Would you, as a person in a position of responsibility, know what to do if you received a protected disclosure?
As a senior financial officer, an external auditor, internal auditor, chair of an audit committee or in the myriad of roles that Chartered Accountants fill, it is possible that you will be asked to act as a screener,  investigator or advisor in a case of protected disclosure. Your training and experience are likely to have given you many of the competencies necessary to act in an independent and skilled manner, which should make you a trusted professional in this area. Before you undertake such a task, however, there are several things you should ask yourself.

Do I understand the fundamental principles of protected disclosure?

The three principles of effective protected disclosure are as follows:

• Disclosures of wrongdoing in the workplace should be screened and/or investigated;
• The identity of the person disclosing should be adequately protected; and
• The discloser, if disclosing based on a reasonable belief, should not be penalised for disclosing.

If all these elements were in place, there would not be a need for detailed procedures and policies. Sadly, experience has shown that there have been failings on all three essentials, so you should be familiar with the law, policy and procedures which have proved necessary.

Am I familiar with the 2014 Act and the organisation’s policy?

Most organisations now have a policy, among its suite of governance policies, dealing with protected disclosures. This policy should derive from the board’s commitment to its culture, which should drive its strategic plan, which in turn gives rise to a business plan that is supported by its policies and procedures.

Many organisations have had precursor policies such as, a whistleblowing or speaking-up policy. The 2014 Act refers to “protected disclosures” and so that is now the common nomenclature. The Department of Public Expenditure and Reform and the Workplace Relations Commission have issued guidelines as to what should be included in protected disclosure policies for public and private entities respectively. So, the first thing you need to do is to read the Protected Disclosures Act 2014 and the organisation’s policy.

What major provisions do I need to understand?

As you read the documentation, it should become clear that the main requirements you need to appreciate are as follows:

• An entity cannot prohibit or restrict the making of protected disclosures;
  The 2014 Act applies to all workers – employees, contractors, agency workers and people on work experience schemes. It includes workers in the public and private sectors (including members of An Garda Siochána). Although volunteers are not specifically mentioned, it is recommended that they be included;
• A worker, having a reasonable belief of wrongdoing in the workplace, can make a protected disclosure to the employer. A designated recipient will normally be mentioned in the policy and there will usually be provision for reporting further up the line if the belief of wrongdoing extends to the designated recipient;
• Wrongdoing in this context means information that comes to a complainant during his or her employment about a criminal act, failure to comply with a legal obligation, miscarriage of justice, endangerment of any individual’s health and safety, the endangerment of the environment, improper use of public funds, an act of a public body that is oppressive, discriminatory or gross negligence or mismanagement, and destruction of information regarding the above;
• It is not a protected disclosure if the disclosure concerns personal complaints such as personal employment complaints or allegations of bullying or normal day-to-day operational reporting;
• The worker must provide information tending to show wrongdoing. The complaint must not be based on a suspicion without tangible foundation. However, the complainant is not expected or entitled to investigate and find proof. The complainant should frame the complaint in terms of information giving rise to reasonable belief of wrongdoing and should not seek to draw conclusions about particular individuals or specific offences;
• The principles of natural justice and fair procedure must apply to a person against whom a disclosure is made. Any disclosure made in the absence of a reasonable belief will not attract the protection of the 2014 Act and may involve a disciplinary action against the discloser. However, if there is reasonable belief, a discloser cannot normally be sued for defamation;
• The motivation of the discloser is not relevant. So, even if the discloser will benefit in some way from the disclosure of the information, it does not matter. All that matters is that there is prima facie information about wrongdoing;
• Anonymous disclosures should be investigated as far as possible, but it can be difficult in the absence of the ability to seek out further details;
• The wrongdoing does not have to have happened in the State;
• There is an obligation to protect the complainant’s identity except in circumstances where the recipient shows that all reasonable steps were taken to protect identity, the investigator believes the discloser does not object, disclosure is necessary to effect a complete investigation, or to prevent a serious risk to the State, public health, public safety and so forth; and
• The complainant must not suffer any penalty for disclosing, such as any suspension, lay-off, demotion, loss of promotion opportunity, transfer of duties, unfair treatment, harassment, etc.

What might I be asked to do?

You might be asked to do any one of four tasks.

First, you might be asked to receive a protected disclosure and conduct an initial screening. This would involve receiving the protected disclosure from the complainant, either in writing or orally. You should take careful notes where the complaint is oral only and ensure that the complainant agrees with your record. You will need to listen carefully and satisfy yourself that the complainant has a reasonable belief of wrongdoing, as defined. You may need to separate out elements of what is being said between personal complaints and protected disclosure. This screening process simply determines whether the matter is a protected disclosure or, in the case of a combination, which issues need to be investigated as a protected disclosure and which issues should be referred back to the complainant to pursue under the dignity at work or other HR policies. You should recommend the form an investigation should take – an informal approach if reasonably straightforward; a detailed and extensive investigation if the wrongdoing is of a serious nature; an external investigation if the matters are so grave; or a report to An Garda Siochána if the matters indicate a contravention of the law. You should set out the terms of reference for the investigation based on your findings of the matters to be investigated.

Second, you might be asked to conduct an investigation – for example, as a member of senior management, of the board, chair of the audit committee or an independent external professional. This will necessitate setting up a framework appropriate to the screener’s recommendations and terms of reference. It may involve an informal establishment of facts, or a more formal process to take evidence from the complainant and such other persons as can provide information concerning the matters under investigation. During the course of your investigation, you should give appropriate feedback to the complainant and you should advise him or her when you have completed your consideration, although there is no need to give a complete account or to inform the discloser of any disciplinary action to be taken.

Third, you may be asked to undertake a hearing into an allegation of penalisation by the complainant arising from, and attributable to, the protected disclosure. Since such a penalisation is specifically provided for in the 2014 Act, it is possible that the complainant may seek recourse to the courts.

And fourth, following the screening and the investigation, the complainant may seek a review of the decision to disclose his or her identity, or of the outcome of the investigation of the complaint, or of the outcome of the investigation into any penalisation complaint. This review must be conducted by a person not involved in the initial screening, investigation or decision and would entail an independent, unbiased review of the policies, procedures followed and outcomes. You may be asked to conduct this review. There is no entitlement to two reviews of the same issues.

What skills do I need to deal with a protected disclosure?

To handle a case of protected disclosure, the skills and competencies that you should have, in addition to your professional competence, include:

• Technical skills such as knowledge of procurement policy, payroll legislation, accounting principles, taxation law and so on, depending on the nature of the disclosure;
• Good emotional intelligence;
• Listening skills. Often, people who make protected disclosures have been trying for some time to be heard and feel frustrated by the way they perceive they have been treated. They are often very independent and persistent people, but may be disengaged from the organisation and feeling stressed. They need to be heard actively and respectfully;
• Clear analytical skills. This involves an ability to extract the key details from what can be a lengthy and complex narrative;
• Good personal ethical values including independence, confidentiality and trustworthiness;
• An ability to read law and regulation, and apply it to different situations;
• A deep understanding of the organisation’s essence – its culture and ‘how things are really done around here’; and
• Patience.

Who carries out the work of screening, investigation and review?

This work is currently carried out by a range of internal disclosure recipients, supported by legal and accounting professionals. Entities may be nervous of internalising the process and some favour outsourcing it, seeking to protect themselves by putting the investigations into independent, outside hands. For example, the Office of Government Procurement has a list of firms approved for such work.

However, although experience is building in the area of protected disclosure professional consultancy, it is still relatively new and many professionals are being very careful and fastidious in their work in this area as they build expertise. It can therefore be expensive, and organisations sometimes find that the amount budgeted and approved for this cost is inadequate to cover the final cost of screening, investigation and possible reviews.

Time to review?

The 2014 Act made provision for a review of the working of the legislation. The outcome of that review is due in August 2018 and it will prove interesting to see the outcome of the evaluation. In my own humble opinion, I feel that there is a risk that we have taken a very legal and/or compliance-focused approach to protected disclosures, focusing on defined events without really coming to grips with the communication, emotional and nuanced aspects that often underpin protected disclosures.

It would probably be better if entities could take as much of this protected disclosure work as possible in-house, building trust in a process that is founded on a clear culture of real openness and respect. This would require shifting the lens from protecting from harm people who speak up to rewarding people who speak up if they unearth toxic behaviour that is contrary to the organisation’s culture. The Financial Reporting Council has urged us to spend time reflecting on our culture and examining how it should be embedded into our organisations. This area of protected disclosure is one festering vesicle that provides evidence of a culture which, while it may look great on paper, is not systemically flushing through the body corporate. An open environment with a strong and deeply embedded culture of doing the right thing should lead to fewer protected disclosures if people are listened to. Where someone spots a need to speak up, the culture should be one of naming and rewarding the early identification of potential wrongdoing. This approach is profoundly to be preferred to one of engaging an overly adversarial, legalistic and compliance-focused approach after the event, hiding the complainant and cushioning him or her from an expected backlash.

It would be healthy for us, as a profession that has had some exposure to these protected disclosure cases, to share our experiences (on a no-name basis) with each other and engage with Government in reviewing the whole area. I commend such a debate and a contribution to the statutory review.

Prof. Patricia Barker FCA is Adjunct Professor of Accounting at DCU and a former member of Council at Chartered Accountants Ireland.