Whistleblowing investigations ‘a two-stage process’ for FS firms

Does your whistleblowing policy provide for the fair treatment of those being accused? Are the senior managers who are responsible for investigating and dealing with concerns adequately trained? Those are questions we put to Ben Brown last week in light of the sharp rise in whistleblower cases we have seen during the pandemic and, in particular, concerns raised not by employees within the firm but by members of the public. The point Ben made is if the allegations prove to be of little merit, or the whistleblower chooses not to cooperate with the investigation for whatever reason, then it becomes challenging as far as the investigation is concerned and stressful for the individual facing the allegations who is left trusting the process, given that their job may depend on it if the outcome is they are no longer deemed to be a ‘fit and proper' person to carry out their role. It also puts the spotlight of the firm’s whistleblowing policy and systems which is something we know the regulators are taking seriously because it was just a couple of months ago when they used their supervisory powers to impose a voluntary requirements notice on two FS firms following an investigation which revealed a number of issues with its systems and controls. Clearly it’s a case of two firms being brought into line with the standards of what the regulators are expecting. But what do they require exactly? How prescriptive is the regime in this sector? To help with that I phoned someone with a lot of experience in this arena – litigator Andrew Herring:

Andrew Herring: "Yes, I mean, it's a really, really good question because different organisations will have structured their response to whistleblowing reports differently. So, not all sectors of the economy have stringent rules around whistleblowing as do financial services organisations where the FCA and the PRA both have rules in place and, interestingly, as well as those financial services companies, you also find specific rules and guidance for the likes of listed companies and US companies that are governed by the Sarbanes Oxley Act, and also public bodies where all of them have to respond appropriately to whistleblower reports. The FCA itself recommends that you have a whistleblower champion which is usually a non executive director who's sort of responsible in overall terms for managing whistleblower reports and then there is a whistleblower channel, which is an independent reporting channel, which needs to be operated and maintained so that people can make whistleblower reports into the financial services organisation. These rules apply to, for example, banks, building societies, credit unions with over £250 million pounds in assets, PRA-designated investment firms, some insurers. It doesn't apply to all financial services companies, but it's obviously recommended. In terms of how the investigation is carried out, that will be set out within the whistleblower policy itself and it may not be the whistleblower champion that is at the coalface of each and every investigation, but the investigation needs to be at least considered in all of the cases that come through, and then passed through to an appropriate investigation team which is usually a group of individuals that have the relevant specialism, the relevant experience of these investigations, and also the necessary confidentiality and independence from the type of whistleblower report that has come in and it is their responsibility then to look into the allegations, which is usually a two stage process, firstly to find out what has gone wrong and determine whether that the allegation is actually true and accurate, and then usually the second part is then who is responsible for what has gone wrong? So in that way organisations can not waste time if the allegation doesn't stand up to scrutiny and they can also manage the risk in terms of pointing the finger at other people within the organisation if in fact the initial allegation doesn't stand up to scrutiny. So that's just a quick summary of how it might operate in practice."

Joe Glavina: "There's a lot of emphasis on encouraging whistleblowers to come forward but how does the procedure protect the accused?"

Andrew Herring: "The two stage process that I've described helps mitigate the risk against the accused because the organisation firstly has to work out whether the allegation is accurate or not, just on a purely factual basis, before it then turns its attention to who might be responsible for that. Clearly you have to follow a correct process to ensure that you don't jump to any conclusions against them, you don't prejudge the situation, and you conduct a completely fair process. Where you have anonymous whistleblowers that can cause real issues for the investigation, because you may actually need to speak with the whistleblower to get to the bottom of what the allegation is about. Quite often the reports that come through whistleblower hotlines have the merest and barest details and without actually a bit more colour to them from the whistleblower it's actually very difficult to investigate. So that's always a challenge for the investigation team in these situations and they simply can't be pointing fingers at people until they've done that first stage and worked out whether what is being alleged is true or not. It can be the case that the other employees, or external people, are making allegations maliciously or, frankly, there's just an innocent explanation and people don't have the full details and something that looks bad may actually be, you know, once you have the full picture, there is a full understanding of what is there?"

Joe Glavina: "Are firms doing enough to train the investigators?"

Andrew Herring: "It's a good question. Within the regulated sector, I would expect that people are doing enough to train them because, ultimately, they are being held to account by the regulator and indeed just in January this year there was a situation with two insurance companies that have been  required by the regulator to do more on the whistleblowing front and report more regularly to the regulator to ensure that they are following the FCA's rules properly. So I wouldn't quite go so far as to call that 'special measures' but they are being held to account and I think all companies need to recognise, whether they're regulated or not, that you need to have specialised training for the managers and staff that are dealing with these situations because you have to balance the potential damage to the employer of the allegations together with the legal protection that is given to the whistleblowers, and that is a slightly different situation to other crisis situations that an organisation may face. Within the FCA rules there are actually some specific rules around the training and development to comply with whistleblowing policies. So for example, for managers, they have to be trained to recognise that there's been a disclosure of a reportable concern by whistleblower. Again, they need to understand how to protect their whistleblower's confidentiality, how to provide feedback to the whistleblower, what steps they should take to ensure the fair treatment of any person accused of wrongdoing and how to access sources of internal and external advice. So it is pretty prescriptive in terms of what the FCA is requiring its organisations to do and my sense is because of that, and the likelihood of banks, being larger organisations with means to put these policies in place, the training is likely to be pretty good, but that will not be a consistent across the whole of the across the whole of the UK economy."

We mentioned earlier the interview with Ben Brown talking about the rise in whistleblowing cases that we have seen in this sector during lockdown, especially complaints from members of the public. That programme is available for viewing now on the Outlaw website.