Keywords

1 Introduction

Corporate scandals are commonly the result of exposed illegal and/or unethical activities. Their proliferation, extensive publicity and the harm they create has increased the focus on compliance and compliance programmes in organizations, particularly in the corporate but also in the government and not for profit sectors. Some, like Griffith (2015, p. 2077), argue that we cannot seriously doubt “that we now live in an era of compliance”.

Compliance is defined as “the processes by which an organization seeks to ensure that employees and other constituents conform to applicable norms which can include either the requirements of laws or regulations or the internal rules of the organization” (Miller 2017, p. 3). Miller describes compliance as the processes that an organization uses to police its own conduct. Importantly, compliance is not only concerned with laws and regulations but also with organizational policies and standards that may or may not have been developed in relation to externally imposed requirements, such as corporate governance codes. Compliance has increased in prominence and influence in corporations, so much so it has been called “the new corporate governance” (Griffith 2015, p. 2075).

This chapter is not evaluating the effectiveness of compliance in promoting ethical and legal conduct by organizations and their people. It defines compliance in the broad sense, as described by Miller (2017), to include internal and external expectations of appropriate conduct, as reflected in organizational codes of ethics and other standards or behaviour expressed in internal policies, as well as organizational legal and regulatory obligations. It explores the role whistleblowing plays as a fundamental element of compliance and reports on some of the initial findings of the WhistlingWhile They Work 2Footnote 1 research project conducted across Australia and New Zealand, as reported in Brown (2018).

2 Compliance

The increased emphasis on compliance has several bases. Griffith (2015, p. 2078) perceives compliance as a new way of exercising government power “a de facto government mandate imposed upon firms by means of ex ante incentives, ex post enforcement tactics, and formal signalling efforts… through compliance, the government dictates how firms must comply, imposing specific governance structures expressly designed to change how the firm conducts its business”.

The most frequently employed elements of compliance programmes are described by Stöber et al. (2018) as consisting of codes of conduct, compliance training and whistleblowing policies and their effectiveness should be associated with reduced illegal and/or unethical activities. Treviño et al. (1999) call for employees to be at the centre of compliance programmes since they know the most about existing misconduct and they are an “organization’s first line of defence against ethical or legal problems because they are most likely to know about violations of the law or of ethical guidelines” (p. 134). It is thus necessary for compliance to “engage critically with both flows of information, through the reporting function and through training. Through the reporting function, compliance ensures that lower-level employees can safely report concerns to their managers and that information concerning potential violations is quickly related to the appropriate level in the organization” (Griffith 2015, p. 2095). Training should focus not only on how people should report suspected illegal or unethical activities but importantly how the recipients of such reports should ensure that they keep the reporter safe and also efficiently and effectively deal with the reported misconduct. Whistleblowing and its effective management plays a key role in enabling valuable information to flow through the organization so that incidents of non-compliance are identified and addressed in a timely manner. Ensuring that whistleblowers are safe and recognized for their valuable contribution sends a powerful signal to employees who have blown the whistle and others in the organization who may be aware of incidents of non-compliance that they will be heard and protected.

3 Whistleblowing

Over the last two decades, we have seen a shift in how whistleblowing is seen by organizations. “Whistleblowing as a threat to an organization’s authority, cohesiveness and public image that leads to the need to protect whistleblowers from retaliation, is slowly being replaced with a perception of whistleblowing as a means of organizational protection” (Tsahuridu 2011, p. 60). Indeed, the fact that whistleblowing policies are considered one of the three key elements of the compliance function is indicative of this shift, at least at the policy level, even if not yet fully appreciated and effectively practised in many organizations.

The most common definition of whistleblowing is that provided by Near and Miceli (1985, p. 4), which describes it as “the disclosure by organization members (former or current) of illegal, immoral or illegitimate practices under the control of their employers, to persons or organizations that may be able to affect action”. In essence, the “whistleblower attempts to exert power to change the behaviour of some members of the organization” (Near and Miceli 1995, p. 686) to address non-compliance with laws, regulations or organizational ethical standards, as reflected in the organization’s code of ethics and policies. Internal whistleblowing refers to reporting channels inside the organization (to people such as compliance officers) while external whistleblowing typically refers to reporting channels outside the organization (such as media or regulators) (Miceli et al. 2008).

While a lot of legislative attention has developed over the years on the protection of whistleblowers, in many instances it has not been effective in protecting whistleblowers or encouraging whistleblowing. This is likely a consequence of the perception of whistleblowing by management as disloyal and costly, despite research evidence that shows the benefits of whistleblowing and its appropriate management (Miceli et al. 2009). Near and Miceli (2008) find that “policy actions by lawmakers aimed at increasing the penalties for wrongdoing … and increasing sensitivity to wrongdoing may have more impact on the incidence of whistleblowing than laws aimed at reducing retaliation against whistleblowers. If executives terminate wrongdoing when informed about it, then observers of wrongdoing may be more likely to blow the whistle” (p. 278). They further speculate that a clear understanding by executives of what constitutes wrongdoing (by societal, legal or organizational standards) and the penalties they will incur if wrongdoing continues is likely to result in them being more receptive to whistleblower disclosures and more willing to terminate reported wrongdoing. Furthermore, Near and Miceli (2008) find that “initial evidence suggests that policy would be better served to focus on penalties for wrongdoing, as a way to increase reporting of organizational wrongdoing” (p. 278).

In the whistleblowing literature, the organization is commonly assumed to be the respondent to the whistleblower but the whistleblower experiences a range of responses from colleagues, superiors, whistleblowing report recipients, etc. The organizational response is unlikely to be a consistent and explicit response. Further, the different actors within the organization may respond to the whistleblower or the wrongdoing, and those responses are likely to differ in focus and content. Retaliation against the whistleblower may occur at the same time as the wrongdoing is addressed or terminated; or the whistleblower may not be harmed but the wrongdoing may be allowed to continue and not addressed.

Similar to the multiple responses that the whistleblower, the wrongdoing and those perpetrating it are likely to encounter, the responses of the whistleblower may vary too, something the literature also does not adequately address as it is generally assumed that “the individual either reports the behaviour/incident/practice or does not” (Knapp et al. 1997, p. 697).

Near and Miceli (1995, p. 681) describe effective whistleblowing as the “extent to which the questionable or wrongful practice (or omission) is terminated at least partly because of whistleblowing and within a reasonable time frame”. This definition addresses the motivations and objectives of whistleblowing. More recently, Vandekerckhove et al. (2014) include the consequences to the whistleblower in what constitutes effective whistleblowing and describe it as leading to the cessation of the wrongdoing while at the same time keeping the whistleblower safe and unharmed.

3.1 Whistleblowing and Compliance

“The assertion that whistleblowers are ‘rats’ or ‘sneaks’ has been refuted by empirical research on the psychological and sociological dimensions of whistleblowing” (Tsahuridu and Vandekerckhove 2008, p. 109). At the same time, internal whistleblowing is increasingly and more consistently seen as a critical means of identifying wrongdoing in organizations (Kaptein 2011) and a key element of compliance.

Brown and Donkin (2008) in the Whistling While They Work1 research project found that while several methods of discovery of identifying wrongdoing ranked as important “‘reporting by employees’ ranked overall as the single most important trigger for the uncovering of wrongdoing in the view of these respondents” (p. 44). Significantly, employee reporting was seen as more important than routine controls, internal audits or external investigations, confirming that “on the whole, whistleblowing is not only regular, but is recognised within organizations as highly important for uncovering organizational wrongdoing” (p. 44).

In the recently released initial findings of Whistling While They Work2 project (Brown 2018) reporting by employees was again considered the most important means for employees, managers and governance professionals to bring to light wrongdoing in, or by, organizations in the public and private sectors (Brown et al. 2018).

Often, whistleblowing expresses an act of loyalty to the organization that reflects organizational citizenship and prosocial behaviour and not disloyalty or negative deviance (Lewis 2011). However, Lewis argues that given the serious risks to the whistleblower that remain present in many organizations, employers and the courts should not impose a duty to report misconduct. Instead, organizations “should promote trust and confidence in the whistleblowing process through the provision of and adherence to codes of ethics, the negotiation and maintenance of effective whistleblowing procedures and the promotion of a general culture of openness at the workplace” (Lewis 2011, pp. 71–72).

Similarly, Vandekerckhove and Tsahuridu (2010) call for the imposition of a general duty to blow the whistle on employees to only be considered when all three of the following conditions are satisfied:

  • Ability to attribute responsibility for whistleblowing based on the capacity to identify who should know of the organizational wrongdoing.

  • Ability to offer effective protection to whistleblowers.

  • Ability to effectively prevent erroneous whistleblowing.

The mere presence of formal codes of ethics and compliance programmes is not an adequate defence against fraud and misconduct. Rather, “the more important and effective deterrent to fraud is managers who are ethical and enforce ethical standards” (Blount and Markel 2012, pp. 1045–1046).

Research consistently confirms that internal disclosures generally precede external disclosures (Jubb 1999; Vandekerckhove and Phillips 2017). In multiple prior studies, most employees who report perceived wrongdoing externally (e.g. to a government regulator or the media) also reported it to an internal complaint recipient (see reviews in Brown 2008; Miceli et al. 2008). More recently, Vandekerckhove and Phillips (2017) found that the whistleblowing process generally involves two or even three internal attempts to raise a concern before an external attempt is made, if it is made at all.

Difficulties have been expressed with what have been called bounty programmes where regulators encourage, through rewards, the disclosure of information of illegal activities to them instead of encouraging, initially at least, an internal disclosure. Ebersole (2011) in discussing the US Dodd-Frank bounty programme lists the following costs it incurs on business compliance and agency administration:

  1. 1.

    “cause a flood of poor quality tips;

  2. 2.

    encourage employees to report fraud externally rather than internally;

  3. 3.

    develop an inflexible SEC fraud enforcement strategy;

  4. 4.

    not be cost-effective; and

  5. 5.

    result in excessive and unnecessary litigation” (p. 135).

Given the rewards offered to employees who provide new information to the SEC and the substantial rewards they stand to gain if they report fraud directly to the SEC rather than internally, Ebersole (2011) argues that “external reporting undermines the effectiveness of internal corporate compliance systems, which are often responsive and effective in stemming fraud. Further, internal compliance systems can be more efficient than external reporting in avoiding delay in correcting financial misstatements and increasing the accuracy of management’s assessment of internal controls. It is also efficient for internal systems to screen tips to reduce the volume of agency tips, preserve the SEC’s limited resources, and ease the SEC’s recent difficulty managing tips” (p. 137). Ebersole also contends that the incentive to report externally also has a negative effect on organizational culture because it undermines management’s efforts to foster an ethical culture. “By undermining management’s efforts to internally handle fraud and foster an ethical culture, Dodd-Frank is concurrently harming the organizational culture. Deteriorating organizational culture has a cascading effect on internal compliance because employees are more likely to report fraud internally in organizations with an ethical culture, in which case there is less fear of retaliation. More broadly, as organizational culture affects organizational performance, Dodd-Frank is harming the bottom line” (p. 139).

3.2 Inaction and the Silent Observers

Overall, the characteristics of the whistleblower are less predictive of whistleblowing than the characteristics of the wrongdoing and the organization. Mesmer-Magnus and Viswesvaran (2005) provide a summary of some research evidence on the characteristics of the wrongdoing and their impact on the decisions to blow the whistle, which indicates that the perceived severity of the wrongdoing and its materiality, as well as convincing evidence of wrongdoing are related to the decision to blow the whistle, as is wrongdoing that is harmful to the organization and co-workers.

However, not all people who see wrongdoing, even if it is severe or material and they have convincing evidence and it is harmful to the organization or colleagues, will blow the whistle. Whistleblowing inaction rates refer to the proportion of employees who have perceived wrongdoing but appear to take no action, that is raise a concern or report it. The inaction rate is considered a key measure of the whistleblowing reporting climate by Brown and Donkin (2008). The Whistling While They Work 1 project was conducted in 2005–2007 across a wide cross section of Australian public agencies from the Commonwealth, New South Wales, Queensland and West Australian governments and examined the incidence, outcomes and management of whistleblowing (Brown and Donkin 2008). Significant differences in reporting and inaction rates across organizations were identified in that research project (Wortley et al. 2008). What seems to influence the occurrence of whistleblowing includes:

  • the employee believes that the identified wrongdoing is serious and frequent;

  • there is sufficient information or basis on which to make a report;

  • the employee believes that effective management action will follow as a result; and

  • reprisal risk.

Wortley et al. (2008, p. 78) find that “for those who do not report, lack of confidence in management action and the fear of management reaction, in circumstances in which management is involved or perhaps complicit, represent the major disincentives to reporting. When employees do go ahead and report, it is usually because these risks are less present or because the perceived seriousness outweighs the risks and the employee is willing to take their chances”. Brown and Donkin (2008) found that the average inaction rate across all organizations was 28.6%, with differences at the organizational rather than jurisdictional levels even though there existed substantial differences in the legislative whistleblowing regimes between the jurisdictions and sectors. This finding indicates the influence of the culture and whistleblowing reporting climate of the organization on the decision to act and report misconduct when it is identified, rather than the importance of regulatory regimes. It also highlights the non-compliance that goes unreported in organizations because people do not believe that management will take action to deal with the non-compliance and that it will not react harmfully towards the whistleblower.

4 How Can Whistleblowing Facilitate Compliance?

Employee reporting of actual or suspected misconduct is one of the most effective ways to identify wrongdoing and can thus play a key role in the identification of compliance risks and their management. The way many employees are still treated after they disclosed wrongdoing, and the way disclosures are managed, indicates that we still have a lot of work to do to realize the benefits of internal whistleblowing. Employees’ awareness of illegal or unethical activities is insufficient to instigate whistleblowing, as research indicates that ethical judgement is related to the intention to blow the whistle but not to actual whistleblowing (Mesmer-Magnus and Viswesvaran 2005). “It is crucial that organizations stimulate employees who suspect or observe wrongdoing not to ‘look the other way’ or ‘stick their head in the sand’” (Kaptein 2011, p. 513) but to respond in a manner that will enable the wrongdoing to be stopped. That is why the “U.S. Federal Sentencing Guidelines and Sarbanes-Oxley Act … advise organizations to create sufficient opportunity for employees to report wrongdoing internally” (p. 514).

The Ethics at Work: 2018 Survey of Employees—Europe undertaken by the Institute of Business Ethics (2018) involved 6119 interviews conducted in February 2018. It reveals that 30% of European employees have been aware of conduct by their employer or colleagues, which they thought violated either the law or their organization’s ethical standards in the last 12 months. However, only 54% of European employees aware of legal or ethical misconduct in the last year raised their concerns.

The 2018Report to the Nations is based on the results of the 2017 Global Fraud Survey, an online survey opened to 41,573 Certified Fraud Examiners (CFEs) from July 2017 to October 2017 (Association of Certified Fraud Examiners 2018). It reports that tips, internal audit and management review have been the three most common means of detecting occupational fraud every edition of the report since 2010. In the 2018 report, these three detection methods were cited in 68% of the cases. Tips represented 40% of the cases and were the most common means of detection, while internal audit represented 15% and management review 13%. Employees provided 53% of the tips to the organizations. It is noteworthy that 32% of the tips that led to fraud detection came from customers, vendors and competitors who are placed outside the organization. Additionally, 14% of the tips came from an anonymous source, demonstrating that a significant portion of those who reported fraud did not want their identities known.

Albrecht et al. (2018) explored empirically the relationship between whistleblowing and fraud prevention and detection. While controlling for multiple variables, they found that of the 4943 frauds for which they had data, 1774 or 35.9% were detected through whistleblowing, followed by internal controls, with 1057 cases or 21.4%, again supporting the role whistleblowing can play in the fight against fraud and corruption. Albrecht et al. also found that as the number of perpetrators increased so did the likelihood that whistleblowing will be the detection method. Similarly, the more anti-fraud measures an organization has the more likely that whistleblowing will be the detection method, indicating that anti-fraud measures increase awareness and responsiveness to identified fraud.

4.1 Whistling While They Work 2

The recently published initial findings of the Whistling While They Work2 project (Brown 2018) provide new insights into whistleblowing processes and experiences of 17,778 individuals in 46 organizations based in Australia and New Zealand. They shed a new and extensive light on issues and practices relating to observing and reporting of wrongdoing, as well as management responses to the wrongdoing and to the whistleblower. This research demonstrates “how any type of organization – public or private, big or small – should approach the task of making whistleblower protection ‘real’ as part of their integrity, compliance and governance systems” (p. iii).

In this research Dozo et al. (2018) report that a total of 7391 or 41.6% of respondents had observed wrongdoing. Of those 5509 respondents observed wrongdoing in their current organization and 1881 in their previous organization. However, while over two-fifths of respondents observed wrongdoing, 29.5% of them did not report the most serious wrongdoing they observed in their current organization. Of those who did not report wrongdoing, 17.2% said that they dealt with the wrongdoing or someone else reported it, while 12.3% said that they were not aware of any action being taken in relation to the wrongdoing. This finding confirms previous research on the incidence of observers of wrongdoing who do not take any action to address or report it and confirms the need for better management of whistleblowing processes and compliance systems to encourage employees to report wrongdoing.

Dozo et al. (2018) also report on the outcomes of whistleblowing in relation to changes and reforms. The most common outcomes reported were:

  • wrongdoers were disciplined;

  • mistakes, failures or bad decisions were addressed;

  • organizational policies/procedures were improved; and

  • management or other personnel changes were made.

While the least common outcomes were:

  • wrongdoers were rewarded;

  • compensation was issued to people affected;

  • apologies were issued to people affected; and

  • outcomes or lessons were officially shared across the organization.

While the important role whistleblowing can, and does, play in compliance by assisting organizations to become aware and address risks is appreciated by managers and governance professionals, whistleblowers continue to report mistreatment due to raising concerns of non-compliance. In this research, Brown et al. (2018) show that 23% of the people who reported concerns were treated badly by management or colleagues, (17% reported they were treated badly by management, 8% treated badly by colleagues, with 6% treated badly by both). Importantly, this finding reveals the frequency and extend of negative repercussions towards those who raised concerns about wrongdoing. While the existence of direct reprisals in terms of harassment and employment-related mistreatment was reported by 50% of people who reported wrongdoing, indirect negative repercussions such as stress, reduced work performance, isolation and ostracism were reported by about 80% of reporters. These indirect or “collateral” repercussions were present in almost all cases of reprisals, indicating that what is considered direct mistreatment is almost always accompanied by indirect or collateral repercussions that affect individual and organizational well-being and performance.

Overall, a minority of respondents (17.6%) felt no adverse repercussions at all after they reported wrongdoing, with most (82.4%) experiencing at least some type of negative outcome (Smith 2018). Most respondents (81.6%) experienced at least one type of informal repercussion, compared with almost one in two (48.8%) who experienced at least one type of formal repercussion. A very small number of respondents (0.8%) experienced formal repercussions but not informal ones, while (32.6%) experienced informal but not formal repercussions and half experienced both types. The data also reveal that informal repercussions are more intense, as well as more common.

The existence of formal organizational whistleblowing policies and procedures has been found to have little effect on the types of support whistleblowers receive or the extent of the negative repercussions that they face (Smith 2018). Smith explains that this finding may be understood by the fact that given the increased focus on formal whistleblowing policies, many organizations have introduced them but they have not yet operationalized and supported them adequately to affect actual practices. Or it may be that even organizations that have not developed formal policies pay more attention to the management of whistleblowing due to the increased attention it receives from governments and other external stakeholders. Either way, what is evident is that the introduction of a formal whistleblowing policy is in itself inadequate, if it is not supported and implemented in a manner that affects organizational practices and culture.

What has been found to lead to positive outcomes in the management of whistleblowing was a manager’s emotion towards the reporting, a manager’s provision of support and work level, as well as the broader organizational ethical culture (Brough 2018). Further, the findings indicate that detrimental outcomes for whistleblowers are not inevitable. When proactive management and risk assessment of detrimental actions towards the whistleblower occur, particularly as soon as a whistleblower has reported a concern rather than after problems arise, the detrimental outcomes fall by at least half (Olsen and Brown 2018).

Overall, the findings of the Whistling While They Work2 research project indicate that whistleblowing can be managed effectively so that wrongdoing can be identified and addressed in organizations in all sectors and that is happening in some organizations. What is important is for the formal policies to be supported by practices that are proactive in assessing risk and providing active and extensive support to address direct and indirect harm to whistleblowers.

5 Conclusion

Whistleblowing is a fundamental element of compliance programmes, as described earlier. “The theoretical case for the compliance-increasing effect of whistleblowing is strong: it increases the chance of getting caught by installing a peer-surveillance” (Stöber et al. 2018, p. 7). However, observing misconduct does not mean that misconduct is reported, as found in several research findings reported earlier. Many people observe non-compliance but remain inactive observers. Whistleblower protection laws were based on the assumption that people that observe wrongdoing would be more likely to report it if the law afforded them protection from retaliation (Near and Miceli 2008; Near et al. 2004). This, however, has not been the case, as survey data suggest that not only whistleblowing but retaliation increased as legal protection increased (Miceli et al. 1999; Near et al. 2004), indicating that the law on its own has not been effective in protecting whistleblowers from retaliation but also that the fear of retaliation does not necessarily deter whistleblowing. It is also an unflattering outcome for organizational compliance, which failed to effectively use one of its key defences, that of whistleblowing, and in doing so also failed to comply with laws that require organizations to protect whistleblowers from retaliation.

For whistleblowing to be an effective element of compliance, as well as ensure compliance with whistleblowing laws, it is important that people feel that they will be, and are in fact, heard, as well as protected from direct and indirect forms of retaliation and harm. We ought to remember that people who see wrongdoing do not report it primarily because they think that nothing will be done if they speak up (Near et al. 2004; Brown et al. 2008).

Laws need to focus not only on the protection of whistleblowers but they should also impose obligations on organizations and their compliance function to effectively manage whistleblowing by responding to the report and the reporter in a timely and effective manner.

The initial findings from the Whistling While They Work2 project, reported in this chapter, indicate the continuing existence of direct retaliation but also the prominence and harm that indirect retaliation or collateral repercussions have on those who blow the whistle. They also indicate that organizations irrespective of sectors or industry can and do manage whistleblowing effectively by proactively identifying risks to the whistleblower and addressing them, while at the same time responding to the report and addressing the wrongdoing.

Compliance that only focuses on the inputs of policies, codes and training is in danger of becoming what has been termed cosmetic compliance “where an entity sets up formal internal compliance controls that are largely ineffective or unenforced, and instead act as mere window dressing for the purposes of obtaining leniency in case of regulatory enforcement” (Blount and Markel 2012, p. 1046).

The existence of whistleblowing policies, codes of ethics or conduct and training will not in themselves lead to organizations that are behaving ethically and legally. What is going to make the difference is the practices.