits in the scheme of corporate Australia, Report 827 offers a detailed, data-rich benchmark of current whistleblower practices. The report identifies clear shortcomings and sets out practical actions that organisations may wish to adopt throughout 2026 in order to maintain trust, tackle corporate misconduct, and establish (or maintain) a strong 'safe to speak-up' culture.

Why this matters: a potential focus for ASIC investigations

Companies that lack effective whistleblower protections may have or develop blind spots which lead to direct and significant legal, regulatory, and reputational risks which cannot be underestimated. By acting on ASIC’s recommendations, organisations will enhance their ability to detect and reduce systemic risks, develop an ethical culture, and strengthen stakeholder confidence. In an era when transparency and integrity are commercial imperatives, investing in an effective whistleblower program is a non-negotiable.

Report 827 emphasises that whistleblowing is a valuable surveillance and prevention mechanism, but also highlights that not every organisation has got it right. This may signal to ASIC a need for more targeted supervisory engagement to identify companies that lack mature whistleblowing programs.

This is particularly relevant in the context of ASIC's 2026 enforcement priorities. Along with its new priorities, ASIC has reiterated its enduring commitment to tackle systemic and persistent issues including: misconduct which damages market integrity and carries a high risk of significant consumer harm; systemic compliance failures; and new and emerging conduct risks.

The synergy between whistleblowing disclosures and ASIC's priorities is pronounced where potential misconduct is concealed within complex group structures, weak governance, and potential conflicts of interests. As a result, whistleblowing programs for sectors managing financial products, consumer credit, superannuation, insurance and other high-risk consumer areas can expect to be under the spotlight.

Critical insights from ASIC's whistleblower survey: key actions that can be implemented to improve whistleblower programs

ASIC's Report 827 provides organisations a clear opportunity to benchmark their performance against other companies, and key actions that can be implemented to assist with improving whistleblower programs.

Whistleblower disclosures rates – establish a dedicated web page or hotline for reporting

• The median disclosure rate for Australian companies surveyed was significantly below global benchmarks with just 13 companies (10% of those surveyed) accounting for ~74% of all whistleblower disclosures received.

• Where organisations have low disclosures rates, it is important to interrogate why this is the case. For example, is this due to a culture of compliance or a fear of speaking up.

• Potential action: establish a dedicated web page or hotline for reporting. ASIC identified that disclosures received through these channels accounted for 69% of all reports, yet 36% of companies did not provide a dedicated web page and 20% did not have a hotline.

Investigations and outcomes – ensure there is the right balance between speed and thoroughness

• Only 39% of whistleblower reports were assessed as 'in scope' for statutory protection, the average time to complete an investigation was 49 days and, once investigated, just 24% of allegations were substantiated.

• Potential action: review if the program has appropriate parameters around what is in scope and out of scope and strikes an appropriate balance between speed and thoroughness when investigating matters.

Information and training – ensure training is provided regularly

• Training frequency is a decisive factor in the success of a whistleblower program. Even where there are exceptional policies, programs can be let down by a lack of communication of, and training in those policies.

• In companies with more than 5,000 employees, those that trained staff both at induction and annually achieved a significantly higher disclosure rate than those where no training occurred.

• Potential action: ensure training is provided at induction and refresher training is provided periodically, particularly for eligible recipients on disclosures and others with responsibilities in the whistleblower program.

Review and assess performance – incorporate regular and systemic evaluations of policies and programs

• Policies must be accessible and living documents. Periodic reviews of whistleblower programs for compliance and best practice are required.

• Although 74% of companies review their whistleblower policy at least every two years, 30% acknowledged that they have never evaluated whether the program is actually performing well.

• Only 42% of participants sought staff feedback on the speak-up culture in the past year, but those that did enjoyed disclosure rates more than double their peers.

• Potential action: incorporate regular, systematic evaluations of both whistleblower policies and the program's operational performance, including via staff feedback mechanisms.

Governance, oversight and accountability – ensure clear functional ownership

• 81% of companies have adopted a formal schedule for reporting to senior management or a board committee with disclosure numbers and issue types commonly reported.

• Potential action: ensure clear functional ownership and adequate resourcing of the whistleblower program, and mandate insightful reporting that equips directors to monitor culture, risk and compliance effectively.

Protect and support whistleblowers

• While the heart of all whistleblower programs should be the protection and support of whistleblowers, ASIC found the implementation of this protection inconsistent across companies.

• Potential action: appoint of a dedicated whistleblower protection officer to safeguard the interests of whistleblowers and support confidence in the program.

We have set out more detail on each of these findings below.

Whistleblower disclosures rates and insights

Despite increasing attention on whistleblowing in Australia, ASIC observed that the median disclosure rate for companies surveyed was significantly below global benchmarks, noting that the data from ASIC's questionnaire was not directly comparable to the global benchmarks. One factor that impacts this comparability is the whistleblower framework under the Corporations Act, including the elements required for a disclosure to be a protected whistleblower disclosure.

The companies surveyed by ASIC reported that they had received a total of 8,095 disclosures between 1 July 2024 to 30 June 2025, with a median disclosure rate of 0.22 reports per 100 employees. However, the disclosures received varied significantly across organisations and industries. ASIC observed that just 13 companies (10% of the companies which were surveyed) accounted for nearly 74% of all whistleblower disclosures received, while 22% of the companies surveyed reported that they did not receive any whistleblower disclosures at all.

This is consistent with our experience, where we see a disparity between organisations with sophisticated whistleblower programs receiving a large volume of disclosures, while other organisations receive limited or no disclosures. In this context, ASIC acknowledged that some companies may face challenges in implementing all the practices it tested for, but that continuous improvements, adapted to the specific circumstances of each company can make a meaningful difference. It is therefore important for all organisations, irrespective of their size, to consider how they can best support a 'safe to speak up' culture and encourage disclosures.

From an industry perspective, ASIC saw companies in the mining industry with a median disclosure rate of 1.40 per 100 employees compared with just 0.12 per 100 employees in the healthcare and social assistance industry. ASIC also observed less mature practices and lower disclosure rates for unlisted companies than listed companies. Companies that sit within a category associated with lower disclosure rates should take the opportunity to consider whether they need to strengthen their whistleblowing programs.

Of the disclosures received, it was reported that only 39% of disclosures received via whistleblower channels were considered to be 'in scope' for the company's whistleblower program. This is perhaps unsurprising where the most common issues raised (some 68%) addressed workplace mistreatment, dispute or grievances (such as bullying and harassment), which is consistent with previous research in Australia that found that personal and workplace grievances were the most common type of reported wrongdoing. Around 3% of in-scope reports included concerns of alleged mistreatment of a whistleblower, and this increased to 28% for companies with at least one in-scope report. This is consistent with our experience, where we are seeing a rise in victimisation claims being raised by whistleblowers.

In practice, we observe organisations routinely facing complexity in determining the scope of their whistleblowing programs, including which disclosures should be dealt with via other grievance mechanisms. ASIC relevantly observed that while there is no 'right' percentage of in-scope disclosures, companies should have adequate processes in place to appropriately assess and filter disclosures so that proper protections can be provided to disclosures within the scope of the whistleblower regime. In any event, ASIC observed that organisations who do not receive disclosures via whistleblower channels tended to have less mature programs. Where organisations are not receiving any disclosures (or very few), it is important to interrogate why this is the case. For example, is this because there is a:

• positive workplace environment and a culture of compliance; or

• lack of awareness or trust in the program and fear of speaking up.

For companies with low whistleblower disclosures rates, one practical option to consider is the establishment of a dedicated web page or hotline for reports to be made. ASIC identified that disclosures received through these channels accounted for 69% of all reports, yet 36% of companies surveyed did not provide a dedicated web page and 20% did not have a hotline. Where both a dedicated web page and hotline was available, companies recorded markedly higher reporting rates. ASIC observed this was likely due to these channels offering greater optionality – such as anonymity and ease of reporting at any time.

Increasing disclosure rates can assist companies with identifying and exposing potentially harmful misconduct and address the issues that may otherwise have gone undetected.

Companies with lower rates of anonymous disclosures were found to have higher median disclosure rates, signalling a safe to speak up culture. In this context, while anonymous disclosures are still common, we are anecdotally seeing a greater number of whistleblowers being prepared to be identified. This is assisting with more robust and targeted investigations into their complaints and is perhaps indicative of a shifting culture in Australia around speaking up.

Investigations and outcomes of whistleblower disclosures

Report 827 also provided a number of insights on how companies respond to and investigate whistleblower disclosures.

As mentioned above, only 39% of whistleblower reports were assessed as 'in scope' for statutory protection, and once investigated, just 24% of those matters were substantiated. Larger companies reported substantiating a greater share of in-scope disclosures than smaller companies. On average, investigations took 49 days to complete, although time frames varied widely. 11% of companies reported investigation cycle times longer than 12 weeks, while 14% of companies completed most investigations inside three weeks. Notably, businesses that closed cases in under three weeks had the lowest substantiation rates, perhaps suggesting an inadequate depth of inquiry.

Similarly, ensuring that the right people have responsibility for investigations is significant. While human resources were the most common team with this responsibility, where legal teams led the investigation process, the substantiation of issues was markedly higher. 38% of companies were found to have outsourced at least some investigations to an external third party.

Upon concluding the investigation process, it was common for companies to take disciplinary action in response to substantiated allegations (around 42% of companies), with only 7% of companies reporting that no action was taken. However, very few referred matters to regulators or law-enforcement agencies, even though many operate in highly regulated sectors. Given this, ASIC has recommended that organisations ensure they are striking an appropriate balance between speed and thoroughness when investigating matters, and to ensure that potential breaches of law or regulatory requirements are escalated to the appropriate authorities.

Providing information and training about the whistleblower program

ASIC has consistently stated that a high performing whistleblower program will require strong communication, high-awareness and recurrent training.

ASIC identified that 75% of organisations offer recurring employee training, while 8% offered none at all. In terms of the number of reports received, training frequency proved a decisive factor. In companies with more than 5,000 employees, those that trained staff at induction and then annually achieved a median disclosure rate of 0.45 per 100 employees, compared with 0.05 per 100 employees where no training occurred. The significant difference highlights the importance of ensuring that whistleblower training remains on the agenda.

In our experience, regular training is particularly important for eligible recipients of whistleblower disclosures, including so they understand their obligations under the Corporations Act and company policy. Where new eligible recipients, such as directors and senior management, join an organisation, they should be given out of cycle training as part of induction to ensure that they are up to speed. More broadly than eligible recipients, all staff should receive a regular refresh on how they can raise whistleblower disclosures, even if this forms part of annual Code of Conduct or similar training. This is important to build familiarity with the whistleblower program and encourage disclosures to be raised, including via the correct channels.

ASIC recommends that training cover topics such as how to make a disclosure, who is an eligible recipient, what types of wrongdoing staff can report, the whistleblower protections and what wrongdoing the protections do not cover.

While training is significant, companies may also reinforce awareness of the whistleblower program through periodic e-mails or workplace posters. Again, companies combining digital and visual reminders saw materially higher reporting rates.

A failure to effectively communicate a company's whistleblower program or provide adequate training may let organisations down, even where they have exceptional policies in place. ASIC’s guidance in this regard is clear – policies must be accessible and living documents. This means communication and training are pivotal to a mature and high performing whistleblower program.

Reviewing and assessing performance of the whistleblower policy and program

Another element of ensuring your whistleblower policy and program is effective is to conduct periodic reviews for compliance and best practice. Although 74% of companies review their whistleblower policy at least biennially, 30% acknowledged that they have never evaluated whether the program is actually performing well. This is consistent with our experience, where we see commonly see organisations conducting policy reviews but failing to undertake broader audits of their whistleblower programs to understand whether they are operating as intended (for example, to review the management of a whistleblower disclosure from end-to-end to understand whether there were any departures from the policy and whether any improvements should be made to the policy or program).

Noting that the structure of an evaluation of an organisation's whistleblower program will vary depending on its specific needs, only 19% of companies sought to combine internal and external perspectives. Perhaps more telling in this regard is the employee voice. Only 42% of participants sought staff feedback on the speak-up culture in the past year, but those that did enjoyed disclosure rates more than double their peers. Feedback can be obtained, for example, via questions in employee surveys about employees' knowledge of the program, trust in the program and willingness to speak up or make a disclosure if they see wrongdoing.

ASIC is urging organisations to ensure that they are incorporating regular, systematic evaluations of both whistleblower policies and the program's operational performance to ensure it is operating effectively. It observed that the most common KPIs used by companies who participated in the survey included report volumes, category or type of conduct reported, investigation case outcomes, time taken to case resolution, the number of reports received via each reporting channel and the substantiation rate of matters. ASIC observed these KPIs enable companies to identify areas of improvement and ensure their programs remain effective and responsive to employee concerns.

Governance, oversight and accountability

With ASIC's view that boards have ultimate responsibility for the whistleblower policy and program, ensuring that the appropriate reporting and oversight structures are in place is critical. With 81% of companies having adopted a formal schedule for reporting to senior management or a board committee, this message appears to have been received. The most common metrics that are being presented to senior management and board committees are disclosure numbers and issue types. However, leaders in the field provide deeper analysis, including trends, benchmarking and thematic insights.

ASIC is recommending that:

• boards ensure clear functional ownership of the whistleblower program;

• companies allocate adequate resources to the team responsible for the whistleblower program; and

• the company mandates regular, insightful reporting that equips directors to monitor culture, risk and compliance effectively.

ASIC observed that the most common business areas or teams to have responsibility for the whistleblower policy were legal (32%), compliance (18%), HR (18%) and risk (12%). ASIC acknowledged that the most appropriate business owner for the whistleblower policy will vary between organisations, depending on a range of factors, though noted companies with HR as the owner tended to have lower adoption of better practices, as opposed to compliance or legal (such as offering dedicated whistleblower webpages and or allowing fully anonymous disclosures). ASIC noted that while there may be employee relations related issues that arise out of a whistleblower disclosure (particularly consequence management), there may be complex compliance, legal and integrity issues that go beyond employee relations.

In our experience, there are sophisticated programs being run by HR where legal advice is sought as appropriate, but we more commonly see Legal, Risk and Compliance having responsibility for the program.

Protecting and supporting whistleblowers

As a final observation, at the heart of the whistleblower protections under the Corporations Act is the protection and support of whistleblowers. While a written commitment to protect whistleblowers is now widespread, the implementation across companies is inconsistent.

Most firms (87%) offer counselling or employee assistance, and around two-thirds provide flexible leave or adjustments to duties. However, fewer have systematic processes to monitor and address the risk of detriment throughout an investigation. ASIC identified that companies are still receiving reports regarding this mistreatment of whistleblowers, with 28% of those surveyed reporting at least one instance of this.

An effective way that an organisation with a mature whistleblower program may support and protect whistleblowers is through the appointment of a dedicated whistleblower protection officer. While this may not be viable for all organisations, ASIC identified that only 7% of organisations have created such a role, with 79% having assigned these duties to staff with other responsibilities. This means that around 14% have no designated person to offer support or protection to a whistleblower at all.

ASIC’s key action point is to formalise protection arrangements by appointing an accountable officer, documenting support measures in the whistleblower policy, and tracking potential retaliation from first disclosure through to case closure and beyond.