Whistleblower investigations sit at one of the most legally sensitive intersections in workplace practice. The individual making the disclosure has specific statutory protections that must be preserved throughout the investigation. The allegation itself — which may concern fraud, regulatory breach, safety failures, or other matters of public concern — must be examined independently and thoroughly. And the organisation must be able to demonstrate that neither the substance of the disclosure nor the identity of the disclosing worker influenced the investigation’s conduct or outcome.
In my experience, the investigations that most often fail to meet these requirements are those that begin with the wrong question. The organisation asks ‘is this allegation credible?’ before asking ‘what does the allegation require us to investigate?’ The first question is an assessment of the whistle-blower; the second is an assessment of the disclosure. The difference is legally significant. The Employment Rights Act 1996 does not require that a protected disclosure be accurate in order to attract protection — it requires that the worker have a reasonable belief that the disclosure tends to show one of the categories of wrongdoing specified in the Act.
This article sets out what a whistleblower investigation requires: the legal framework, the planning considerations, the evidence gathering approach, and the specific confidentiality and reporting obligations that distinguish these enquiries from other workplace investigations.
What Is Whistleblowing?
Whistleblowing, in the legal sense, means making a protected disclosure under the Employment Rights Act 1996. A protected disclosure is a qualifying disclosure — one that, in the reasonable belief of the worker, tends to show one of the specified categories of wrongdoing — made in the specified manner.
The specified categories of wrongdoing are: a criminal offence, a failure to comply with a legal obligation, a miscarriage of justice, a danger to health or safety, damage to the environment, or the deliberate concealment of information relating to any of the above. The worker does not need to be certain that wrongdoing has occurred — they need a reasonable belief that the information tends to show it has.
The protected routes for disclosure are: to the employer, to a legal adviser, to a prescribed person or body (such as the FCA, the Health and Safety Executive, or HMRC for disclosures relevant to their regulatory functions), or — in specific circumstances — to a third party including a journalist. The vast majority of whistleblower disclosures with which organisations need to deal are those made internally, to the employer or to a manager.
A worker who makes a protected disclosure is entitled under the Act not to be subjected to any detriment by their employer as a result. Dismissal of an employee for making a protected disclosure is automatically unfair, with no qualifying period of employment. These protections extend to the process of investigation itself — a worker who experiences adverse treatment because they made a disclosure, or because they raised concerns during an investigation, has a cause of action regardless of whether the underlying disclosure was accurate.
Employer Responsibilities
When a protected disclosure is made, the employer has both a substantive obligation and a protective one. The substantive obligation is to examine the substance of the disclosure — to investigate what was alleged and to establish whether it has merit. The protective obligation is to ensure that the worker who made the disclosure is not subjected to any detriment as a result.
These obligations run simultaneously and neither excuses non-compliance with the other. An investigation that thoroughly examines the substance of the disclosure but allows the disclosing worker to be marginalised, reassigned, or treated differently by colleagues or management, has failed the protective obligation. An investigation that protects the worker but does not genuinely examine the disclosure has failed the substantive one.
The practical implications are:
- The substance of the disclosure must be investigated regardless of whether the organisation believes it to be credible. The investigation’s credibility assessment comes at the end of the process, not before it begins.
- The identity of the disclosing worker must be protected to the greatest extent possible throughout the investigation. Where disclosure of their identity becomes necessary — because they are a direct witness to the conduct, or because the investigation cannot proceed without revealing who raised the concern — the worker should be informed and their consent sought where possible.
- The worker must not be subjected to any detriment during or after the investigation as a result of making the disclosure. This requires active monitoring, not just a general instruction to managers to treat the worker fairly.
- The organisation should consider whether there are interim measures that protect the worker during the investigation — temporary redeployment, adjusted reporting arrangements, or other steps that reduce the risk of informal retaliation by colleagues or managers who become aware that an investigation is underway.
Investigation Planning
The planning of a whistleblower investigation requires careful attention to three questions that do not arise in the same form in other workplace investigations: who can appropriately conduct it, what its scope should be, and how the identity of the disclosing worker will be managed.
Independence: a whistleblower investigation must be conducted by someone with no prior involvement in the alleged wrongdoing and no relationship with the individuals whose conduct is under examination. Where the disclosure concerns the conduct of a senior individual — a director, a member of the executive team, or someone with authority over the people most likely to be appointed as investigator — external investigators are effectively the only appropriate choice. An investigation whose independence can be credibly questioned has failed one of the Act’s core requirements before it has gathered a single piece of evidence.
Scope: the scope of the investigation should be defined by the substance of the disclosure, not by a preliminary assessment of its credibility. Where the disclosure raises multiple concerns — financial irregularities, health and safety failures, regulatory breaches — each should be within scope unless there is a specific, documented reason to treat one differently. An investigation that narrows its scope to avoid examining uncomfortable matters is not a compliant investigation.
Governance: the governance of the investigation — who commissioned it, who receives updates, who has authority to act on its findings — needs to be established before any active step is taken. In whistleblower cases, the governance structure should exclude any individual whose conduct may be the subject of the disclosure. Updates should be limited to individuals who can be trusted to maintain the confidentiality of both the investigation and the disclosing worker’s identity.
Evidence Gathering
Evidence gathering in a whistleblower investigation follows the same principles that apply to other workplace investigations — documentary evidence first, forensic standards for digital material, structured witness sequencing — with the additional consideration that the investigation must, from the outset, be designed to examine the substance of the disclosure rather than to assess the credibility of the person who made it.
The specific evidence priorities depend on the nature of the disclosure. Where the allegation concerns financial irregularities, the financial data analysis, transaction review, and corporate intelligence work described in our fraud investigation articles will apply. Where the allegation concerns health and safety failures, the relevant records, incident reports, and operational documentation are the primary evidence source. Where the allegation concerns a regulatory breach, the applicable regulatory framework shapes what evidence is needed and what standard it must meet.
Where the disclosing worker is themselves a witness to the conduct they have reported — as is often the case — their interview needs to be handled with particular care. They should not be placed in a position where the act of giving evidence in the investigation exposes them to further risk of detriment. Where their account will form part of the evidence presented in a disciplinary process, the implications for their identity need to be managed in advance.
Where the investigation reveals that the disclosure was made in bad faith — that the worker did not have a reasonable belief that the information tended to show wrongdoing, and raised the concern for an ulterior purpose — that finding should be reached on the evidence, documented carefully, and addressed separately from the substance of the disclosure. Bad faith does not remove the protection entirely, but it is a relevant factor in any subsequent proceedings.
Confidentiality Considerations
Confidentiality in a whistleblower investigation is both a legal obligation and a practical necessity. The legal obligation arises from the Employment Rights Act 1996 — the worker must not be subjected to detriment, and exposure of their identity may itself constitute a detriment if it leads to adverse treatment. The practical necessity arises from the fact that a whistleblower investigation whose subject becomes aware of it prematurely can be compromised before it has established the facts.
The management of the disclosing worker’s identity is the most sensitive confidentiality issue in these investigations. The following principles apply:
- The identity of the disclosing worker should not be disclosed to the subject of the investigation, to colleagues, or to any other individual without the worker’s informed consent, except where it is strictly necessary for the investigation to proceed.
- Where the worker’s identity cannot be protected without compromising the investigation’s ability to examine the substance of the disclosure, the worker should be informed of this before the relevant step is taken, given the opportunity to consider their position, and — where possible — given a choice about how to proceed.
- Anonymous disclosures, where the worker has not identified themselves, should be investigated on the basis of the substance of the allegation, with the investigation record reflecting that the identity of the disclosing worker is unknown.
- All communications relating to the investigation, including the investigation report itself, should be marked as strictly confidential and shared only with those who have a genuine need to see them.
Reporting Outcomes
The investigation report in a whistleblower case must address two distinct sets of findings: the findings on the substance of the disclosure, and the findings on any detriment experienced by the disclosing worker during or after the investigation.
On the substance of the disclosure, the report should address each specific allegation raised, make a finding on the balance of probabilities where the evidence permits, and identify clearly what the investigation established, what it could not establish, and what further action the findings may warrant — whether disciplinary, regulatory, or operational.
Where the investigation finds that wrongdoing occurred as alleged, the findings and the recommended next steps need to be communicated to the appropriate governance body — the board, the audit committee, or the relevant regulator — in a form that allows them to act promptly and appropriately. In regulated sectors, this may include mandatory reporting obligations that need to be addressed alongside the internal response.
The disclosing worker should receive feedback on the outcome of the investigation at a level of detail that is appropriate given the confidentiality requirements of the process. They should be informed whether the substance of their disclosure was found to have merit, what action has been taken as a result, and what the organisation’s position is on any detriment they may have experienced. This feedback should be handled sensitively and should not inadvertently reveal information that prejudices the investigation’s findings or exposes others involved.
Need independent support investigating a whistleblower disclosure? Contact iSpy Detectives for confidential, legally compliant investigation services. Our team has recently undertaken investigations around Whistleblower Allegations for corporate customers in London, Dundee, Belfast, Bristol, Rochester and Sheffield.