Whistleblower Investigations: A Guide for UK Businesses

When an employee reports wrongdoing, your response defines your organisation

A whistleblower disclosure is one of the most consequential events a UK business can face. Handle it well, and you identify and correct a problem before regulators, the press, or the courts force you to. Handle it badly, ignore it, suppress it, or retaliate against the person who raised it, and you face regulatory investigation, employment tribunal claims with uncapped compensation, criminal liability, and reputational damage that no PR strategy can undo.

This article explains what whistleblowing means in UK law, how employers should respond to disclosures, how to investigate internal complaints properly, and the legal protections that apply to the person who speaks up.

What counts as whistleblowing

Not every employee complaint is a whistleblowing disclosure. The Public Interest Disclosure Act 1998 (PIDA), which amended the Employment Rights Act 1996, protects workers who make “qualifying disclosures” – disclosures of information that the worker reasonably believes shows one or more of the following: a criminal offence has been or is being carried out, a person has failed or is failing to comply with a legal obligation, a miscarriage of justice has occurred or is likely to occur, the health or safety of any individual has been or is being endangered, the environment has been or is being damaged, or information relating to any of these categories has been or is likely to be deliberately concealed.

The disclosure must be made in the public interest. A personal grievance, “my manager is rude to me”, is not whistleblowing. A disclosure that “my manager is falsifying safety inspection records” is, because it concerns potential criminal conduct and a risk to health and safety that affects people beyond the individual complainant.

The worker does not need to be right about the wrongdoing. They need to hold a reasonable belief that the information they are disclosing shows or tends to show one of the qualifying categories. A worker who reports suspected fraud that turns out to have an innocent explanation is still protected, provided their belief was reasonable at the time they made the disclosure.

Legal protections for whistleblowers

Protection from dismissal

Dismissing an employee because they have made a protected disclosure is automatically unfair – regardless of the employee’s length of service. There is no qualifying service period for whistleblowing dismissal claims (unlike ordinary unfair dismissal, which requires two years’ continuous service). Compensation for automatically unfair dismissal is uncapped, meaning the tribunal can award whatever sum it considers just and equitable.

Protection from detriment

Subjecting a worker to any detriment because they have made a protected disclosure is unlawful. “Detriment” includes denial of promotion, reduction of hours, exclusion from meetings, removal of responsibilities, disciplinary action, and any other treatment that puts the worker at a disadvantage. The detriment does not need to be carried out by the employer directly – if a colleague subjects the whistleblower to detriment and the employer fails to prevent it, the employer may be liable.

Interim relief

Whistleblowers who are dismissed can apply for interim relief within seven days of their date of termination. If the tribunal finds that the claim is likely to succeed, it can order the employer to continue to employ the worker (or re-engage them) until the full hearing. This is a strong remedy that most dismissed employees do not have access to.

How to handle a whistleblowing disclosure

Step 1: Acknowledge and record

When an employee makes a disclosure, acknowledge it promptly. Confirm in writing that the disclosure has been received, that it will be investigated, and that the person making the disclosure is protected from retaliation. Record the disclosure accurately – what was said, when, and to whom. Do not dismiss it, minimise it, or promise a specific outcome.

Step 2: Assess the disclosure

Determine whether the disclosure qualifies for protection under PIDA. Does it relate to one of the qualifying categories (criminal offence, legal obligation, health and safety, environmental damage, miscarriage of justice, or concealment)? Does the person making the disclosure hold a reasonable belief that the information shows wrongdoing? Is the disclosure made in the public interest?

If it qualifies, it must be investigated. If it does not qualify as whistleblowing, for example, it is a personal grievance unrelated to any qualifying category, it should still be investigated through the appropriate grievance or complaints procedure. Either way, the complaint deserves a proper response.

Step 3: Appoint an investigating officer

The investigating officer should be senior enough to have authority over the investigation, independent of the people involved (they should not report to the person accused of wrongdoing), and experienced in conducting investigations or supported by someone who is.

In cases involving senior management, or where the disclosure concerns conduct at board level, an external investigator provides the independence that an internal investigation cannot. External investigators have no internal relationships to manage, no career consequences to worry about, and their findings carry more credibility with regulators and tribunals.

Step 4: Conduct the investigation

The investigation should follow the same principles as any workplace investigation: define the scope, gather documentary evidence, interview relevant witnesses, assess the evidence on the balance of probabilities, and produce a written report with findings and recommendations.

The specific requirements for a whistleblowing investigation include protecting the identity of the whistleblower as far as possible (complete anonymity cannot always be guaranteed, particularly if the matter goes to court, but the employer should minimise disclosure of the whistleblower’s identity), ensuring the whistleblower is not subjected to any detriment during or after the investigation, keeping the whistleblower informed of progress (they should know that the investigation is ongoing and when it is expected to conclude, even if they cannot be told every detail of the findings), and maintaining confidentiality more broadly – the investigation should not become office gossip.

Step 5: Report and act on findings

The investigation report should set out the evidence, the findings, and recommendations for action. If the investigation confirms wrongdoing, the employer must act: disciplinary proceedings against those responsible, reporting to regulators where required, remedial action to prevent recurrence, and, where appropriate, referral to the police.

If the investigation finds no evidence of wrongdoing, communicate this to the whistleblower clearly, explaining the reasons for the finding. The whistleblower may disagree with the conclusion, but a thorough, well-documented investigation that finds nothing is a defensible outcome. A dismissive one-paragraph response that fails to address the substance of the disclosure is not.

Common mistakes in handling whistleblowing

Shooting the messenger

The most damaging response to whistleblowing is to retaliate against the person who made the disclosure. Retaliation includes formal actions (dismissal, disciplinary proceedings) and informal actions (exclusion, hostility, removal of responsibilities). Both are unlawful, and both are detectable. Tribunals look at the timeline – if a previously well-regarded employee suddenly faces performance management proceedings after making a disclosure, the inference of retaliation is strong.

Failing to investigate

Receiving a disclosure and doing nothing is not a neutral act. It leaves the alleged wrongdoing unaddressed, exposes the employer to regulatory risk, and may itself constitute a detriment to the whistleblower (who reasonably expected the matter to be taken seriously). A disclosure that is ignored does not go away, it goes to a regulator, the press, or a tribunal.

Investigating the whistleblower instead of the wrongdoing

Responding to a disclosure by investigating the whistleblower’s conduct, their performance, their attendance, their motives for making the disclosure – rather than the substance of what they disclosed is a form of retaliation. The whistleblower’s motives are irrelevant to the protection. Even if the disclosure was made partly out of personal animosity, it is still protected if it meets the qualifying criteria and is made in the public interest.

Inadequate record-keeping

If a whistleblowing matter reaches a tribunal, the employer will need to demonstrate what it did in response to the disclosure. A detailed record of the disclosure, the investigation, the findings, and the actions taken is essential. An employer who cannot produce this record will struggle to defend a claim that the whistleblower was subjected to detriment or dismissal because of their disclosure.

Establishing a whistleblowing policy

Every UK business should have a written whistleblowing policy that explains what whistleblowing is and how it differs from a grievance. It should identify who disclosures should be made to (a named individual, a role such as the compliance officer, or an external hotline). It should describe how disclosures will be investigated. It should confirm the legal protections available to whistleblowers. It should make clear that retaliation against whistleblowers will be treated as a disciplinary matter. And it should provide information about external reporting channels (such as the relevant regulator) that the worker can use if they are not satisfied with the employer’s response.

The policy should be communicated to all staff and included in induction materials. A policy that exists only in an HR manual that nobody reads is of limited value. Regular reminders, through training, team meetings, and internal communications, keep the policy visible and normalise the act of raising concerns.

When to use external investigators

External investigation is appropriate when the disclosure involves senior management or board-level individuals. When the allegation concerns financial fraud, corruption, or other matters requiring specialist investigation skills. When the employer lacks internal investigation capacity or specialist knowledge. When the independence of an internal investigation would be questioned. And when the matter is likely to result in regulatory scrutiny, litigation, or criminal proceedings, where independently gathered evidence carries greater weight.

UKPI provides whistleblowing and fraud investigation services for UK businesses. Our investigators conduct independent investigations that meet tribunal and regulatory standards. We gather evidence lawfully, interview witnesses impartially, and produce reports that withstand legal scrutiny.

If your business has received a whistleblowing disclosure and needs independent investigation support, or if you want to establish a whistleblowing procedure, call 0800 043 1754 or contact us online.

The cost of ignoring whistleblowing

The financial consequences of mishandling a whistleblowing disclosure are severe. Compensation for automatically unfair dismissal of a whistleblower is uncapped. In recent years, UK employment tribunals have made awards exceeding £1 million in whistleblowing cases. But the direct financial cost is often the least of the damage.

Regulatory consequences follow. The Financial Conduct Authority, the Health and Safety Executive, the Care Quality Commission, and other regulators treat failures to investigate whistleblowing disclosures as evidence of poor governance. A business that ignores a whistleblower’s report of safety violations and subsequently suffers a workplace accident faces both regulatory action and civil claims, with the ignored disclosure as evidence of knowledge and failure to act.

Reputational damage is the hardest to quantify. Media coverage of whistleblowing cases, particularly those involving dismissed whistleblowers who are vindicated at tribunal, causes lasting harm. Potential employees, customers, and business partners read these stories, and the perception of an organisation that punishes truth-tellers does not fade quickly.

Whistleblowing in specific sectors

Financial services

The FCA requires authorised firms to have internal whistleblowing arrangements, including a designated senior manager (the whistleblowing lead) responsible for overseeing the firm’s arrangements. Firms must inform the FCA of any internal whistleblowing report that could indicate a regulatory breach. Failure to maintain adequate whistleblowing arrangements is itself a regulatory failing.

Healthcare

The NHS and care sector have been shaped by whistleblowing failures – most notably the Mid Staffordshire NHS Foundation Trust scandal, which prompted the Francis Report and subsequent reforms. The Freedom to Speak Up Guardian role was established in NHS trusts following the Francis Report’s recommendations. Healthcare employers face particular scrutiny of their whistleblowing arrangements, and failures in this area attract intense regulatory and media attention.

Construction and manufacturing

Health and safety whistleblowing in construction and manufacturing can prevent fatalities. An employee who reports unsafe working practices, inadequate PPE, defective equipment, or falsified safety records is providing information that protects lives. Employers who suppress or ignore these reports, and subsequently suffer a serious accident, face criminal prosecution under the Health and Safety at Work Act 1974 and the Corporate Manslaughter and Corporate Homicide Act 2007, with the suppressed disclosure as evidence of management awareness and failure to act.