The Silence After the Disclosure: Why Whistleblowing Policies Cannot Be Audited From the Outside

Almost every UK public body has a whistleblowing policy. It will usually promise confidentiality, protection from detriment and a route to raise concerns. The Public Interest Disclosure Act 1998 gives legal protection to workers who make qualifying disclosures. The policy is the organisation's public statement of how it will honour that protection in practice.

But a policy is not a record. It describes what should happen. It does not show what did. For this analysis, The Ferret reviewed published whistleblowing policies and annual reporting across a range of local authorities, NHS bodies and central government organisations. The aim was not to grade individual employers. It was to test whether an outsider can verify the promises made to staff.

In many cases, the answer is no.

What the policies promise

The language is broadly consistent. Staff are told they can raise concerns about wrongdoing, malpractice, safety or financial impropriety. They are told they will not be victimised. They are told their identity will be kept confidential where possible. They are given a list of people to contact: a line manager, a nominated officer, human resources, an audit committee, an external helpline, a regulator or a prescribed person.

The caveats are also consistent. Anonymity cannot always be guaranteed. Confidentiality may be limited by law, by the need to investigate, or by the small size of a team where details could identify the reporter. Concerns about a named individual may have to be shared with that individual during a disciplinary process. These are real operational constraints, not excuses. But they mean the promise is conditional, and the conditions are often buried in a policy document few staff will read closely.

The result is a gap between the assurance and the evidence. A policy can say that concerns will be investigated. It cannot, by itself, show that they were.

Who receives the concern

Routing matters. If the only internal route is to a line manager, a concern about that manager has nowhere to go. If the route is to a monitoring officer in a small authority, the reporter may fear being identified. If the route is to an audit committee that meets quarterly, urgency can be lost.

Many bodies provide external routes. NHS organisations have Freedom to Speak Up guardians and a national helpline. Local authorities often point staff to the monitoring officer, the external auditor or a prescribed person. Central government departments usually have a nominated officer and a whistleblowing helpline. These routes are important, but they are not always visible to the staff who need them, and they are rarely connected to published data.

A further problem is conflict. A concern may involve the very person responsible for receiving it. A policy may say that staff can go elsewhere in that situation, but the alternative route is not always clear. For a junior employee in a small team, the practical choice may be silence rather than escalation.

The reporting gap

Annual reports are where the public record should begin. Some organisations publish the number of whistleblowing concerns raised. Some break them down by category. A smaller number report how many were investigated, how many were upheld and what action followed. Many publish nothing beyond a statement that concerns are taken seriously.

Where numbers are published, they are not comparable. One body counts concerns raised. Another counts cases opened. Another counts allegations, so a single concern about several issues becomes multiple entries. Some report only concerns that reached a formal investigation. Others include informal advice. Without a common framework, a rise in numbers can mean more wrongdoing, more reporting, or simply a change in counting.

The absence of a number is not proof that concerns are ignored. It is proof that outsiders cannot tell. A public body may have a robust internal log, a supportive speak-up culture and a board that reviews trends every quarter. If none of that reaches the public record, the assurance remains internal. The public is asked to trust the process without being able to see its outputs.

What is logged, and what is not

Freedom of Information requests can sometimes extract aggregate data. A request for the number of whistleblowing concerns raised in a given year, the number investigated, the number still open, and the categories used is not usually personal data. It can be answered without identifying anyone. Yet responses vary widely. Some bodies provide a table. Some cite confidentiality. Some say the information is not held centrally.

That last answer is revealing. If a public body cannot produce a central count of concerns raised under its own policy, it cannot easily demonstrate that the policy is working. It may still be handling cases well. But it cannot show patterns, timeliness or outcomes across the organisation.

Boards and audit committees can ask for more than the public can. They can request anonymised case studies, time-to-close figures, repeat concerns and feedback from reporters. They can ask whether settlement agreements or non-disclosure agreements have been used in cases involving whistleblowers. They can ask whether staff know how to raise a concern and whether they trust the route. These are the questions that turn a policy into a management system.

Questions that should be answerable

A credible whistleblowing framework should be able to answer a short set of questions. How many concerns were raised last year? How many were anonymous? How many were investigated? How many were upheld? What was the average time to close? How many reporters said they suffered detriment? How many cases were referred to a regulator? How many were settled? When was the policy last reviewed, and what changed?

None of these questions requires the disclosure of personal data. None of them undermines a confidential process. They are the minimum evidence that a process exists beyond the document.

Public bodies are rightly expected to protect whistleblowers. They should also be expected to show that protection is real. A policy on a website is a promise. An annual report with a number, a timescale and an outcome is a form of proof. Without it, the whistleblower inbox may be monitored, the concerns may be investigated and the lessons may be learned. The public record simply gives no way of knowing.