Does my small business need a whistleblower policy?

Only if you are a public company, a large proprietary company, or the corporate trustee of a registrable superannuation entity. A proprietary company is "large" only if it meets at least two of: $50 million revenue, $25 million gross assets, or 100 employees. Most small and mid-size businesses meet fewer than two and have no policy obligation.

What happens if a company that needs a policy doesn't have one?

Failing to have a whistleblower policy where required is a criminal offence, with a maximum penalty of $16,500 for an individual and $165,000 for a body corporate.

Do whistleblower protections apply if we have no policy?

Yes. The protections attach to the disclosure and the person making it, not to whether the company has a policy. Confidentiality of the discloser's identity and protection from victimisation apply regardless of your size.

Is a hotline enough on its own?

No, and a channel with nobody impartial behind it can be worse than none — you have invited disclosure and then mishandled it. What matters is who assesses reports, how quickly, and what happens in the first 24 hours.

Why not just have HR handle it?

HR is a party to most workplace matters and cannot be independent of them. In a business of forty people, genuine independence usually isn't available internally. That is the argument for an external channel, not the software.

Do You Need a Whistleblower Hotline? What Australian Law Requires

In brief: Most Australian small and mid-size businesses have no legal obligation to hold a whistleblower policy. The protections still apply to their workers the moment somebody speaks up — which is where the real exposure sits.

The short answer

If you are a public company, a large proprietary company, or the corporate trustee of a registrable superannuation entity, you have been legally required to have a whistleblower policy since 1 January 2020. Failing to have one is a criminal offence, carrying a maximum penalty of $16,500 for an individual and $165,000 for a body corporate.

If you are none of those things — and most Australian businesses are not — you are not required to have a policy at all.

That is where most commentary stops, and it is where the useful part begins.

Are you a "large proprietary company"?

The test is not what most people assume. A proprietary company is large for a financial year if it meets at least two of these three:

Consolidated revenue of $50 million or more
Consolidated gross assets of $25 million or more
100 or more employees at the end of the financial year

Two of three. A business with 140 staff, $20 million in revenue and $8 million in assets meets only one — and is not a large proprietary company. It has no policy obligation.

There is also relief for public companies limited by guarantee that are not-for-profits or charities with annual revenue under $1 million.

So if you employ twenty to two hundred people and turn over less than $50 million, the honest answer is almost certainly that the law does not require you to have a whistleblower policy.

But the protections apply to your people anyway

This is the part that catches employers out.

The whistleblower protections in the Corporations Act attach to the disclosure and the discloser — not to whether the company has a policy. An employee of a small business who makes a qualifying disclosure about misconduct is protected in the same way as an employee of a listed company.

Which means the obligations that bite are not "have a policy". They are the ones that apply the moment somebody speaks up:

Their identity is protected, and disclosing it without consent is a serious matter
They cannot be victimised for having made the disclosure
Detriment — dismissal, demotion, exclusion, or a campaign of small hostilities — carries real consequences for the business and potentially for individuals

You can be entirely exempt from the policy requirement and still be badly exposed by how you handle the first person who raises something.

The practical case has nothing to do with compliance

Set the law aside for a moment.

The largest recurring study of occupational fraud, the ACFE's Report to the Nations, is consistent on this: around 43% of frauds are detected by a tip — nearly three times any other method. External audit catches about 3%.

And the same research finds only around 24% of small organisations have a reporting hotline, against 85% of larger ones.

That is the whole argument. The most effective fraud control available to a small business is not a bigger audit. It is somewhere for people to raise concerns, and someone impartial to act on what comes in. It happens to also be the cheapest.

Detection speed is what determines cost. Fraud caught within six months costs a median of around US$40,000. Left running five years, it passes US$1.1 million. Nothing else you can buy moves that number as much.

A hotline on its own achieves very little

Here is the failure pattern worth avoiding.

A business buys a reporting line, puts a poster in the lunch room, and considers the box ticked. Then a report arrives, and nobody has decided who assesses it, what happens in the first 24 hours, who is told, or what the person who raised it is entitled to expect.

A channel with nobody impartial behind it is worse than no channel. You have invited disclosure and then mishandled it, which is precisely the conduct the protections exist to punish.

What actually needs to exist:

A way to raise something that does not route through the person it might be about
Someone independent who assesses every report within a defined timeframe
A decision about what happens next — no action, handled internally, or formal independent investigation — and a record of why
Confidentiality that is genuinely maintained, not just promised
A response to the person who raised it, so the next person believes it is worth doing

Should a small business bother?

Honest answer: it depends on what you handle and who you employ.

Worth it if you handle cash, stock or procurement; if a small number of long-tenured people hold the books, the passwords and the payments; if you have had a grievance or conduct issue recently; or if you employ enough people that you no longer personally know what happens on every shift.

Probably not worth it yet if you are under about ten people, everyone reports directly to an owner, and there is no separation between the person who approves payments and the person who makes them — because in that environment a hotline is not your control, oversight is.

The independence problem

The obstacle for most small businesses is not cost. It is that there is nobody impartial to run it.

HR is a party to most workplace matters. The owner is often the person a disclosure would be about, or close to them. Whoever else might do it reports to one of the two. That is not a criticism of anyone's integrity — it is arithmetic. In a business of forty people, genuine independence is not available internally.

That is the case for an outsourced channel: not because software is better, but because the person assessing the report needs to not manage, report to, or work alongside the people involved.

Where to start

You do not need a program. You need three things: somewhere to raise it, someone impartial to look at it, and a decision about what happens in the first 24 hours.

If you want that in place before you need it, that is what an outsourced integrity function does — a confidential channel, independent triage within one business day, and investigation capability when something warrants it.

If you would rather just understand where you stand first, a conversation costs nothing.

Figures: ACFE, Report to the Nations 2026 (global data, reported in USD).

This article is general information, not legal advice. Integrity Solve is not a law firm. Thresholds and penalties under the Corporations Act change; confirm the current position and obtain advice on your own circumstances before acting.

Do You Need a Whistleblower Hotline? What Australian Law Actually Requires