Where to from here? The future of corporate whistleblowing in Australia

More than six years after the enhanced whistleblower regime for private sector organisations was introduced into Part 9.4AAA of the Corporations Act 2001 (Cth) (Corporations Act), some expectations around organisational compliance with the regime have become clearer, many remain untested and debated, and whistleblowing governance is a key focus area of Parliament, media and boardrooms across the country. The practical challenges of effectively managing protected disclosures remain significant.

As Federal Treasury’s statutory review of the whistleblowing laws is now underway, we examine where the regime currently stands and consider what the next phase may hold for whistleblower protections and obligations in Australia.

Treasury’s statutory review

Under section 1317AK of the Corporations Act, a review of the whistleblower provisions in the Corporations Act and Tax Administration Act 1953 (Cth) (Corporate Whistleblowing Regime) was to be conducted “as soon as practicable” following the end of five years from the Regime’s commencement in July 2019.

Following a period of early scoping discussions and preliminary engagement with several entities regarding the scope of the review undertaken in late 2025,^[1] on 2 June 2026 Treasury released its consultation paper, Review of tax and corporate whistleblowing in Australia (Consultation Paper), commencing the statutory review process. As flagged in our recent alert addressing the statutory review of the regime, the Consultation Paper has sought views on matters including the scope of 'eligible whistleblower' categories and the range of entities captured by the regime, whether whistleblower anonymity and confidentiality protections remain fit for purpose, administration and regulation of the regimes, and their effectiveness in encouraging disclosures and discouraging wrongdoing. The review does not extend to public sector whistleblowing frameworks or other private sector regimes. Submissions closed on 29 July 2026 and Treasury has convened roundtables during the consultation period to supplement written submissions. Treasury is now required by s 1317AK to produce a written report to government. As at the date of publication, no timeline has been announced for that report, nor for any resulting legislative response. We will continue to watch these developments closely.

As outlined in earlier Parts of this series, in parallel with the development of Treasury’s review, there has been a recent increase in judicial activity, which has started to deliver insight into some of the key areas of debate and practical challenge that have arisen from application of the current regime. On the ground, we are also seeing whistleblowing matters arise more frequently within or alongside other employment disputes for current and former employees, particularly general protections claims and other termination-related disputes. Untangling these intertwined issues can be complex. Ongoing vigilance and management of complaints and disclosures remains necessary.

As we’ve previously indicated, in our view it is critical that Treasury has heard from a range of organisations as to the opportunities to simplify and clarify the existing regime in a way that preserves meaningful protection for legitimate disclosures. Mallesons has engaged with clients and made a submission to Treasury to draw attention to some of these practical challenges our practitioners and our clients experience in the handling and investigation of disclosures. 

What our clients told us: survey insights

To ground our submission in the real experience of regulated entities, and building on our previous survey conducted with clients in June 2024, we surveyed clients on how the whistleblower regime operates in practice^[2]. The results reveal a clear gap between the law as designed and the law in practice and have informed our submission to Treasury.

Key insights

Confidence and disclosure management

We inquired into our clients’ confidence in correctly applying the tax and corporate whistleblowing laws in practice. While clients generally reported some confidence, for a significant majority, it is qualified.  Results reveal that most respondents (73%) are "generally confident" applying the laws but routinely seek advice on novel or borderline matters. Eleven percent report frequent uncertainty and reliance on external advice, while only 16% felt they applied the laws confidently across almost all scenarios.

This perhaps tracks with resourcing of organisations’ whistleblower programs: 73% have teams who manage their whistleblower programs alongside other employment duties, while only 2.2% have teams that are exclusively engaged for this purpose. Meanwhile, disclosure volumes are climbing: 68% of respondents reported an increase in disclosures received over the past three years, with 39% describing it as "marked."

Nearly 38% of clients surveyed indicated disclosures reliably reached eligible recipients, however a concerning 62% reported some degree of confusion about who in their organisation can receive protected disclosures and nearly 7% reported grappling frequently with purported disclosures being made to ineligible recipients.

Pleasingly, more than three quarters of respondents expressed a level of confidence in managing the risk of claims of detriment when making employment or governance decisions affecting a discloser, but still, 22% worry that routine decisions could be characterised as detriment.

On the question of how well-equipped organisations are to investigate anonymous or confidential disclosures while maintaining the whistleblower’s identity protections, nearly 70% of respondents indicated that while their processes generally work, they are tested by “hard cases”.

Understanding the boundaries of key regime concepts

The boundary between disclosable conduct and workplace matters seems to be the most persistent point of challenge. Three-quarters of respondents reported that at least half of the complaints they receive relate wholly or partly to employment or workplace issues, and 73% said personal or workplace grievances are raised "frequently" or "very frequently" through the whistleblowing framework rather than through ordinary grievance channels. Consistent with this, almost 69% find the "misconduct or improper state of affairs" threshold "somewhat" or "very" unclear with more than 13% reporting it as a constant source of difficulty, and 77% face at least occasional difficulty distinguishing a protected disclosure from a personal work-related grievance. Nearly 38% of clients reported that this analysis requires careful, contested assessment.

An issue that has not received much attention in public discourse, but which we know arises not infrequently for clients, is how to deal with a concern raised by someone presenting as a customer or member of the organisation but where their eligibility as a whistleblower may only arise because they also happen to be a current or former employee, officer, contractor or associate. Nearly 28% of respondents have no established approach for dealing with these dual-capacity disclosers, and otherwise responses were mixed: 10% routinely screen customer complaints for employment or other eligible relationships, over 17% rarely assess whistleblower eligibility in customer complaint channels and most (45%) only identify these cases where the connection is obvious or expressly raised by the discloser.

On the question of protection for “preparatory acts” (for example, a discloser gathering or copying supporting material - including in the context of employment in a manner that may otherwise breach a discloser’s underlying employment and confidentiality obligations to the organisation), more than 86% expressed a level of concern about this issue, though we note that more than 60% of respondents recognised the risk but had not encountered it directly.

Perhaps the most telling finding is that more than three quarters (77%) of respondents say they treat borderline matters as protected on a precautionary or “overly inclusive” basis to a moderate or large extent. In other words, uncertainty in the scope of the law’s application is not being resolved through confident triage, advice or other resolution mechanisms. It is being resolved by erring on the side of treating the matter as protected by the regime. In a sense, this aligns with the regime’s protective purpose. However, it also might also be adding to confusion about where statutory protections do genuinely apply, and suggests the current definitions are not defining the boundaries as clearly as the legislation should. This challenge raises interesting questions about the appropriate place to draw the line between raising of concerns through existing grievance channels (such as HR) and statutory whistleblowing as an organisation’s ‘default’ grievance mechanism. Particularly given the significant organisational and personal liability that may flow from a concern being raised via whistleblowing channels.

Entity coverage and financial incentives

While 82% of respondents said the exclusion of partnerships, trusts, sole traders and other non-constitutional structures from the corporate regime is not a relevant concern because their structures are already fully captured, a meaningful minority — nearly 9% — say the exclusion of key or material parts of their operations from the regime is a moderate or major issue, reflecting the entity-coverage debate we discussed in Part One.

Interestingly, our clients are predominantly against financial incentive schemes for whistleblowers who make substantiated disclosures: nearly 94% "somewhat" or "strongly" oppose their introduction, a striking degree of consensus on an issue that has otherwise attracted support in some quarters for many years and has been implemented in other overseas jurisdictions.

Finally, only 11% of respondents consider existing regulatory and internal policy guidance "fully adequate" for operating the organisation’s whistleblower program, while 40% describe it as either "partly" inadequate, or "wholly inadequate” and offering “little practical help” for the issues they face.

We expect the period ahead to involve further public commentary and internal reflection by boards and senior management on whistleblowing governance in the private sector more broadly. We see that three questions are likely to recur: how disclosures are handled, and by whom (that is, what’s the optimal internal disclosure handling model); what do effective protection arrangements look like in practice; and what role third parties, including external investigators and legal advisers, should play in ensuring disclosures are handled with independence and rigour. Treasury’s review presents a genuine opportunity to simplify compliance, support earlier internal resolution of concerns and improve clarity in the framework for both whistleblowers and organisations, in ways that will help to address all three of these questions.

Opportunities for reform

A Whistleblower Protection Authority

The idea of a dedicated Whistleblower Protection Authority (WPA) has featured in the whistleblower policy debate in this country for years, including as a recommendation of the Parliamentary Joint Committee in its 2017 report on whistleblower protections in the corporate, public and not-for-profit sectors. In February 2025, two private bills, the Whistleblower Protection Authority Bill 2025 (Cth) and the Whistleblower Protection Authority Bill 2025 (No. 2) (Cth), were introduced in the House of Representatives and Senate respectively.

The first Bill lapsed at dissolution in March 2025 before the federal election. On 29 August 2025, the Senate Legal and Constitutional Affairs Legislation Committee tabled its report on the second Bill, recommending that it not be passed, in light of the then ongoing reforms of public sector whistleblower legislation. It recommended that Treasury consider relevant evidence as part of its statutory review. However, Treasury’s terms of reference confirm its review is focused on the Corporate Whistleblowing Regime, expressly excluding public sector and other private sector regimes, and the Consultation Paper says little about it.

On the terms of the Consultation Paper itself, therefore, the establishment of a WPA has not appeared to be central to the matters on which Treasury wished to consult or is a concept which is driving potential reforms. As envisaged, a WPA would act as a “one stop shop” for potential whistleblowers - a body established to provide assistance, advice, guidance and support to navigate the legal landscape when revealing misconduct. Such a body would sit alongside existing regulators such as ASIC. Anecdotally, we have observed markedly increased discussion of and openness to the possible establishment of a WPA, based on the support and guidance it could potentially offer actual and potential whistleblowers, and in turn, the load it could lift from organisations currently grappling with how to educate and protect disclosers who may, for example, be anonymous, who may or may not be current employees, and who may for various reasons find themselves potentially outside the scope of the current protection regime.

Enforcement

The Australian Securities and Investments Commission (ASIC) remains a key actor in the whistleblower regime, receiving and assessing disclosures concerning corporate misconduct and, where appropriate, using its enforcement powers. ASIC experienced a significant increase in whistleblowing disclosures received since the 2019 Corporate Whistleblowing Regime reforms. Notably:

• from July 2016 to June 2019, before the current regime came into effect, ASIC received an average of 227 disclosures each year, with around 94% of disclosures requiring no further action;^[3]
• from July 2019 to June 2022, under the current regime, ASIC received an average of 745 disclosures each year, with around 92% of the disclosures requiring no further action;^[4] and
• from July 2022 to June 2025, the number of whistleblower reports assessed by ASIC stabilised, averaging 727 disclosures annually, with around 91% of the disclosures requiring no further action.^[5]

Taken together, these figures show a large uptick in the number of reports under the current regime. The high rate of no‑further‑action outcomes reflects a range of factors, including insufficient evidence, disclosures that do not reveal an actionable breach or matters falling within the remit of other regulators.

However, scrutiny of ASIC’s effectiveness has intensified. In July 2024, the Senate Economics Reference Committee released its report into ASIC’s approach to investigation and enforcement of reports of alleged misconduct. The Committee was critical of ASIC for investigating too few of the disclosures it receives. Relevantly, two recommendations made in the report included that the Government should consider introducing financial incentives for whistleblowers who make substantiated disclosures, referencing such strategies implemented in other jurisdictions; and ASIC should prioritise litigating serious suspected breaches.

What might the courts consider next? 

Based on the trajectory of recent decisions, we expect continued judicial attention to the outer boundaries of “misconduct or an improper state of affairs or circumstances”, including whether the apparent narrowing toward matters that engage ASIC's, APRA's or another regulator's core functions will hold, or whether courts will find the regime encompasses other categories (such as safety or other non-financial concerns).

We also expect further consideration of the personal work-related grievance boundary, particularly in mixed disclosures involving both integrity and workplace elements, given how frequently this arises in practice according to our anecdotal experience and consistent with our client survey results.

On detriment, we now have appellate guidance on the test for liability from Reiche v Neometals Ltd [2026] FCAFC 53 (Reiche). We expect future cases will test how that standard applies to more complex fact patterns, such as where there are multiple decision-makers at play, or the evidence is more contested. High Court guidance on these questions may also arise, given Mr Reiche’s special leave application.

Final thoughts

Based on our experience working with clients in this area, the scope of Treasury's review, public and parliamentary scrutiny and the issues our clients have reported, we anticipate the following will feature most prominently in any resulting legislative reform:

• Clearer definitions, particularly around the "misconduct or improper state of affairs" and the personal work-related grievance boundaries.
• Entity coverage, especially whether partnerships are to be brought within the corporate regime, in light of the parliamentary scrutiny of entity coverage discussed elsewhere in this series.
• Guidance on anonymous disclosures and preparatory acts, given the practical challenges organisations report in this area.
• A cautious approach to financial incentives, which we expect to remain a contested issue in the context of any proposed reforms.While recommendations have previously been made to Government to consider incentive schemes, the Consultation Paper flags risks including of an increase in low-value disclosures tying up limited regulatory resources, amidst a lack of clarity about the degree to which rewards would incentivise potential whistleblowers.
• A dedicated authority, to provide a ‘no wrong door’ source of support for whistleblowers. We expect the idea of centralised support for individuals to remain an active issue for debate.

We are at an inflection point in a changing regime, not at the end point. The courts are gradually adding definition to key concepts of the whistleblowing regime, Treasury’s statutory review is well underway and our own client survey reflects our experience of organisations striving to manage day-to-day uncertainty while doing their best to protect those who speak up, acknowledging the many challenges in both respects.

What comes of Treasury’s review remains to be seen. But the practical priorities for organisations in the immediate future are more clear: organisations should look to build robust, well-resourced whistleblower programs capable of identifying, triaging and handling disclosures with rigour, and support whistleblowers and decision-makers alike with the guidance, training and independent perspective they need to navigate the regime with confidence. Whatever the review ultimately delivers, organisations that get these fundamentals right now will be best placed to adapt to whatever reform follows.