Speak‐out in the Banking Sector

In the aftermath of the financial crisis and scandals discussed in the previous section, preventing wrongdoing is now higher on the agenda for states and professional bodies.³⁸ Commentators have emphasised that eradicating wrongdoing in the financial sector will require joint action by employers and employees to create an organizational context that is conducive to speaking up.³⁹ However, the sector is known to have a culture of silence and secrecy.⁴⁰ According to the literature, the primary reasons behind the pervasiveness of silence are organizations' failure to investigate claims, retaliation against voicing employees, social isolation of voicing employees from colleagues, and gagging clauses,⁴¹ each of which are briefly discussed next.

Previous research shows that concerns are often disregarded by line managers, who are usually the first point of contact for voicing employees, and that escalation of concerns is difficult within the strict hierarchy of banks.⁴² Even if a concern is eventually investigated, investigations can lack rigour.⁴³ Furthermore, management typically fails to act upon reports resulting from investigations by compliance personnel and internal auditors.⁴⁴ It has also been observed that whistleblowers perversely become the object of investigation, instead of the concern they raise.⁴⁵ Their intention, personality and mental health are closely scrutinised to divert attention from the concern and discredit the whistleblower^46,47 (see the case of Eileen Foster in Chapter 2).

In their five‐year review, Public Concern at Work notes that among finance professionals who called its advice line, 33% had been suspended and 31% had been dismissed for raising a concern.⁴⁸ This was higher than the averages across other sectors, which stood at 27% and 23%, respectively.⁴⁹ Another survey showed that of 500 finance professionals who participated, only 35% were confident that they would not face retaliation if they raised a concern.⁵⁰ Types of retaliation observed in financial firms range from character assassination to dismissal, causing distress to those who speak up and dissuading others who may consider speaking up.⁵¹ (See Box 3.2.)

A pervasive form of victimisation in the financial sector is social isolation. As mentioned in the beginning of this chapter, previous research has found that there is a strong ideological conviction in the ability of financial markets to self‐regulate, and this over‐confidence leads to underestimation of the risks posed by new financial instruments and practices.⁵² Such conviction finds its expression in organizations as ‘groupthink’,⁵³ which does not allow alternative ways of thinking to be explored and contrarian views to be expressed. Challenging organizational norms, even for the purposes of compliance with legal regulations and professional standards, often results in isolation from colleagues.⁵⁴

The last notorious barrier to speaking up in the sector involves gagging clauses. These are confidentiality agreements between employers and employees designed to prevent the latter from disclosing information about organizational practices. Although legal protections and obligations may override gagging clauses, they still deter many employees from escalating concerns to regulators as they fear the consequences that these agreements convey.⁵⁵

These barriers to speaking up have featured in recent whistleblowing cases that garnered media attention. In 2007, Hervé Falciani, an IT consultant for HSBC bank in Geneva, Switzerland, leaked details of thousands of clients' accounts, alleging that the bank facilitated tax evasion and money laundering.⁵⁶ The documents were submitted to the French authorities, who later passed them onto other countries for whom the information was relevant.⁵⁷ Since then, several countries have conducted investigations into tax evasion and money laundering with the continued collaboration of Falciani.⁵⁸ Falciani claims that he followed his organization's speak‐up arrangements and first raised his concerns internally, but the organization failed to investigate. The Swiss authorities, however, have taken him to court for stealing data with the intention of profit making, and he was sentenced to five years in prison.⁵⁹ As such, his case seems to exemplify the ‘failure to investigate’ discussed earlier.

Another recent well‐known whistleblowing case from the financial sector is LuxLeaks. This time two (former) employees of PricewaterhouseCoopers (PwC), an auditing firm, leaked documents evidencing advance tax agreements between the Grand Duchy of Luxemburg and 340 companies, most of them multinationals.⁶⁰ These tax agreements allowed the companies to funnel profits made across the globe through Luxemburg where they would only pay about 1% in taxes, which is much lower than what they would pay in the countries where the income is generated.⁶¹ While the LuxLeaks whistleblowers have started a global debate about tax evasion and triggered policy changes in several countries, they were ‘found guilty of data theft and breach of commercial confidentiality’⁶² by the court. This verdict was overturned for one of the whistleblowers, Antoine Deltour,⁶³ in January 2018, but not for Raphael Halet,⁶⁴ who was given a nine‐month jail sentence and a €1,000 fine.

Halet had previously signed a contract with PwC which threatened him and his wife with damages of €10 million and the repossession of their home if they ever spoke about their role in the LuxLeaks scandal. The document also forbade him from questioning the validity of the court's decision in Metz to provide a bailiff access to his home and emails, despite an 1881 French law that specifically protects journalists' sources.⁶⁵ Halet claimed that he gave conflicting testimonies during the investigation fearing the consequences of this gagging clause, which might have led to his later conviction.⁶⁶

It was the growing public pressure following these and similar successive scandals that led governments to look for ways to protect whistleblowers and make the best of the information they provide. For instance, in July 2015, the FCA has introduced new regulation for financial firms which includes the requirement to:

• Establish internal speak‐up arrangements.
• Emphasise in contracts and settlement agreements that workers cannot be gagged from making a public interest disclosure.
• Inform employees about their right to raise their concerns with FCA and the Prudential Regulation Authority (PRA).⁶⁷

PCAW has stated that the new regulation has already helped encourage speaking‐up in the sector.⁶⁸ This was reflected in the number of financial sector professionals who called their advice line in 2015, which was double the amount in the previous year.⁶⁹ The callers' concerns included ‘falsifying invoices and expenses, breach of data protection, incorrect reporting to a third party, misuse of client funds and market abuse’.⁷⁰ In the United States, the number of concerns raised with Office of the Whistleblower (OWB) has also increased, from 334 in the 2011 fiscal year to 3238 in the 2013 fiscal year.⁷¹ Concerns included corporate disclosures of financials, facilitating fraud, and manipulation.⁷² These indicators suggest that the culture of silence in the financial services may gradually be changed. Improvements in legal protection, regulatory oversight, and internal speak‐up arrangements appear to encourage more people to expose wrongdoing.

Case in Focus

The bank we researched operates and is headquartered in Northwest Europe with some presence in the United States and eastern Europe. Its services span personal, business and corporate banking. It was established in the second half of the twentieth century and acquired and merged with other banks in the 1980s and 1990s. Together with its counterparts at the time, it was heavily engaged in commercial property lending before the 2008 crisis and was severely affected by this event.

In early 2000s, the bank's reputation suffered from successive scandals. One of these was a highly publicised case of creative accounting at one of its subsidiaries. In order to recover from the reputational loss and prevent similar events in the future, the bank developed a code of conduct. The speak‐up policy formed an integral part of this code. In developing the policy, the board was particularly interested in addressing conflicts of interest, which were widespread at the time according to a speak‐up operator:

It was at a time when there [were] very high levels of sensitivity around people, particularly at management level in the bank, being involved in —becoming involved in—conflict of interest situations with (property) developers. (…) and it had been quite clear that a lot of people involved in the bank had become involved with buying their own buy‐to‐lets⁷³ — as many of us did. (…) But some people did actually get involved in development and there were some conflict of interest situations. So there was a very, very strong message that went out from the board to say, ‘We have a conflict of interest policy. You need to put your hand up now and identify if you are in any of these types of situations'.

Initially, the speak‐up channel was owned by the compliance function but had been taken over by human resources at group level after a comprehensive review undertaken after a number of years. The review was partly motivated by the board's concern to change the tone around speaking‐up: from policing towards engagement. The speak‐up operator continued:

The difference then was that the speak‐up process and line and email was owned by compliance. And it was owned by compliance up until about 2012 because it travelled with our code of business ethics, now known as our code of conduct. And the ownership of the code moved in 2012 from compliance to HR. (…) It wasn't handled particularly well because compliance are not experts in communication. So the board said, ‘Here, HR, you do it’.

As part of the review process two charities specialising in whistleblowing and business ethics were invited to benchmark the new whistleblowing policy and help with implementing best practice. A speak‐up operator said ‘we are confident, again, that our current speak‐up, which had some minor changes in it, addresses all the requirements of that new [regulator's acronym] policy document’. The code of conduct and the speak‐up arrangement continue to be reviewed annually.

The speak‐up arrangements allow employees to raise concerns with their line manager, internal ‘key persons’ (the CEO, chairman, HR director, head of internal audit, chief risk officer, and the head of compliance), through an internally operated hotline and email. The bank also has a contract with an external independent advice line, which provides guidance on effectively raising concerns and benefiting from legal whistleblowing protection. This guidance includes informing employees about their rights and signposting the voicing employee to regulators if deemed necessary.⁷⁴

In practice, concerns are usually first raised informally with one's line manager. At the time of our research, the organization was trying to empower line managers to make this pathway more effective. On the other hand, the speak‐up policy names the “key persons” as the first point of contact. The first point of contact is responsible for registering the concern, informing the whistleblower that his/her concern is received and logged, identifying a contact person going forward, and arranging an in‐person meeting to discuss follow‐up activities. The Head of Special Investigations Unit noted:

If, for example, as I say, we're interviewing people, first of all, (…) we say that they're only being interviewed as a witness, so we would offer the same, whatever information they give to us, you have the same protection as you would under the speak‐up policy.

The key person, in collaboration with the head of HR strategy and planning, determines whether the concern is related to wrongdoing or is a grievance. This is followed by signposting to the relevant function(s), as a speak‐up operator notes:

There was a speak‐up last year which was, when it originally came in, it was about three‐quarters person grievance and one‐quarter speak‐up. So, again, as the case manager, I had to meet with the individual, talk her through which bits looked like allegations of wrongdoing and which looked like being a personal grievance, and we split it and it went down the two directions.

Concerns about a potential wrongdoing are passed on to the leadership team owner for investigation. Complex cases can be directly referred to the group internal auditor and the head of the special investigations unit. In intricate cases, the investigator sets out terms of reference, which identifies the parties to be involved in the investigation.

Meanwhile, the voicing employee is offered HR support or is signposted to a whistleblowing charity if deemed necessary. A speak‐up operator emphasises this aspect as one of the strengths of their current arrangement:

We have a very strong protocol around protecting the individual by checking their comfort levels, (…) supporting them. So keeping a very distinct split between the case manager, who typically will probably be someone in HR and the investigator. Having very, very clear divisions of responsibility.

When the investigation is complete, the resulting report is presented to the head of HR strategy and planning and the voicing employee is informed. As can be inferred from this summary, responsiveness is standardized and embedded in the policy document. Speak‐up operators communicate with the voicing employee and keep them informed throughout the process. However, a speak‐up operator noted during the interview:

We don't necessarily have a touch point three months after the closure and six months after the closure and that's only just occurred to me as I'm speaking. So maybe it's something I need to look at in terms of checking back in.

Speak‐up operators try to provide anonymity for the voicing employee but may have to lift it to further the investigation as one of them explains:

If the reporter is required to be involved in the investigation, obviously the anonymity has to be lifted. But we would always lift the anonymity on a very limited basis. So it would be lifted for the investigator and depending on the nature of the complaint.

An HR officer supports this statement:

So my understanding is that they can remain anonymous unless it becomes, I suppose, impossible to investigate it without making you aware of who the individual is.

She also adds that the employee is informed before lifting anonymity:

I know we have had one case where it was alluded there was a speak‐up issue attached to it. And we had to—the speak‐up operator, I think, was involved—she had to write the individual to say, ‘Look, for us to progress this it will involve us passing it over to the work force performance team. Therefore they will know your name…'

Risk of retaliation is also addressed in the whistleblowing policy and the voicing employees are assured that they are protected. Nevertheless, the policy notes that a voicing employee may be disciplined if the investigation concludes that his/her claim could not be supported by evidence and was found to be malicious. The head of special investigations says:

I think the bank protects you as much as it can, but at the same time I think under legislation—and I may be wrong here—I don't think there's an overall covering under the legislation. I may be wrong. But the bank, if your claim is not malicious, the bank will protect you against any kind of discipline or anything like that, or any reprisals from senior management, or anybody making—which is a disciplinary action in itself, if people are coming and attacking you, anyway.

We should also note that the speak‐up mechanism is designed for, and advertised to, current staff members. If received, concerns from customers and former staff members are also considered but are not recorded as speak‐up events. These are subject to a different set of legislation and a separate code of conduct. Thereby, such concerns go through a different procedure.

The person leading the internal investigation states that the average number of cases they deal with at any one time is six and they have handled about sixty cases in the last two years. However, not all of these were classified and recorded as speak‐up events. In fact, speak‐up events accounted for a fraction of these cases. In the month that preceded our interview, for example, the special investigations unit worked on two speak‐up cases. They usually receive less than one per month, and one‐third or one‐fourth of these do not fall under the category of speak‐up as defined by the organization. The speak‐up operator expressed his worry about the low number of speak‐up calls and mentioned an ongoing debate in the organization about how to interpret it. To inform the debate, they have begun consultations with employees who could potentially refrain from disclosing wrongdoing.

If the take‐up is low, the most likely reasons are low levels of trust in the speak‐up arrangements or insufficient advertisement. Thereby, the speak‐up operator explains, the bank has recently focused their efforts on increasing trust:

We have been trying to become, to build a culture which is much more adult‐to‐adult than the patriarchal culture that used to exist in the classic financial services. So (…) our code of conduct (…) explicitly calls out, ‘If you breach policies, you may be subject to disciplinary procedures up to and including dismissal’. So we tend to be a little bit more black and white where speak‐up is concerned.

Clear communication of policies is important for both creating trust and advertising the speak‐up arrangement. At this bank, there are several avenues through which information about speak‐up arrangements is disseminated. As mentioned before, the first one is the code of conduct itself, on which all staff is trained. There are about ten compliance and ethics courses that staff members have to complete every year. These courses encourage employees to raise their concerns and provide information about the speak‐up channels. Although the organization does not measure the effectiveness of this method, the speak‐up operator was able to share some evidence of impact:

Just as an anecdote, in our branches our early morning training takes place on a Wednesday and a large proportion of branches (…) were doing early morning training last Wednesday morning. And at about ten to ten, when early morning training finishes, my phone rang with one speak‐up report and 20 minutes later it rang from somebody else with another speak‐up report. Now I hadn't picked it up in the first one but on the second one I said, ‘Why did you raise this issue now?’ And the guy said, ‘We've just done the conflict of interest [compliance and ethics] course and the slide came up and a few of us’—it was this pricing query—‘a few of us afterwards were saying, “Maybe that's the way to raise this worry”’.

In addition to these measures, the top management circulates information emails, which may sometimes provide details about the speak‐up arrangements.

Key Learning

This bank shows some of the best practices in speak‐up arrangement design and operation.⁷⁵

1. It offers a variety of speak‐up channels: the line manager (informal), internally operated hotline, dedicated email account, key persons, and external advice channel. This provides increased accessibility as well as meeting different needs.⁷⁶
2. Different functions are involved in operation of speak‐up arrangements with clear protocols. For example, the HR provides necessary support to the voicing employee, while the compliance function carries out the investigation. This prevents speak‐up operators from finding themselves in dual dependencies. It also makes best use of each function's expertise.
3. Although the organization has separate arrangements for speak‐up, grievance and customer complaints, no concern is turned down for being raised through the wrong channel. Instead, they are signposted to the relevant function.
4. Responsiveness is embedded in the speak‐up process and formalised in the speak‐up policy.
5. The external advice line gives employees the opportunity to receive support and guidance from an independent body. This not only facilitates effective whistleblowing but also increases trust.
6. All speak‐up events are documented.

Speak‐out in the Engineering Sector

Judging by the whistleblowing cases in recent history, we can argue that retaliation against whistleblowers is a common occurrence in the engineering sector.¹⁰² In the last few years, several allegations of victimising employees for externally raising concerns about illegal conduct have been made against engineering firms.¹⁰³ The problem was so widespread that researchers have advised engineers to find a new job before blowing the whistle, and discuss their intentions to speak‐up with the new employer.¹⁰⁴ As is well known, the prevalence of retaliation creates a culture of silence. IEEE fellow and computer science professor Stephen H. Unger says:

I hate the term whistle‐blower. It conveys the wrong impression, of someone running around, being noisy and disruptive, behaving in an erratic way. Which is the very opposite of all the engineer whistle‐blowers I'm aware of. They did everything they could to avoid publicity, to avoid making waves. Engineers are very quiet people.¹⁰⁵

Employees from a variety of sectors face similar circumstances and may be caught between their conscience and the desire to protect themselves from harm when they witness wrongdoing. However, engineers carry a greater responsibility towards the public as the projects they are involved in can cause harm to large numbers of people, animals and the environment.

The first engineering codes of ethics from early twentieth century featured protection of clients' and employers' interests only,¹⁰⁶ leaving out the public interest, workers' health and safety, and protection of the environment. However, the engineering profession's potential to cause harm on a great scale if work is not done properly has led professional bodies and ethicists to include safety, health and welfare of the public among engineers' responsibilities as the profession developed.¹⁰⁷ Today, engineers are often bound by law, professional standards or ethics codes to protect all of these.¹⁰⁸ This means whistleblowing for many is a double‐edged sword, in terms of not only the inner conflicts they may experience but also the ‘dual dependencies’¹⁰⁹ they may find themselves in. Dual dependencies occur when individuals have simultaneous responsibilities to competing interests. In the example of engineers who witness wrongdoing that they are required by law to report, they may face victimisation for exposing wrongdoing or for being complicit if a colleague breaks the silence, but may also suffer penalties if a catastrophe exposes the truth. Whistleblower protection legislation and effective speak‐up arrangements are crucial for engineering‐firm employees, especially engineers, in order to prevent appropriate dependencies from being compromised.¹¹⁰

One of the earliest and most published examples of a catastrophe in modern engineering history that could have been prevented if effective speak‐up arrangements had been in place is the Challenger disaster.¹¹¹ On 28 January 1986, a space shuttle exploded over Florida, in the United States, seconds after its launch and killed seven crew members.¹¹² Morton Thiolkol Inc., NASA's subcontractor that manufactured the booster rocket for the Challenger, was warned by one of its engineers, Roger Boisjoly, about a potential O‐ring failure under cold temperatures six months before the explosion.¹¹³ On the day of the launch, the team of engineers working for the firm tried again to convince their managers to delay due to weather conditions to no avail.¹¹⁴ In the aftermath, Boisjoly provided his testimony to the Presidential Commission investigating the event and made public the memo in which he alerted his superiors to the risks.¹¹⁵ Although he had not raised his concerns with the regulators prior to the disaster, he is well known as a whistleblower for exposing how Morton Thiolkol managers neglected health and safety warnings. Although he was later celebrated for his courageous and ethical conduct, he personally paid a very high price. He was isolated by his colleagues and managers, as a result of which his mental and physical health deteriorated to the extent that he could no longer work.¹¹⁶ His experience exemplifies a failure to investigate concerns, retaliation against and social isolation of voicing employees, all of which are among the primary reasons for the prevalence of a culture of silence and secrecy, as was discussed in the previous section.

Whistleblowing legislation and speak‐up arrangements in the engineering sector have been gradually improving since the Challenger disaster.¹¹⁷ This progress is evidenced in some recent victories of whistleblowers in legal battles against retaliation.¹¹⁸ Implementation of speak‐up arrangements, especially hotlines, has steadily increased since 1995 according to Institute of Business Ethics' (IBE) 2016 survey with FTSE 350 companies—among which are engineering firms from mining, oil, industrial, electronic, software, IT, construction and pharmaceutical sectors.¹¹⁹ The prevalence of speak‐up arrangements vary among engineering subsectors, but comprehensive data in this area is not available. We know, for example, that 67% of 163 defence companies from 47 countries have at least one speak‐up channel, but only eight of these actively encourage reporting.¹²⁰ There are also external reporting systems operated by regulators such as the British Health and Safety Executive (HSE), Civil Aviation Authority (CAA), Maritime and Coastguard Agency (MCA), and Office of Rail and Road (ORR).¹²¹

Case in Focus

We researched a multinational engineering firm headquartered in Europe that has multiple subsectors including power generation and transmission, transport, and medical imaging. It operates in more than 200 countries and has more than 300,000 employees. It was caught up in a crisis in the mid‐2000s when regulators discovered that the company had a slush fund used by managers for bribery purposes. The scandal was extensively covered in the media and court cases were opened in several countries. In a few years, the top management and some middle managers were replaced, and billions were paid in legal settlements. Following the scandal, the company took firm steps towards strengthening its compliance function and creating a speak‐up arrangement: an audit organization was created at the group level under the new CEO, a new board position was created, and the specialist compliance function grew tenfold. According to a legal counsel at its headquarters, a speak‐up arrangement was implemented as ‘an immediate action and reaction to the scandal’.

The arrangement is comprised of a question channel, key internal persons, an external hotline and an external ombudsperson. The question channel was crucial in the initial stages of implementing speak‐up arrangements. It helped inform the employees about the channels, explain their purpose and how they work, signpost voicing employees to the right channel or function, and so on. But the need for a question channel has gradually diminished, according to a legal counsel at the headquarters:

In the beginning, by building up this [the question channel] offer, it was very important that we have a very quick hotline, a very quick and a very centralized hotline like [the question channel], but the more we are developing our community of compliance, the more the importance of [the question channel] decreases.

Therefore, a regional compliance officer argues, currently the channel is less frequently used:

[The question channel] was more around—you know, [for] general questions. If someone was unsure about something within the compliances, they would use that. But that's less used now. […] The main one is really [the external hotline], just to speak up.

The external hotline was frequently used to raise concerns from the beginning. The Regional Compliance Officer continues:

I think what we've seen is that, in the early days when it first came into being, people were using it for everything. For any sort [of] issues that they had with the company, they would use it which is not what was intended. For example, the one I always use is, the car park lights in front of me weren't working one day. Some of the playing real estate department, they never did anything about it so they put it through [the hotline], which clogs up the system. That's one extreme.

This shows that organizational members went through a learning process in which the question channel and the hotline proved very useful. The types of issues one can raise and the channels best suited for the purpose were not immediately clear to the employees. But they collectively learned through these channels.

Concerns about wrongdoing are followed up by the compliance function, and grievances are handled by HR. The two functions work in coordination based on a protocol. All concerns received through available channels are filtered and signposted to designated functions. The compliance and HR work together on issues that fall within their remit if a concern has both grievance and wrongdoing components.

The hotline, as a speak‐up channel, is specifically for compliance purposes. The regional compliance officer recounts:

I think (…) that we had a lot of cases coming through [the hotline], which were more interesting cases, but they very much sat within the HR arena so, you know, bullying, victimization, those types of issues which still need to be looked at, but weren't really anti‐corruption, anti‐trust, those sort‐of pure compliance cases.

The hotline operators use a questionnaire to elicit information that helps categorise the information as grievance or compliance to make necessary referrals. Compliance‐related concerns are directed to the central compliance team at the headquarters. They also provide digital chat rooms for anonymous communication between voicing employees and company compliance officers. The legal counsel at the headquarters explains the speak‐up process as follows:

The user is guided through all of the process. Employees and external stakeholders can stay anonymous if they want to. We will never obtain any information about their identity if they do not want. Even the [external] provider does not gather such data in accordance with its internal policy to keep the data safely stored without any possibility to access it on their own.

If the operators need to pass on the concern, they inform the voicing employee, tell them to whom the concern will be passed on, and give them the option to opt out. The legal counsel continues:

The reporter also can decide if he or she wants to communicate [directly] with us or not. Therefore, he is able to decide if he wants to create a post‐box we can use to safely and anonymously communicate with him. If the whistle‐blower decides not to communicate with us anymore after bringing the report to us, this is fine as well. One of the new features is also that there is not a dialogue talking hotline, but a kind of voice intake where reporters can record their message on an automated system.

As he mentions here, the company was ‘conducting a trial in a number of countries with a telephone hotline that uses automated voice handling instead of “live” staffed call centre’¹²² at the time of our research. But, he also adds that some users were not comfortable with using this new technology:

In the last few months we have learned that for some user groups (…) this new system with an automated in‐voice reporting provokes some uneasiness. For [region], we have already changed it. We now have an external call centre especially for [region] where a dialogue with a person at the other end is possible.

While these innovations continue, according to the regional compliance officer, the demand for the hotline is shifting towards key internal persons (local compliance officers and regional managers) and external ombudsperson:

But in terms of usage, I would say, more recently, I've personally seen people perhaps coming more directly to the compliance office or even using the Ombudsman. Not actually using [the hotline], but the procedure. But that's my own personal feeling, where we've seen complaints coming through to my desk.

One could see this shift as a success of the speak‐up arrangements in building trust since the shift is from technologically supported anonymous channels to direct communication through informal channels, or, simply as transfer of trust from one channel to another.¹²³

The ombudsperson is one of the increasingly popular channels. This channel was also established after the scandal in the first decade of the twenty‐first century. The company makes a contract with a lawyer specialising in white‐collar crime, economic law or criminal law in general to act as its ombudsperson. They have worked with several different lawyers so far. According to the legal counsel:

The Ombudsman is a communication channel, an objective external channel to report violations, misconduct, et cetera. The investigation, the question how to handle this report, lies with us [the compliance function].

The role of the ombudsperson in the speak‐up system is to receive and signpost concerns to the compliance function or the management, to organize follow‐up activities, and to facilitate alternative dispute resolution.¹²⁴ S/he provides a confidential service to the voicing employee and aspires to neutrality. The legal counsel says:

For us, the ombudsman is also very valuable when we need to communicate with the reporter. For example, when the reporter says ‘I do not want to bring my identity to the knowledge of [the engineering company], and I want to stay anonymous’, then it's his right. The ombudsman only is a channel, as I said, and the ombudsman might know about the reporter's identity. Therefore, we have the possibility to communicate via the ombudsman with a reporter, even if he wants to stay anonymous. (…) This is an equal alternative. There is no hierarchy of channels.

In short, this engineering firm offers a variety of channels by which concerns are received. These filter the concerns about wrongdoing and pass them on to the compliance function. The executive documents and investigates these concerns.¹²⁵ The legal counsel explains the process:

We have an important tracking tool in which we are tracking all our incoming cases as soon as they are assessed to be compliance cases. Every compliance officer, but my department as well, especially when we have any [hotline] or Ombudsman income—can register cases within this tool. And then every case is permanently assigned an individual number. It is a highly relevant tracking item. When any compliance officer within [the engineering company], for example on local level, receives information about potential misconduct, he is obliged to enter his case—as long as it's a compliance case—in this tool. He can then, in accordance with internal protocols, send it either to us for central handling, or the case can be handled locally. However, every compliance case worldwide is centrally tracked in this tool, both those on local level and on central level. At central, we have the overview over all cases.

Protocols and procedures were developed in this firm to standardise the follow‐up activities. Once the investigation is complete, the person who raised the concern is informed. If they have used an anonymous channel and have not provided contact information, communication can become a problem both during and after the investigation.

The tracking tool mentioned in the preceding excerpt is useful also in collecting and aggregating data. The data collected in this manner is used for pattern recognition, risk analysis, and reporting.¹²⁶

The provision of compliance case figures formed part of the company core policy and served the promotion and continuous development of the compliance organization. After the crisis, our own management board position for Legal and Compliance was created. (…) it was part of his role in the management board to provide the company with all figures regarding compliance, and this includes all relevant factors like speak‐up arrangements, and the numbers with regards to investigations and disciplinary measures et cetera. I think, from that intense culture of internal transparency, but as well of pride concerning the effective first steps already taken the motivation arose to put the figures in the annual report. (The legal counsel)

The interviewees asserted that the management and shareholders have been very keen to analyse the speak‐up data, which provided internal transparency. The company also provides aggregated figures in its annual report. Although they believe reporting increased investors' and other stakeholders' trust, it has also posed some challenges. Because reporting speak‐up data is not yet standardised, their figures have been misinterpreted.¹²⁷

You cannot compare the incoming cases of one period, let's say one year or one quarter, with the disciplinary measures and the closing of the cases, because sometimes complex investigations take more than half a year or more than one year in total. Therefore, the numbers do mostly not refer to the same cases, they are just stating the in‐ and output of cases without saying anything about how much is still on‐going within the compliance organization. If we in one year have an incoming number of 100 cases and disciplinary measures in or closing of 60 cases, that does not mean we are only handling 60 of 100 cases. We may very well have 40 open cases which are passing on to the next quarter or the next year. (The legal counsel)

The company finds it rewarding to report on speak‐up data despite some misguided inquiries especially from the media:

By publishing, we promote transparency, demonstrating that the compliance system you've seen is alive and working, and that there are cases being investigated. (The legal counsel)

The speak‐up data reveals the uptake of the speak‐up arrangement and helps evaluate the behavioural patterns in use of various channels. Reportedly, in the second half of the 2000s after the scandal, a steady increase was observed in speak‐up events. The reports reached a peak in the 2010s with 740 compliance‐related reports received through the hotline worldwide. This was followed by a steady decrease up until 2015 when 300 speak‐up events were recorded. Currently, the numbers seem to be almost constant.

Key Learning

With its experience that spans over a decade, this engineering firm shows some of the best practices in speak‐up arrangement design and operation.¹²⁸

1. It offers a variety of speak‐up channels: the question channel, the externally operated hotline, internal key persons, and the ombudsperson. Each channel offers a different degree of independence and anonymity, thus meets a different need or attracts a different audience.¹²⁹
2. It involves more than one function in its speak‐up arrangements, which liaise through clear protocols. For example, HR and the compliance work together on cases with both grievance and wrongdoing aspects, while all alleged wrongdoing is investigated by the compliance function.
3. Although the organization has separate arrangements for speak‐up about wrongdoing and grievance, no concern is turned down for being raised through the wrong channel. Instead, they are signposted to the relevant function.
4. There is evidence of building trust through speak‐up arrangements.
5. Responsiveness is formalised through procedures and protocols.
6. There is an effort to standardise and coordinate responsiveness through a global expat strategy.¹³⁰
7. The external hotline and the external ombudsperson make it possible to raise concerns anonymously and provide confidentiality. This encourages employees to speak‐up without fear of reprisal.
8. All speak‐up events are documented.
9. Speak‐up data is used for risk monitoring and published in an annual report.
10. The web‐based channel and the hotline are offered in local languages of the regions where they operate. This increases accessibility.

Speak‐out in the NHS

Adopting new managerialism was part and parcel of the neoliberal transition in the NHS towards a consumerist model focused on efficiency, throughput and competition.¹⁴² The Griffiths Report, presented to the parliament in 1983, concluded that the NHS must be run like a private organization by hierarchically organized professional managers. Subsequent to acceptance of recommendations in the parliament, the NHS replaced district management team (DMT) structure with general management. The former was based on the principle of ‘management by consensus’, the latter is a top‐down management system.¹⁴³ This hierarchical structure, coupled with the complexity the NHS is known for, makes it difficult to navigate the speak‐up arrangements.¹⁴⁴

The interdependence of the many different elements of the NHS system adds to the complexity of this issue. Each part of the system has a continuing need for information about what is or may be going wrong and indeed on what is going well. The complexity is a potential barrier to important information being received and acted upon in the right places in the system.¹⁴⁵

Although the NHS is highly regulated, speak‐up pathways are not clear, standardised or overseen by a centralised authority.¹⁴⁶ There are several regulators with powers of inspection but coordination among these is reportedly insufficient.¹⁴⁷ There are gaps in follow‐up activities including support provision for whistleblowers.¹⁴⁸ The lack of consistency in speak‐up policies across NHS organizations as well as insufficient training for speak‐up operators and other employees act as a barrier to raising concerns.¹⁴⁹ The NHS is also criticised for its culture ‘in which reports of “success” are in constant demand and reports of “failure” are unwelcome’¹⁵⁰ due to fear of reputational damage and its political consequences. Therefore, middle managers often refrain from raising issues to their superiors.¹⁵¹ This has knock‐on effects such as silencing employees with concerns, retaliation against whistleblowers, and lower trust in speak‐up arrangements. The Francis Report, a review of speak‐up systems in the NHS in which more than 600 individuals from 43 organizations participated, found that:

Only 64% of NHS workers felt confident that their organization would address their concern. Not only do staff feel they are ignored, a significant number fear there will be consequences for them if they do speak up.¹⁵²

Despite these barriers, concerns related to wrongdoing are fairly frequently raised.

Around a third of the staff working in trusts (35.4%, n = 5020) and just under a quarter of the staff from primary care (21.6%, n = 945) reported having raised a concern about ‘suspected wrongdoing’ in the NHS.¹⁵³

Among trust staff who did not raise a concern, 17.9% cited lack of trust and 14.9% cited fear of retaliation as the reason for not doing so.¹⁵⁴ Among primary‐care staff, these figures were 7.5% and 10.4%, respectively. On the other hand, approximately a quarter of all NHS staff reported that they did not know about the speak‐up arrangements their organization put in place.¹⁵⁵

Lack of effective speak‐up arrangements in the healthcare sector can cost lives as the paediatric cardiac surgery scandal at Bristol Royal Infirmary (BRI) has shown. Soon after starting to work as a consultant anaesthetist at the paediatric cardiac surgery unit in 1989, Dr. Stephen Bolsin realised that the rates of infant deaths were significantly higher than the national average. In 1990 he wrote a letter to the chief executive of the trust about ‘excess deaths’¹⁵⁶ caused by substandard care, but his concerns were dismissed.¹⁵⁷ Dr. Bolsin continued to voice them through different channels. He spoke with his colleagues at the hospital who advised him to collect data that would provide the evidence base for his claims. He spent the next six years following the advice while also raising his concerns with other anaesthetists in Bristol, his hospital peer group from other specialties, the management of the University Hospitals Bristol NHS Foundation Trust (UBHT) and the Department of Health.¹⁵⁸ Unfortunately, none of these channels were effective and no follow‐up activities were organized until 1995 either to investigate or to provide him with support.

The clinicians in Bristol at least by 1990 had data on their own poor performance relative to that in other centres in the UK which could have caused them at least to pause and reflect. (…) An opportunity was not taken in July 1994 by an official of the Department of Health to investigate more closely the outcomes of PCS (paediatric cardiac surgery) in the under 1s. It was only in 1995 that PCS was formally stopped…¹⁵⁹

The public inquiry has concluded that around one‐third of the children who were operated on at the unit received less than adequate care in 1980s and 1990s.¹⁶⁰ As a result:

In the period from 1991 to 1995 between 30 and 35 more children under 1 died after open‐heart surgery in the Bristol Unit than might be expected had the Unit been typical of other PCS units in England at the time.¹⁶¹

The inquiry also emphasised that substandard care in BRI resulted from a combination of factors including understaffing, the state of buildings and of equipment, deficiency in the performance of staff members, a hierarchical management system which made it difficult to investigate senior members of staff, complexity of the organizational structure, gaps in regulatory oversight, and absence of effective speak‐up arrangements.¹⁶²

The paediatric cardiac surgery scandal and similar tragedies (e.g. the Mid Staffordshire scandal) demonstrated the need for effective speak‐up arrangements in the NHS to prevent wrongdoing and malpractice. Therefore, the 2000s have seen new governmental and civil initiatives to establish better speak‐up arrangements including:

1. Safety Escalation Team (SET): CQC, a prescribed person for the purposes of the 1996 Act,¹⁶³ established SET in 2012 to receive and follow‐up concerns from NHS, social care workers and members of the public.
2. Monitor: Monitor is the healthcare sector regulator in England and is a prescribed person for the purposes of the 1996 Act.
3. The NHS Trust Development Authority (NHS TDA): NHS TDA is a special health authority supporting NHS trusts in their efforts to obtain foundation trust status. In 2014, it has become a prescribed person for the purposes of the 1996 Act.
4. Professional Regulators: All professional regulators are prescribed persons for the purposes of the 1996 Act.
5. NHS Protect: This is a subdivision of the NHS Business Services Authority overseeing the speak‐up arrangement for concerns about fraud, bribery and corruption.
6. Speak‐up Charter: Launched by NHS Employers in 2012, the charter encourages organizations to develop their speak‐up arrangements.
7. Whistleblowing Helpline: Commissioned by the Department of Health, this is an advice line for healthcare workers. ¹⁶⁴
8. Freedom to Speak Up Guardians: All NHS Trusts have appointed a guardian whose role is to work with Trust leadership to ensure that there are processes in place to facilitate and support staff who want to speak up about issues, and that these processes are effective and continuously improved.
9. National Guardian's Office: The CQC set up this office to assist Guardians in all of the trusts by providing leadership, training and advice for Freedom to Speak Up Guardians. Its role is to also challenge and provide learning and support to the healthcare system as a whole by reviewing trusts' speaking up cultures and the handling of concerns where they have not followed good practice.

While having these speak‐up mechanisms is positive in essence, there is a need for addressing gaps, better coordination, clear definition of the remit of each organization and better communication of pathways for raising concerns.¹⁶⁵ It is also important to reach consistency in speak‐up arrangements across NHS organizations including trusts in order to prevent problems that employees face when they move from one to another.¹⁶⁶ Research has shown that about 20% of trusts do not have a speak‐up policy.¹⁶⁷ Among those who have speak‐up policies and procedures, formal and independent channels are a rarity (for example, only 19.5% have a hotline and less than half of these are external).¹⁶⁸ Also, speak‐up training is provided only in 57% of trusts to managers and only in 31% of trusts to potential users.¹⁶⁹ These figures suggest that the NHS is still far from best practice in speak‐up design.

Case in Focus

We researched a hospital with NHS trust status, located in the Northwest of England. It treats more than 200,000 patients per year and has a workforce of almost 3,000. The trust has had a whistleblowing policy and informal channels at least since the first half of the 2000s. In the early 2010s, it found itself in the middle of a media storm when a number of employees and patients blew the whistle to regulators and the media. Mostly by a former staff member, patient safety concerns were continuously raised to external parties for the next half a decade. The hospital had gone through an internal review process, an invited review process by a royal college, and unannounced inspections by the CQC. At the same time, some staff members were reported to General Medical Council. The trust spent a considerable amount of resources on responding to allegations, while staff morale, especially among middle managers, plummeted.

Those guys at one point I think felt quite ‐the management team in [department] felt quite beleaguered really because obviously we'd had historical whistleblowers (…) who didn't use the policy but Public Interest Disclosure process. They and their associates have repeatedly raised concerns with CQC and Monitor, and currently there is one. A concern has been raised again to CQC—same issues, historical stuff but it's by a journalist. Clearly it's a journalist working alongside one of these individuals, at least. So it has felt to them quite relentless, I think, in that team.

Although the trust believes the allegations were inflated by grievances and to some extent malicious, the management thought the time scales within which they have responded to concerns and their quality of communication was not good enough in these instances. Hence, they decided to review their speak‐up arrangements. These reviews coincided with the publication of the Francis Report, which outlined recommendations for NHS organizations. Following these guidelines, the trust implemented new formal speak‐up channels including a hotline. The HR director explains the background to reviewing the arrangement as follows:

I would say we've really ramped this [the review] up in the last 12 months, and that's partly due to some of the experiences that we've had around the whistleblowing agenda really and partly to do with, because we did see a sort of rise in individuals going externally to CQC as a first port of call, not really talking to anybody internally in a couple of cases.

Concerned with employers directly voicing their concerns with regulators and the media, the trust introduced a new whistleblowing policy that aims to strengthen its internal speak‐up mechanisms. The policy applies to employees who are entitled to ‘protected disclosure’ under law, while there are other mechanisms such as the complaints policy for patients and other stakeholders. At the time of this research, their arrangement comprised of multiple channels with varying levels of confidentiality, independence and communication interfaces.

The policy sets out a three‐channel internal speak‐up mechanism and advises the employees to exhaust these channels before externally whistleblowing. The first step identifies line managers and lead clinicians as an informal channel. If the staff feels they can't raise their concerns with these managers or their concerns are not resolved at this level, they are advised to approach an appropriate senior manager (e.g. HR or finance manager) or a manager from another department as a second step. The third step is to approach the trust's senior independent director, who is the whistleblowing champion, if the staff feels previous steps are not effective. The clinical director explains the escalation process as follows:

They [voicing employees] will feel that that issue hasn't been addressed. Now, sometimes they're right. Sometimes it hasn't, in that there's only so many hours in the day. But I think having the escalation process helps bring some focus to those issues, when people feel they haven't been listened to. The sort of issues that get escalated are quite broad issues. An example at the moment is one of our anaesthetists feels that anaesthesia isn't given enough prominence in the hospital. And that's a really broad concept, and in personal discussions, and in written responses to that individual, I've both tried to address the concerns and responded. But even so, there is still a perception on that individual's part that they've still not got special prominence. So that's gone up through the escalation methodology.

In addition to the informal channels, there is an internal hotline, secure ‘post boxes’ for written concerns, and the option to write a letter directly to the chief executive. Concerns related to fraud, bribery and corruption can be raised directly with the trust's local counter fraud specialist (LCFS) and/or the trust's Director of Finance (DOF), bypassing line management. While formal channels are in place, the HR director believes that ‘the culture of [the trust] can be categorized as often being quite an informal one in terms of structures and so on.’¹⁷⁰ The chief executive, for example, has an open‐door policy according to the HR director:

She does see a lot of consultants. She receives a lot of emails from consultants, but this [whistleblowing policy] has basically crystallized all of that and put it into a framework.

Although there are designated channels for different types of concerns, voicing employees are not turned down if they chose the wrong pathway. The whistleblowing policy is seen as part of a broader system of voicing and monitoring concerns that includes the complaints policy, the serious incident policy, the grievance policy and more. The HR director explains the approach they try to establish in the organization:

What we're trying to work towards at the moment is not—we don't want to force people down certain routes, but what we've been trying to do over the last few months particularly is just to raise awareness of ‘There are a number of ways that and, if you've got a concern, please don't be quiet about it. Please go and speak to somebody.’ And there's a whole plethora of ways of doing that. (…) Providing people with an outlet—bringing these things out in the open, it doesn't really matter what channel they go through particularly.

All concerns formally raised under the whistleblowing policy are logged, and the follow‐up activities and the outcomes are documented in a central repository. When concerns are raised with persons identified in the policy, they are responsible to respond and organize follow‐up activities. If concerns are received through the hotline, which is operated by the HR function, they are assessed and reallocated to people who can potentially resolve the matter. Depending on the judgement of the speak‐up operator, this may be followed by an informal review, a more formal investigation or an internal inquiry.

Response is formalised in the policy document and includes continuous feedback to the voicing employee until the closure of the case but is subject to usual legal limitations on details of investigations. The clinical director emphasises his efforts to respond in a timely fashion:

I document, and I will basically never leave something like that unanswered because I have to. I know that it's my responsibility as clinical director to respond to those issues, and I try and do it the same day. The more difficult ones are things where there's evidence to be gathered and things like that.

In line with best practice, where possible, voicing employees are included in the process of addressing problems they have identified. The HR director shares an example:

So within that group of people that ultimately, that led the approach to CQC, one of the group, what's the best expression to use for it? Well certainly, he might say he ‘outed’ himself as the whistleblower because he has said that phrase. Then he could see the Trust board were wanting to do something. He started to work with the Director of [department name] and he's subsequently led the improvement work that's going on.

The hotline makes it possible to raise concerns anonymously or confidentially.¹⁷¹ However, anonymity may hinder the investigation, act as a barrier to responsiveness or the voicing employee's identity may be guessed by colleagues or those involved in the wrongdoing.¹⁷² The policy explicitly addresses this problem and recommends voicing employees to seek advice if they are concerned about confidentiality. To tackle victimisation, the trust offers emotional and legal support to voicing employees through the Speak‐Up Guardian, mentors (for students) and the HR department as well as disciplining those who retaliate. The policy document asserts that the senior independent director, in his/her capacity as the speak‐up guardian, should ‘check up on the welfare of whistleblowers at mutually agreed regular intervals during and after the process’¹⁷³ and that HR will provide information and advice about how to make a protected disclosure.

In addition to these internal mechanisms, the policy document provides information about independent third parties that offer advice to whistleblowers, such as trade unions, regulatory and professional bodies, the NHS and Social Care Whistleblowing Helpline, PCAW, and solicitors. It also lists the external speak‐up channels such as SET and Monitor while strongly encouraging staff to exhaust internal mechanisms before external whistleblowing.¹⁷⁴

The effectiveness of the speak‐up arrangement is assessed through periodic audits. If the speak‐up operators are found not to comply with the policy, an action plan is implemented by the audit committee. This committee is also responsible for annually reviewing the whistleblowing policy. If necessary, revisions are made in order to reflect changes in speak‐up cultures and the most recent developments in whistleblowing legislation.

The HR director is responsible for implementing and disseminating the policy. The staff is informed about the policy primarily through the intranet. They also organized a campaign to advertise the speak‐up arrangement as part of which the voicing employees are celebrated and the response they receive is shared. Making the response visible, to the extent that legal regulations allow, is part of the trust's strategy to increase trust and engagement.

The speak‐up arrangement is also used as a supplement to existing tools that measure attitudes to patient safety and staff engagement. The HR manager says:

I mean if we saw a pattern of similar kinds of concerns being raised consistently from one particular area of the business, then I think obviously we would intervene at that point.

Although a multiplicity of channels have been in place, concerns have been predominantly raised with line managers and external regulators until the recent campaign. According to the HR director, the formal policy has been invoked once or twice in the year preceding the policy review that introduced a hotline. However, the clinical director receives multiple concerns on a daily basis:

Basically, every day I have probably between five and ten interactions that could be described as a whistle‐blowing disclosure to me, in that whenever anybody raises a concern to do with service provision or performance or any aspect of that, that is a disclosure as far as I'm concerned. And it's my ability to respond to those things which stops any higher process being invoked.

Key Learning

Having taken lessons from the build‐up to the scandal, this NHS trust displays some of the best practices in speak‐up arrangement design and operation.¹⁷⁵

1. It offers a variety of speak‐up channels: Informal channels (line managers and lead clinicians), the question channel, key internal persons (the whistleblowing champion, the HR director), an internal hotline and external independent advice (trade unions, regulatory and professional bodies, the NHS and Social Care Whistleblowing Helpline, PCAW). Although greater emphasis is put on informal channels in the policy, and these are more popular among staff, channels with varying degrees of formality, independence and anonymity are available.
2. It involves more than one function in its speak‐up arrangements. Whereas the HR and the board focus mainly on employment and patient safety issues, the trust local counter fraud specialist and the finance department respond to concerns about fraud, bribery, and corruption.
3. Speak‐up data is used to increase trust in the speak‐up arrangement.
4. Although the trust has separate arrangements for speak‐up for patient‐safety issues, grievances, and wrongdoing, no concern is turned down for being raised through the wrong channel. Instead, they are redirected to the designated channel.
5. Responsiveness is formalised through the whistleblowing policy.
6. There is awareness of the barriers to responsiveness such as anonymity and legal limitations and strategies are developed to circumvent them.
7. The trust works towards standardising and coordinating responsiveness across management. The policy registers managers' duties to respond promptly and appropriately.
8. The whistleblowing resource on the intranet provides information about the types of support offered by and ways to contact independent third parties.
9. Speak‐up events received through the formal channels are registered in a central repository.
10. The speak‐up data is used to monitor attitudes to patient safety and staff engagement.