Why Your Executives and Board Need Separate Whistleblower Training

Bundling executives and directors into one whistleblower training session may look efficient, but the two groups have different responsibilities. Executives need practical first-contact capability, while boards need governance oversight, reporting discipline and confidence that the whistleblower program is working in practice.

Key takeaways

• Executives and boards both need whistleblower training, but they need different training because their roles are different.
• Executives need practical first-contact capability: confidentiality, consent, escalation, documentation and immediate risk management.
• Boards need governance oversight: reporting quality, program effectiveness, disclosure trends and assurance that whistleblowers are protected.
• ASIC REP 827 shows regular whistleblower training is linked with higher disclosure rates and stronger program awareness.
• Low or zero whistleblower disclosures should prompt leaders to test whether the program is known, trusted and accessible.

By Darren Murphy, CEO, Core Integrity

Bundling the executive team and board into one whistleblower training session sounds tidy.

One invite. One meeting room. One neat little compliance box ticked.

But whistleblowing does not land neatly inside a policy document. It lands in real life, usually at a bad time, with incomplete information, heightened emotions, and someone senior needing to make a call before they have had their second coffee.

That is why training matters.

Source note: This article draws on ASIC Report 827, Insights from the ASIC Whistleblower Questionnaire: July 2024 to June 2025, and Core Integrity's work with whistleblower programs, eligible recipients, executives and boards. ASIC REP 827 | ASIC media release on better whistleblower practices

ASIC's findings should make leaders pause

ASIC's recent Report 827 should prompt every organisation to look closely at how well its whistleblower program is understood, trusted, and used.

ASIC found that 25% of surveyed companies did not provide regular training to staff about their whistleblower program. It also found that companies providing regular training had higher disclosure rates, even after allowing for company size.

For companies with more than 5,000 employees, those with recurring training had a median disclosure rate of 0.45, compared with 0.19 for induction-only training and 0.05 for no training.

ASIC's point is clear. When people understand the program and trust it, they are more likely to use it.

That matters because low disclosures are not always a sign that everything is humming along nicely.

ASIC found that 22% of surveyed companies reported receiving zero whistleblower disclosures during the review period. Some of those organisations may genuinely have low risk. Fair enough. But ASIC also said low or zero disclosures should prompt companies to question whether people know about the program, trust it, and have safe ways to make disclosures.

In other words, silence can be a risk signal.

Eligible recipients need more than awareness

For executives and directors, this creates a very practical problem.

They are not just staff who need a general awareness session. Under the Corporations Act whistleblower regime, directors, senior managers, auditors, actuaries, and certain other roles can be eligible recipients.

That means they may be the person a whistleblower approaches first.

Not the hotline.

Not the policy owner.

Them.

A worker might pull a senior executive aside after a meeting. Someone might email a director with a bundle of documents. A former employee might raise a concern through a personal contact because they do not trust the formal channel.

This is where good programs either hold their shape or get messy very quickly.

Executives and boards have different jobs

The first contact matters.

An executive who receives a disclosure needs to understand what to do in the moment. They need to know what they can ask, what they should not ask, how confidentiality works, where consent matters, and how to get the matter into the right channel quickly.

They also need to know enough to avoid contaminating the process or accidentally exposing the person who has spoken up.

That is operational.

Boards have a different role.

Directors need confidence that the whistleblower program is working as intended. They need to understand the governance settings, the reporting they should expect, the warning signs in the data, and the questions they should ask management when something does not look right.

For example, directors should be alert when disclosure rates are unusually low, investigation timeframes blow out, certain business units never seem to report anything, or reporting to the board is too vague, infrequent, or sanitised.

That is oversight.

Same law. Different role. Different risk.

Why combined training falls short

I am often asked whether the board and executive team can be trained together.

Of course they can.

But I do not recommend it.

When the two groups are combined, the training usually gets watered down.

The executive team needs practical guidance on handling the first conversation, triage, confidentiality, escalation, documentation, and immediate risk management.

The board needs a sharper conversation about governance, assurance, reporting, accountability, program effectiveness, and whether management has built a program that works in practice, not just on paper.

Put both groups in the same room and you usually end up with one of two problems.

The session becomes too operational for the board, or too high-level for the executives.

Neither outcome is ideal.

What role-specific training should cover

Separate sessions let you focus on the decisions each group actually needs to make.

Executives need to know how to:

• respond in the first conversation
• protect identity and confidentiality
• avoid saying or promising the wrong thing
• understand when consent is required
• escalate the matter properly
• preserve evidence and protect the integrity of the process
• avoid retaliation, victimisation, or perceived detriment

Executives need to be ready for the moment someone says, "I need to tell you something, but I do not want anyone to know it came from me."

That is not the time to start reading the policy for the first time.

Boards need to know how to:

• oversee the program
• understand what reporting they should receive
• read whistleblower data
• question low disclosure rates
• test whether the program is trusted
• assess whether investigations are timely and independent
• satisfy themselves that whistleblowers are protected from detriment

A board does not need to run the whistleblower program.

But it does need to know whether the program is credible, accessible, trusted, and working.

Mature programs are active, not passive

ASIC also found that only 42% of surveyed companies had sought feedback from employees on their whistleblower program or speak-up culture in the last year, and those that did had higher disclosure rates.

That is another clue.

Mature whistleblower programs are not passive. They are tested, explained, reviewed, discussed, challenged, and improved.

They are not mentioned once a year when someone remembers the policy exists.

The takeaway

Doing nothing is not an option.

If your executives and directors are eligible recipients, they need more than a copy of the policy and a vague sense that Legal or HR will sort it out.

They need role-specific training that prepares them for the moment the issue lands.

Because when a disclosure is mishandled at the start, everything gets harder from there.

The solution is simple.

Train them regularly.

Train them separately.

And get it right the first time.

FAQ

Why do executives and boards need separate whistleblower training?

Executives and boards need separate whistleblower training because they have different jobs when a disclosure is made. Executives need practical first-contact skills, including confidentiality, consent, escalation and documentation. Boards need to understand oversight, reporting, program effectiveness and the questions they should ask management.

What should executive whistleblower training cover?

Executive whistleblower training should cover what to do when a concern is raised directly with a senior leader. That includes how to respond in the first conversation, how to protect identity and confidentiality, when consent matters, how to escalate the report and how to avoid contaminating the process.

What should board whistleblower training cover?

Board whistleblower training should focus on governance and oversight. Directors should understand what reporting they need, how to interpret whistleblower data, what low disclosure rates may indicate, how to test whether the program is trusted and how to satisfy themselves that whistleblowers are protected from detriment.

Why is combined board and executive training risky?

Combined training can become too operational for directors or too high-level for executives. The two groups need to make different decisions, so a single session can water down the practical guidance each group needs.

What does ASIC REP 827 suggest about whistleblower training?

ASIC REP 827 suggests regular training is an important feature of a stronger whistleblower program. ASIC found that organisations providing recurring training had higher disclosure rates, and it identified low or zero disclosures as a reason to test whether people know about the program, trust it and have safe reporting pathways.

How can Core Integrity help with whistleblower training?

Core Integrity works with organisations on whistleblower programs, eligible recipient capability, board and executive training, program reviews and speak-up arrangements. The practical focus is helping leaders understand their role before a disclosure arrives, not after the process has already become difficult.