ESGComplete

Australia

Whistleblower protection Australia: Corporations Act policy guide

Australian whistleblower protection for the corporate sector sits in Part 9.4AAA of the Corporations Act. Since 1 January 2020, public companies, large proprietary companies and corporate trustees of registrable superannuation entities must have a whistleblower policy and make it available to officers and employees. This guide covers who is in scope, what ASIC is seeing in practice, and how to build a policy buyers will accept.

Whistleblower protection Australia: Corporations Act policy guide
Get the policy template->Who must have a policy?

Last updated

Key takeaways

  • The Corporations Act requires a whistleblower policy for public companies, large proprietary companies and corporate trustees of registrable super funds (duty in force since 1 January 2020).
  • ASIC’s RG 270 explains what the policy should cover. A thin copy-paste policy is a known enforcement and review risk.
  • In ASIC’s FY25 questionnaire (REP 827), 134 companies reported 8,095 disclosures; 22% reported receiving none.
  • Smaller entities outside the statutory net still get asked for a whistleblower policy in tenders and supplier onboarding.

Who must have a whistleblower policy in Australia?

Under the Corporations Act, the policy duty applies to public companies, large proprietary companies, and proprietary companies that are trustees of registrable superannuation entities. Those entities must have a whistleblower policy and make it available to officers and employees. Protections for eligible whistleblowers (confidentiality, victimisation rules, and related remedies) are broader than the policy-duty list alone, so check current ASIC guidance for your entity type.

"Large proprietary" follows the Corporations Act size tests (consolidated revenue, assets and employees). If you are unsure whether you tip into large proprietary status, confirm against the Act and your latest financial report before you tell a board you are out of scope.

This is practical guidance, not legal advice. ASIC publishes INFO sheets and RG 270 for the detail that belongs in board papers.

ASIC whistleblower questionnaire snapshot

Figures from ASIC’s media release for Report 827 (questionnaire covering 1 July 2024 to 30 June 2025). Use them as market context for your own speak-up program, not as targets.

Source dataASIC: Report 827 Insights from the ASIC Whistleblower Questionnaire© ASIC (see asic.gov.au copyright notice) (checked today)
Companies surveyed
134FY25 questionnaire
Disclosures reported
8,0951 Jul 2024 – 30 Jun 2025
Reported zero disclosures
22%

ASIC flags awareness and trust as common follow-ups.

Via dedicated page or hotline
69%
Average investigation time
49 days
No regular staff training
25%
No employee feedback in past year
58%
Policy duty since
1 Jan 2020

Basis: 134 surveyed companies across 18 industries

Mandatory policy vs a program that works

Having a PDF in SharePoint is the floor. ASIC’s questionnaire shows where programs still fall short.

Statutory floorStronger practice
DocumentPolicy exists and is available to officers and employeesEasy to find, plain English, matches how you actually receive reports
ChannelsEligible recipients named as the Act requiresDedicated web page or hotline; anonymous options that actually work
PeopleProtections against victimisation understood by managersRegular training and feedback on whether staff trust the program
OversightDisclosures handled confidentiallyBoard or committee visibility on volumes, themes and remediation

How to build your Australian whistleblower program

Start from the statutory content, then close the gaps ASIC keeps highlighting.

  1. 1

    Confirm you are in scope

    Check public company, large proprietary or super trustee status against the Corporations Act.

  2. 2

    Draft against RG 270

    Cover reportable conduct, eligible whistleblowers, how to report, investigation, confidentiality and protection from detriment.

  3. 3

    Stand up real channels

    Name eligible recipients, publish how to contact them, and test anonymous reporting if you offer it.

  4. 4

    Train and measure

    Train staff and managers, then review volumes and feedback at least annually.

Download the whistleblower policy template

Get the editable policy template, then adapt the Australian Corporations Act detail for your entity type.

FAQs

Who is entitled to whistleblower protection in Australia?+
Eligible whistleblowers under the Corporations Act can include officers, employees, suppliers and their employees, and relatives or dependants of those people, when they make a qualifying disclosure to an eligible recipient. Confirm the current criteria in ASIC’s INFO sheets before you train staff.
What can be reported under Australian whistleblowing rules?+
Qualifying disclosures generally concern misconduct or an improper state of affairs in relation to a regulated entity, including breaches of the Corporations Act and related laws. Personal work-related grievances are often carved out. Your policy should explain the line in plain language.
What are reasonable grounds for whistleblowers?+
The discloser needs reasonable grounds to suspect the misconduct or improper state of affairs. They do not need to prove the allegation before speaking up. Policies should say that good-faith reports are protected even if later unsubstantiated.
What are whistleblowers not protected from?+
Protection is not a free pass for unrelated misconduct. Disclosures that are not qualifying disclosures, or that are made without the required connection to an eligible recipient, may sit outside the statutory shield. False reports made maliciously can still create employment and legal issues.
Do small Australian companies need a policy?+
If you are outside the Corporations Act policy-duty list, you may not have that specific statutory obligation. Many still publish a policy because customers, lenders or group parents require one. Use the whistleblower policy template and keep the wording honest about your size.

Related guides

Whistleblower policy template->Fillable outline for any jurisdiction.Whistleblower UK->PIDA / ERA employer framing.Anti-bribery policy template->Companion governance policy.Code of conduct template->Internal conduct rules reports often sit against.

Prefer the policy done for you?

Request a tailored, ready-to-issue whistleblower policy. We review fit before any charge.

Requests for the whistleblower policy are reviewed and prepared manually, we'll follow up by email.