A whistleblowing inbox needs somewhere safe to go

A whistleblowing policy needs a workable route from the first report to someone able to respond without a conflict of interest. An email address alone does not establish that route. For employers in Great Britain, the worker guidance published on 1 October 2026 provides a timely reason to test what happens after a concern arrives, particularly when it concerns the usual recipient.

The government guidance for workers explains that protection depends on conditions including the worker's reasonable belief about wrongdoing and the public interest, and the channel used. Its scope is England, Scotland and Wales; Northern Ireland has a different framework. A policy should explain where advice is available without trying to decide every individual's legal position in advance.

Consider the reporting route as a restricted case, rather than an ordinary customer-service queue. Our practical recommendation is to name both the normal recipient and an alternative outside that person's reporting line. Describe when the alternative can be used in ordinary language. A worker should not have to send the allegation to the person it concerns to discover the next step.

Test this design against access permissions. A named independent recipient is of limited help if a broad management group can read the shared mailbox, attachments or automated forwarding rules. Record the authorised roles, the backup for absence and how access is removed when responsibilities change. Keep an access decision separate from a conclusion about whether the allegation is substantiated.

There is also a difference between anonymous reporting and a named report made in confidence. The government guidance discusses both and notes limitations. Explain those limits honestly; do not promise absolute secrecy or unrestricted updates about other people. Tell the reporter how follow-up questions can reach them through the chosen route.

Use a minimal case record to capture receipt, immediate risk assessment, the accountable case owner, any conflict considered, and the next review point. These are recommended management controls, not a claim that every field or response time is prescribed by law. Sector-specific duties and legal advice may require additional arrangements.

Keep allegations, evidence and findings distinguishable. A first report may be incomplete; an unsubstantiated concern is not automatically a dishonest one. Avoid copying sensitive narrative into a general board pack simply to demonstrate activity. A restricted case file can hold the evidence while an oversight report identifies decisions or overdue actions at a suitable level of detail.

The reasoning discipline in recording board decisions is useful here, but access must suit the sensitivity of the case. Record why a route or action was chosen, who authorised it and when it will be reviewed. Do not treat a closed status in a spreadsheet as proof that the underlying issue has been resolved.

Fictional example, not an investigation result. A worker sends a named report to the advertised channel alleging that the usual case manager concealed a safety concern. The organisation's designated alternative recipient is outside that manager's reporting line.

The oversight log can say that a conflicted case was reassigned without reproducing the worker's name or narrative. The restricted case file carries those details and the reasons for access decisions. A mailbox forwarding rule giving the usual manager continued access would mean this routing design has not actually been implemented.

To use the record, rehearse the route with invented data and inspect permissions before inviting sensitive disclosures into it. Record a real rehearsal as performed only when it has occurred. The arrangement does not determine whether a disclosure is legally protected, remove external reporting routes or promise absolute secrecy; those questions remain subject to the applicable framework and competent advice.

The government's employer guidance describes protected disclosures and sets out best-practice handling and policy considerations. Use it to brief the people who receive concerns, alongside the organisation's applicable legal and regulatory obligations. A manager receiving an unfamiliar report needs an escalation route, not permission to improvise a legal ruling.

A short tabletop discussion can expose gaps: the normal recipient is on leave; the report concerns that recipient; an attachment contains unrelated personal information; or the reporter asks who will see their identity. These are proposed test situations, not accounts of real cases. Evaluate whether staff can find the approved response route and record the reason for escalation without spreading the report unnecessarily.

The immediate payoff is a clearer response system. Confirm the alternate recipient, restrict the records and assign a date to review unresolved cases. Do not use a small number of reports as evidence that the workplace has no problems, and do not discourage legitimate external reporting routes. Seek qualified advice on individual disclosures, protection, deadlines and sector obligations.

AI assistance was used in preparing this article.

This article is general information. Verify current requirements and seek qualified advice for your specific circumstances.

Spotted an issue? Contact our editorial desk.