How to Handle a Whistleblowing Report: A Practical Guide for Employers

A whistleblowing policy should give workers a clear way to report suspected wrongdoing and tell managers how to respond. Both need to understand what happens after a concern is raised.

The Advisory, Conciliation and Arbitration Service (Acas) recommends explaining how whistleblowing differs from a grievance, how concerns can be raised and how the organisation will investigate and respond (Acas, 2026a).

At a practical level, the policy should identify:

• Who receives reports, including an alternative contact when a manager is implicated.
• Who assesses concerns, appoints investigators and decides on action.
• How confidentiality and anonymous reports are handled.
• How workers are protected from retaliation and where they can obtain support.
• When workers can expect acknowledgement, updates and feedback.
• How unresolved concerns can be escalated and which external reporting routes are available (Department for Business and Trade, 2026).

These arrangements give managers a starting point. They do not replace judgement about immediate risks, conflicts of interest or the response an individual report requires.

When a concern reaches HR, the worker may already have tried to raise it elsewhere in the organisation.

Vandekerckhove and Phillips (2019) examined 868 cases from a UK whistleblower advice line. In 484 cases, the concern had been raised at least twice. As reporting progressed, people tended to seek someone more independent to hear their concerns.

The authors caution that workers whose concerns were resolved without retaliation may have had little reason to contact the advice line. The findings therefore cannot establish how often employers mishandle whistleblowing reports.

For employers, the important question is not simply whether the concern has been reported before, but what happened when it was first raised. Check who received it, what action followed and whether the problem remains unresolved.

A repeated disclosure should prompt a review of the earlier response as well as the allegation itself. Referring the worker back to the same manager without establishing what happened previously may leave the original problem unaddressed.

Not every report requires a formal investigation, but each concern needs to be assessed on its merits. When handling whistleblowing concerns, establish what is known, address immediate risks and make clear who is responsible for deciding what happens next.

An informal conversation can be a whistleblowing disclosure. It does not have to arrive through a dedicated portal or in writing. Acas gives the example of a disclosure made in a private meeting (Acas, 2026a).An informal conversation can be a whistleblowing disclosure. It does not have to arrive through a dedicated portal or in writing. Acas gives the example of a disclosure made in a private meeting (Acas, 2026a).

• Listen carefully and distinguish what the worker observed from what they were told or suspect.
• Record what is alleged to have happened, relevant dates, the people involved and any earlier reporting attempts.
• Confirm the record. Ask the worker to check that it accurately reflects what they said.
• Ask about records and witnesses. Establish what information may be available without requiring the worker to prove the allegation. Government guidance confirms that workers do not need to provide evidence for an employer to investigate (Department for Business and Trade, 2026).
• Acknowledge the report promptly. Explain who will review it, who the worker can contact and when they should expect an update. Describe the process without promising a particular outcome.
• Offer support at meetings. Allow the worker to bring a colleague or trade union representative.
• Protect the record. Keep it secure and restrict access to those who need it. Before sharing it with a line manager, check whether that manager is implicated.

Address urgent risks without waiting to decide whether the report qualifies for protection under whistleblowing law. Acas states that employers must take reported safety risks seriously and act to protect people at work (Acas, 2025).

Suppose a worker reports that a machine guard is routinely bypassed with the supervisor’s knowledge. Establish whether anyone is still exposed to danger and take appropriate safety action, including stopping unsafe work where necessary.

Making the machine safe addresses the immediate danger. The investigation still needs to establish what happened, who knew and whether earlier warnings were missed.

Check for other immediate risks:

• Could relevant records be destroyed?
• Could witnesses face pressure?
• Could a vulnerable person remain at risk?

Involve the appropriate specialists promptly. Check whether the concern also triggers safeguarding, data protection or regulatory reporting duties.

The distinction between whistleblowing and a personal grievance matters, but a complaint can contain both. Acas advises checking this with the person raising it and recognises that both procedures may be needed (Acas, 2026a).

In Great Britain, a worker must reasonably believe that their disclosure is in the public interest and that the information tends to show a type of wrongdoing listed in law. This is known as a qualifying disclosure. Examples of wrongdoing include a criminal offence, a breach of a legal obligation or danger to health and safety. To be protected, the disclosure must also meet the legal conditions for the reporting route used (Employment Rights Act 1996, Part IVA). Northern Ireland has separate legislation.

Since 6 April 2026, sexual harassment has been expressly included among the matters that can form a qualifying disclosure in Great Britain. A disclosure about sexual harassment must still meet the requirements for reasonable belief, public interest and the reporting route to be protected (Employment Rights Act 1996, section 43B).

Name the person responsible for deciding how to handle the report and confirm which decisions they are authorised to make.

Whistleblowing law does not impose a general duty to formally investigate every disclosure. Government guidance recognises that an employer may investigate, refer the matter to an appropriate authority or decide that no further action is warranted. Separate legal duties arising from the underlying issue still apply (Department for Business and Trade, 2026).

Record the chosen response and the reasons for it. Where a whistleblowing investigation is needed, check for conflicts of interest before appointing the investigator.

In the machine-guard example, the supervisor accused of allowing the practice should not investigate their own alleged conduct. A report involving senior leadership may require an uninvolved board member or an external investigator, depending on the circumstances.

Acas’s disciplinary and grievance investigation guidance recommends choosing an impartial investigator with suitable experience. Set out what they need to establish, which evidence is relevant and who receives their findings (Acas, 2026b).

Agree who will decide on action after the findings are reviewed. Keep a named contact responsible for updates to the worker and for checking progress, even when several teams are involved.

With an anonymous report, the worker does not identify themselves. With a confidential report, the recipient knows the worker’s identity but restricts access to it.

Assess an anonymous report for the information it provides and the risks it identifies. If you cannot ask follow-up questions, it may be harder to establish what happened. Anonymity alone is not a reason to dismiss the concern (GOV.UK, n.d.).

Make every effort to protect the worker’s identity and explain the limits of confidentiality. Acas notes that witness names may have to be shared in legal proceedings (Acas, 2026b). If sharing the worker’s identity becomes necessary, take appropriate advice and, where possible, tell them beforehand.

Share information only with people who need it. Consider whether names or other identifying details can be removed while allowing a fair investigation.

Preserve relevant records before they are overwritten or lost, while respecting privacy and data protection requirements. In the machine-guard example, maintenance records, defect reports and accounts from different shifts could help establish whether bypassing occurred and how managers responded.

Gather evidence that supports and challenges the allegation. Give the person whose conduct is questioned a fair opportunity to respond at the appropriate stage. Acas’s investigation guidance emphasises establishing the facts rather than trying to prove guilt (Acas, 2026b).

Keep allegations, evidence and findings separate in the record. If the evidence is inconclusive, say so. An inability to establish what happened is different from evidence that wrongdoing did not occur.

Address the risk of retaliation as soon as the report is received. Make clear that bullying, exclusion or other adverse treatment because someone has raised a concern is unacceptable.

In Great Britain, workers who make protected disclosures are protected against detriment because of those disclosures. For employees, dismissal is automatically unfair if making the protected disclosure is the reason or principal reason for dismissal (Employment Rights Act 1996, section 47B and section 103A).

Bullying, unjustified cuts in hours or refusal of training without good reason can amount to detriment when they happen because of a protected disclosure. Retaliation can come from colleagues as well as managers (Acas, 2026a).

Check for changes in duties, hours, access to training or invitations to meetings. Maintaining dignity and respect at work includes addressing pressure or intimidation from colleagues. Give the worker a contact who is independent of anyone implicated in the report so they can raise concerns about their treatment.

Take care with arrangements intended to protect the worker. Moving them to another role or shift may disadvantage them. Discuss proposed changes, record the reasons and review their effects, including after the case has closed.

Agree dates for updates and keep to them. If a decision is delayed, explain the current stage, the reason for the delay and when the worker should next hear from you.

Explain the decision, the reasons for it and what you can share about any resulting action. Other people’s confidentiality may limit the detail available, particularly about disciplinary outcomes (GOV.UK, n.d.).

Assign each corrective action to a named person and set a completion date. Keep evidence of completion and check whether the action has resolved the problem.

In the machine-guard example, issuing a revised procedure or delivering a briefing would not show that bypassing has stopped. Check that the guarding is effective and safe working arrangements are followed during normal production.

Explain any internal review route. A worker can also approach a relevant prescribed person or body, such as the regulator responsible for the issue. Internal procedures do not have to be exhausted first, but the disclosure must meet the legal conditions for that external reporting route to be protected (Acas, 2026a).

If the investigation closes before corrective action is complete, confirm who will monitor that action and report on the result.

Before closing a report, check that you can answer these questions:

• Receipt: Is there an accurate record, including earlier attempts to raise the concern?
• Risk: Have urgent risks been addressed and separate reporting duties checked?
• Responsibility: Is it clear who decided how to handle the report and why?
• Fairness: Have conflicts of interest been addressed, confidentiality protected and evidence assessed fairly?
• Protection: Have you checked for retaliation and given the worker a contact for further concerns?
• Action: Has the decision been explained, with corrective actions completed and checked or assigned to named people with deadlines?

Managers need to recognise a disclosure and know how to respond. Acas recommends using the organisation’s whistleblowing policy as the basis for manager training and discussing it regularly with staff (Acas, 2026a).

Review the policy regularly and after a case exposes unclear responsibility, failed escalation or missed updates. Name the person responsible for each change and set a completion date. Check that reporting contacts are current and that managers understand the revised arrangements (Acas, 2026a).

Human Focus’s Whistleblowing Training introduces reportable concerns, legal protections, reporting routes and what happens after a report. It is certified by the Continuing Professional Development (CPD) Certification Service.

Support that awareness with your own procedures for receiving reports, appointing investigators and agreeing corrective action. Staff need to know how to raise a concern, and managers need to know who can act on it.

In Great Britain, there is no general requirement for every employer to have a whistleblowing policy. Sector-specific rules may apply (Department for Business and Trade, 2026; Financial Conduct Authority, n.d.). Government guidance recommends having one so workers know how to raise concerns and managers know how to respond. A report can still be legally protected even if the employer has no policy.

No single statutory response deadline applies to every workplace whistleblowing report. Follow your policy, set reasonable timescales and check for sector-specific requirements or separate reporting deadlines. Explain any delays (Department for Business and Trade, 2026; Acas, 2026b).

An unsubstantiated allegation is not automatically dishonest or malicious. Legal protection depends on the statutory conditions, including reasonable belief, rather than whether wrongdoing is ultimately proved. Record what was established, what remains uncertain and why (Employment Rights Act 1996, section 43B).