The Employment Lifecycle through a SMCR lens: episode 3 - whistleblowing

Ian Mason: Hello everyone. I'm Ian Mason. I'm a partner in Gowling WLG. I head up the financial services and regulatory team. Welcome to this podcast on whistleblowing. This is the third podcast that we are bringing to you which members from Gowling WLG's employment and financial services regulation teams will be discussing the issues that arise from a senior management and certification regime perspective, or SMCR as we call it, at each stage in the employment cycle. So far we've covered recruitment and some of the issues arising during employment and today we're going to be moving on to look at the very topical issue of whistleblowing and to discuss this I'm joined by Simon Stephen a director in our employment labour and equalities team and Jonathan Chamberlain who's a partner in the same team.

So in our previous podcasts, we covered recruitment and also some of the issues that arise during employment such as the need for contract changes and reporting duties and we decided to cover the hot topic of whistleblowing as a separate issue and make sure that we give it the attention it deserves. So Jonathan we've read a lot about whistleblowing issues in the news and we know it's a crucial part of the regulators' overall regime and perhaps especially in the SMCR but as a starter and back to the basics, what is whistleblowing and why is it so important?

Jonathan Chamberlain: Well it is very important but telling you what it is not as straightforward as you might imagine. The FCA knows what a whistleblower is. The FCA defines a whistleblower in the handbook glossary and it says that it's 'any person who discloses or intends to disclose a reportable concern' and that includes a 'protected disclosure' but it's wider and we'll cover that later. And I mention protected disclosure because the law generally doesn't define a whistleblower. UK employment law talks about a person who makes a protected disclosure and that's the key concept rather than whistleblower as such and if you look more widely then a dictionary tells you it's simply a person who informs on another person or organisation who is involved in illegal activity. So there are lots of different concepts of whistleblower floating around but I think the best way to look on this practically is by analogy with the warning lights on a car dashboard. A whistleblower is someone raising a concern that something isn't right. Now it may be when you check the oil levels or the water level or the tyre pressures, whatever it is that the light is letting you know about it and it turns out to be ok but you've got that warning. You've got the chance to look at things what should be, you've got the chance to check and remedy it if necessary and it's just as important frankly as the warning lights on a dashboard and I think there are three reasons for that. There's firstly regulators expect regulated firms to manage it properly. It's referred to in the FCA's handbook. It's part of the tools they expect you to have and that they will check for themselves and secondly it's a key part of risk management. You want to know that there's a potential issue before it escalates and the whole point of whistleblowing is that you can't necessarily rely on the people whose primary responsibility it is to manage the relevant issue to tell you that the whistleblowing is there as a key safety system if you like and that brings me to my third point which is that this is in support of a culture where people can be open and raise issues without recrimination, sometimes referred to for example as a 'speak up culture'. Where one has a healthy culture of doing that then it has a much broader positive impact than just flagging policy breaches or wrong-doing and managing risk. It's where people are not afraid to point out that something might be done better and that has a really positive impact on such things as employee engagement, productivity, innovation, mental health, wellbeing. And that's all good but my final point is of course the one you would expect an employer to make which is get this wrong and it can be very expensive from all angles - a regulatory censure, Employment Tribunals and negative PR. And really when you asked the question 'What is a whistleblower'?  I answered that but I do wonder whether we should really be calling this whistleblowing at all because it's quite an emotive term and there's quite a lot of research into the psychology of how so called whistleblowers are dealt with. It's suggests an outsider and the organisations close ranks against them and it has negative connotations. I think developing a 'speak up culture' or a raising concern procedure or an integrity hotline and process. Moving away from that term can be I think quite useful to place emphasis on the more positive characteristics of what we're aiming for here.

Ian: Thanks very much Jonathan. You made a number of really interesting points there and clearly that highlights the importance of getting it right. As part of that and picking up what you've said about regulators, Simon perhaps you could highlight the expectations of the regulators?

Simon Stephen: Sure. So I'm going to talk about the FCA regime specifically but it's important to note that the PRA does have mirror provisions too. So when we talk about the FCA it's really talking about both. So the FCA has specific requirements which apply to UK SMCR banking firms, insurers subject to UK Insolvency II and Lloyds of London. The requirements are their non-binding guidance for other firms who can adopt these rules and practices in a way which suits them and I would always suggest that as best practice all regulated firms have something in place in line with these requirements.

It's also important to be clear that these rules are designed to work alongside the senior management and certification regime and they really have as an aim forcing cultural change where people can raise issues without retaliation or perhaps more importantly, without fear of retaliation.

So as Jonathan mentioned, the FCA handbook has a wider definition for whistleblowing and the employment context that HR practitioners will be familiar with has 'protected disclosures'. The FCA handbook covers reportable concerns which is wider as it expressly includes protected disclosures but also includes concerns relating to a breach of the firm's policies and procedures and behaviours that harm or are likely to harm the reputation or financial wellbeing of the firm. So you can see that this wider definition is very, very important to be familiar with.

So moving on then to the specific key requirements. The first I'm going to highlight is that firms must have an independent 'whistleblowing channel' and this must be in place to enable confidential and anonymous concerns to be raised. There are of course many providers of solutions to this on the market, a number of whom we actually work with and this is not just as a result of the financial services regulatory regime but also a tighter corporate governance and the impact of wider legislation like Sarbanes-Oxley and we also can't forget there is the impact of the EU directive here as well.

So the next requirement is to highlight that staff must be explicitly told and this should be in the policy really that they can speak to the FCA and/or the PRA directly. They are both prescribed persons under the protected disclosure regime and individuals can go to them without having to follow up any other process. They don't have to raise something internally before they go to the FCA or the PRA and if they do that directly then they still have protection. SMCR firms must also ensure that all the UK employees' line managers and those responsible for whistleblowing arrangements are properly trained with bespoke training designed for them and this has to include what reportable concerns are and how to make it. For managers, they need to know how to recognise it and how to protect whistleblowers both from retaliation and also in maintaining confidentiality and for those who are responsible for arrangements they need to have training as to how to assess or triage what a whistleblower says so that the appropriate action can be taken. Settlement agreement wording must also not prevent or deter people from making protected disclosures or reportable concerns. A settlement agreement must explicitly say that they are not so prevented and it must also not have any mechanisms such as warranties that may try and discourage whistleblowing in any way. And the final point to note is that firms must also have a whistleblowing champion. This is an individual who has responsibility for overall whistleblowing compliance. This must in most scenarios be a non-executive director who is also a senior manager and they will be required to prepare an annual report to the board and this report is something that does not needs to be made public but the FCA can ask for it so it's obviously in the interests to get it there and to get it done properly. The whistleblower champion also has, importantly, the responsibility to notify the regulator where a whistleblower has been found, by an Employment Tribunal to have been subject to a detriment.

So from highlighting these key requirements you can see how this is designed to embed whistleblowing into a firm's risk framework and make it an integral part of the structure. However, following on from Jonathan's points earlier, is the point made about culture which is directly linked to the FCA's stated aim in time to transform culture to encourage prioritising a psychologically safe environmental. This is, in essence, stated to be where people are willing and able to express an opinion. This is of course so much wider than having a whistleblowing framework, but in my mind it really highlights how important it is that the regulator's requirements are really only seen as the starting point for a firm's internal whistleblowing processes.

Ian: Thanks Simon. Those are clear requirements but Jonathan what specifically should firms be thinking about in relation to the SMCR and whistleblowing?

Jonathan: Well the whistleblowing regime Simon has set out isn't formally a part of the SMCR as such but it is designed to sit alongside it.

So in our previous podcast we gave an overview of the fitness and propriety regime and the conduct rules and if we go back to that - the FCA in chapter 18 explicitly links effective whistleblowing measures to fitness and propriety in that it says that if there's any evidence that a firm or a member of staff has acted to the detriment of a whistleblower then that could directly affect the firm's suitability or the fitness and propriety of a senior manager or certification employee. 

So there's a very strong protection for whistleblowers and a very strong incentive to provide an effective regime and it means that firms and staff should make sure that the requirements that Simon spoke about are robustly implemented and if there's any hint of retaliation or detriment for making a reportable concern then that is dealt with promptly and appropriately and if the relevant reporting thresholds are crossed it must be reported to the regulator and that does include disciplinary action and ensuring that regulated references are updated. This is not something that can be swept under the carpet. We often talk about a light touch approach to regulation. We should emphasise that it is not a light touch that is required here and it's important here again to remind listeners of the conduct rules and particularly those for senior managers because you can then immediately see how this fits in with those rules. Rule one remember, a senior manager must take reasonable steps to ensure that the business for which they are responsible is controlled effectively. Rule two, they must also ensure that their business complies with the relevant regulatory standards and requirements. Now put those two together and you can immediately see that this can include ensuring whistleblowing arrangements are followed and in particular, I'll come back to this point again, ensuring that those who raise concerns are not subjected to a detriment as the language of the legislation has it and so practically senior managers may want to build whistleblowing issues into regular reports to ensure that they cascade their and their firms' stance to those and their business. Townhalls, of course virtual at the time of recording this, for example are a good way of doing this and this will require liaising with HR as well as other key stakeholders such as legal and compliance but of course as we know the main thrust of the regime is that those responsible are those responsible. They can't simply divest this off to another function within the business. This is something that senior managers themselves must get hold of.

So and let's look at some of the ways this works itself out. Under SM rule 4 a senior manager must also disclose appropriately any information of which the FCA or the PRA would reasonably expect notice and this could of course include reportable concerns which are raised as whistleblowing and steps need to be in place to ensure that senior managers are aware of issues including whistleblowing so that they can comply with their obligations and in some circumstances this could be in itself a duty to blow the whistle themselves.

Finally, and this is a point I think that we will deal with in more detail in a later podcast because it's not an SMCR point as such but firms should make sure that whistleblowing issues are investigated promptly and properly and that the reporting requirements and anything that comes out of those investigations are met but investigations is a separate and a big topic so we won't be picking that up today I don't think.

Ian: Thank you Jonathan. So we've covered a lot of information there. Simon how would you pull this together for some overarching practical tips from an HR or employment perspective?

Simon: Thanks Ian. The key in my mind to getting this right is in having a framework that is embedded, not only in all aspects of the SMCR, but the firm in general. I have spoken before in these podcasts about the various pieces being a bit like a jigsaw and whistleblowing in many ways can be the corner pieces of that jigsaw. Now the reality is that most whistleblowing issues that HR deal with will either come through an HR process or will involve an element of what would be seen as an HR issue so I think it's very important that there are joined up approaches across all of HR, compliance, risk, audit etc and of course with the whistleblowing champion to ensure that each of the stakeholders has a clear understanding of the firm's approach to whistleblowing and can work together. This would mean that anything being linked to whistleblowing can be properly tracked, assessed, triaged and dealt with and this then moves onto ensuring that feedback can be given where required and that learning points and remediation steps are also put in place and it's important to note this isn't just an HR issue and it isn't just a compliance issue, it really is a matter which involves joined up co-operation and thinking.

I think there should also be clear processes and understandings across all stakeholders in order to identify when there might be some other action being taken in relation to a whistleblower. For example, you may have someone who has raised concerns previously but they are now being made redundant. HR should be aware of the fact that they have blown the whistle previously and they should be able to liaise with the appropriate internal stakeholders, perhaps a whistleblowing body or someone in compliance, to ensure that any appropriate messaging to regulators is covered.

Now I have flagged this because if somebody who has blown the whistle is being made redundant they might well raise a complaint about that and that might well be seen by a regulator. The regulator will then be very interested to understand why that person has been made redundant and does it have any link to the fact they've raised reportable concerns or blown the whistle. Of course many of our HR listeners will be well aware of the situations where people seek to use alleged whistleblowing as leverage. Perhaps it's the defence for a disciplinary issue or perhaps they're trying to leverage negotiating a settlement if they are leaving by means of redundancy. However, putting that to one side, the regulator will expect to see clear evidence of steps taken to ensure there is no detriment to that person who is known to the firm as having blown the whistle or indeed seeks to do so during that HR process.

Finally, larger firms may well have a designated whistleblowing team who will be responsible for all of this and can co-ordinate and work together but if not, there should still be a clear framework and a roadmap setting out for all staff including employees and setting out how it all works and of course as Jonathan has said the senior managers should be at the front and centre of it all.

Ian: Yes I certainly agree with the emphasis on senior management there, that's who the regulators will be looking at. So thank you both very much. That's been very informative, also I think practical but that's all we've got time for on this podcast but do keep a look out for our further podcasts in this series and in fact Jon, the next podcast in the series is going to be on wellbeing which is another very topical issue right now. So make sure you tune in for that and in the meanwhile have a good day. Thank you.