In brief: At the IAFCI Symposium insider-threat panel in Sydney on 29 September 2026, Daniel was asked which single control he would put in place first. Our answer was an effective whistleblower program. Not because a reporting line prevents every incident, but because it gives people who see a problem a credible way to bring it to someone who can act.

Why people often see the threat first

Insider threats do not always begin with an alert on a screen. They may first be visible to the colleague who notices unusual access to a system, an unexplained change in a process, records being concealed or a relationship that does not make sense. Someone may see a control repeatedly bypassed, or feel pressure not to ask why an exception has become routine.

None of those observations is proof of wrongdoing. There may be a legitimate explanation. But together with context that an automated control does not have, they may be the first reason to ask a careful question. The practical problem is whether that question can travel beyond the immediate reporting line without exposing the person who raised it to avoidable risk.

The ACFE’s 2024 Report to the Nations found that tips were the most common initial detection method in the occupational fraud cases it examined, accounting for 43% of cases. That is a finding about detected fraud in the study, not a measure of all insider threats or a claim that every tip is correct. It does show why human observation needs a route into a disciplined response.

Access controls, segregation of duties, monitoring, vetting and supervision remain necessary. A reporting program does not replace them. It connects what people notice to a process that can test it and decide what, if anything, should happen next.

A policy is not a functioning program

A policy can describe who may speak up and where to send a disclosure. A hotline can receive it. Neither tells us whether a manager will recognise a concern, whether the recipient has authority to act, or whether the subject of the report will learn the reporter’s identity through careless handling.

A functioning program is a trusted system: people know how to raise concerns; identifying information is handled carefully; allegations are assessed by someone who is not compromised by the matter; an investigation can be commissioned where warranted; and findings lead to recorded decisions. It must also be usable when the concern is about someone senior. If every route leads back to that person, the channel is not credible.

ASIC’s 2025 release on Report 827 offers a useful test of the gap between having a channel and knowing whether it works. In its sample, 69% of disclosures came through a dedicated web page or hotline. Yet 22% of surveyed companies reported zero disclosures. ASIC said those companies should consider whether staff know about and trust the program, and whether there are safe, easy ways to report. Zero reports do not, by themselves, establish that nothing is wrong.

What the core elements look like in practice

Visible executive ownership. A board or executive sponsor should be accountable for the system, including what happens when a concern crosses a senior reporting line. Ownership is not the same as personally receiving every report. The people responsible need to know what information reaches them, when escalation is required and who can make an independent decision.

More than one way to speak up. A dedicated web page or hotline is useful, but people may prefer a named contact, an external channel or a way to report anonymously. Channels must be accessible to the people expected to use them. If an anonymous reporter can receive follow-up questions without identifying themselves, the organisation has a better chance of clarifying the concern before deciding on action.

Confidentiality and protection against retaliation. Limit access to identifying information, explain who may need to know and why, and record the reasons for any disclosure or escalation. Watch for detrimental treatment after a concern is raised, rather than assuming the initial confidentiality promise settles the issue. Australian whistleblower protections can apply depending on the circumstances; the ASIC guidance and findings are a starting point, and legal advisers should address obligations in a particular matter.

Independent triage. The first assessment should separate immediate preservation or safety needs from the question of whether an allegation is substantiated. Record what has been received, who may have a conflict, what evidence could be lost and who has authority to commission the next step. An untested tip should not become a finding by repetition.

Fair investigation when warranted. Define the questions before collecting material; preserve relevant records; seek responses from people affected; and test competing explanations against evidence. The investigator should be able to state both what the evidence supports and what remains uncertain. Independence matters especially when leadership or the normal decision-maker is involved.

Feedback and closure. A reporter may not be entitled to every detail of an outcome, but an acknowledgement and appropriate updates show that the concern did not disappear into a queue. Record the decision, the reasons, any corrective action and whether controls need to change. Closing the file without closing the loop weakens trust in the next report.

Metrics and testing. Look beyond the number of disclosures. Test awareness, channel usability, time to triage, conflicts identified, preservation decisions, follow-through and whether staff believe they can raise a concern safely. In ASIC’s 2025 sample, 30% did not regularly review program effectiveness, 25% did not provide regular staff training and 58% had not sought employee feedback. Those gaps are practical places to start, not a scorecard that determines whether any one company is safe.

Who does what: Legal, Governance, HR and Investigations

No single team should have to own every part of insider-threat risk. Governance or the board sets oversight and receives appropriate reporting on the operation of the program. Legal advises on applicable protections, confidentiality, privilege and decision-making obligations. HR may support welfare, workplace process and protection from adverse treatment. Investigations establishes what happened, using a scope and reporting line that can withstand scrutiny.

Those roles overlap, but they are not interchangeable. HR may be too close to a workplace allegation; Legal may advise the decision-maker without being the fact-finder; and an investigator should not decide the legal consequences of their own findings. Agree the interfaces before a difficult matter arrives, including an escalation path when one of the usual owners is implicated. Where needed, we can conduct an independent investigation for an organisation alongside its advisers.

What executives should ask now

  • Could a person raise a concern about a senior leader without the report first going to that leader or their direct report?
  • Who would preserve evidence and assess a report before relationships or assumptions shape the response?
  • Can an anonymous reporter receive a question or an update without giving up their identity?
  • When did we last test whether people know the channels, trust them and believe retaliation would be addressed?
  • Can we show how concerns become decisions, investigations where appropriate, and changes to controls?

The answer to the panel question was not “buy a hotline”. It was to build a route from observation to fair, independent action. A good program does not promise that every concern is true, or that misconduct will never occur. It gives an organisation a better chance to notice, test and respond before an unresolved concern becomes a larger failure.

If you are considering where to start, our Fraud & Insider Threat Readiness Check offers a practical way to review your current arrangements. For help assessing whether controls work in practice, see our integrity assurance work.

This article is general information, not legal advice. Obtain advice about the legal requirements and protections that apply to your circumstances.