Why Australian boards should worry about a quiet reporting line

A quiet reporting line looks like a governance result. It is closer to a governance blind spot, and ASIC has started saying so directly.

In Report 827, published in December 2025, ASIC surveyed 134 Australian companies across 18 industries about their whistleblower programs. 22% received zero disclosures across a full financial year, and ASIC's guidance to them was not congratulatory. It was to go and check whether employees trust the program, whether they know it exists, and whether there is a safe and easy way to use it.

The audit sector has since shown how a zero gets made. A complaint raised at a major Australian firm in May 2024 was classified internally as an HR issue rather than as a concern about audit quality. The firm's transparency reports for 2024 and 2025 then recorded no whistleblower complaints about audit quality, which a law firm review tabled at the parliamentary inquiry found to be misleading given an active complaint existed. Nobody suppressed anything dramatic. Someone made a routing decision, and the number followed. ASIC has since extended its surveillance to audit-related complaints at all four large firms going back to July 2023, turning up 551 of them, though the regulator has been careful to say that figure does not represent 551 serious whistleblower matters.

What the rest of the numbers say

The same 134 companies logged 8,095 disclosures between them. Investigations took 49 days on average, about 24% of those investigated were substantiated, and 69% arrived through a dedicated whistleblower web page or hotline rather than an informal route.

The gaps sit underneath those figures:

• More than a third of companies had no dedicated web page for raising a concern, the channel ASIC links directly to higher disclosure rates.
• 58% had not asked employees for feedback on the program in the past year.
• 25% provided no regular training on how the program works.
• 30% do not review whether the program is effective on any regular basis.

A company can hold all four of those gaps and still report zero to its board with a straight face. Every organization is a reflection of the society around it, and society is not misconduct-free. A large employer that hears nothing in twelve months is either extraordinary or is not hearing from people who have something to say.

The feedback gap is the cheapest one to close, and it answers the question the others leave open. Run a short set of questions through HR once a year: do people know the channel exists, do they understand what happens after they use it, and do they believe someone will act. Three answers and you know whether your zero has an obvious cause. Ask before the regulator does.

The other place a zero comes from

A report that never arrives and a report that arrives and gets miscategorized both end up as the same number in the same board pack. The first failure is the one ASIC's data describes: no visible channel, no training, no idea whether anyone would act. The second happens after a reporter has already taken the risk.

An employee raises a serious concern. It gets reviewed once, is not substantiated, and is closed. The employee escalates. A second, independent review reaches a different conclusion. By the time that surfaces at a regulator's hearing, the question being asked is why the first review missed it.

Two models for handling intake both work, and the choice usually follows how the company is already structured. Central intake puts one team in front of everything: that team builds deep expertise, oversight is stronger, and a case is harder to quietly close. Decentral intake puts reports closer to the site where things happened, which is faster and better informed locally, but oversight has to be designed rather than assumed. A central team can still misclassify a report. A local office can still act fast and get it right. Which model does your organization run, and who has real oversight once a report leaves intake?

Speed is part of the same question. ASIC's 134 companies closed investigations in 49 days on average, which gives your board something concrete to measure against. A fixed acknowledgment deadline and a target for closing a case are what stop a report from sitting untouched while everyone assumes someone else picked it up.

Handing an investigation to an external law firm does not settle the oversight question either. An external reviewer answers to whoever engaged them. Without a separately governed process for what happens to their findings, external is not the same as independent.

The organizations I see handling this well tend to run a standing ethics committee that does initial triage, decides where each report goes, and stays in the loop regardless of who investigates. It does not replace external investigators when they are needed. It makes sure someone is watching the process, not only the outcome. A platform cannot supply that judgment, but it can make the job workable: on the SpeakUp platform, your committee sees timing, routing, and status on every report, including cases an external party is running on your behalf.

A channel that suits one workforce does not suit all of it

A single Australian organization might span a remote mining or agricultural site, a metro head office, and a multilingual workforce, all under one program. A worker on a regional site and a graduate in Sydney will not reach for the same channel, and neither should have to. Age, comfort with technology, location, and language all shape what feels safe to use. Offering phone, web, app, and in-person routes that all land in the same case file is what accessibility actually means.

How the intake itself feels matters as much as whether it exists. Long call trees and scripted questions that do not fit the situation turn a serious concern into an exercise in filing a complaint, and people abandon it halfway. The other common failure comes later: a report gets forwarded internally, and control over who can see it quietly disappears.

Underneath the channels, anonymity has to be technical rather than promised:

• Two-way anonymous dialogue, so your investigators can ask for more evidence without ever learning who they are talking to.
• Reports routed and stored so access is limited to the people who need it, at every stage, not only at intake.
• No single gatekeeper deciding informally what counts as serious enough to escalate.
• Systems built for anonymity from the ground up, not anonymity layered onto a standard call center.

In organizations with strong hierarchy and long tenure norms, the fear is rarely formal retaliation. It is being identified and quietly sidelined afterward. A policy saying "we protect whistleblowers" does not touch that fear. A system that makes identification technically difficult does.

From collecting reports to using them

A hotline that logs calls gives you a pile of data. It will not tell your board where the program is weak, which categories keep recurring, or whether cases are closing faster than last year.

Intake volume is the easiest number to produce and the least useful one. A better measure is how often an anonymous reporter comes back to answer a follow-up question. Across SpeakUp, 49% of reporters check back. Someone who returns is telling you they trust the channel enough to use it twice. If your rate sits well below that, your investigators are probably closing cases for lack of information rather than lack of substance.

If someone in your organization raised a serious concern tomorrow, do you know exactly where it would land, and who would decide what happens next?

See how whistleblowing software handles triage and anonymous follow-up, or book a demo to walk through your current setup.

‍

Marc van der Spek is Senior Business Development Representative at SpeakUp. He has spent 20 years in conversation with compliance teams and demonstrating the platform daily, which mostly means showing people what their program could look like when the tool is one employees want to use.