A Channel Is Not a Culture: Reviewing Speak-Up Arrangements Across a UK Group

A group board can point to a single whistleblowing number, a web form and a policy signed by the chief executive. None of those things proves that a concerned employee in a subsidiary can raise an issue, be heard, and be protected afterwards. The central channel is a service. Assurance is a different question: does every part of the group connect to it, and does every connection lead to a competent owner and a safe outcome?

For UK groups, the distinction matters. The Public Interest Disclosure Act 1998 gives protection to workers who make qualifying disclosures, and the Employment Rights Act 1996 provides the wider framework against detriment. Where the group includes regulated firms, the Financial Conduct Authority's whistleblowing rules and the Senior Managers and Certification Regime may add further expectations. A group-wide policy can set a standard, but it cannot substitute for evidence that the standard operates in each entity.

The assurance gap beneath a single line

A single front door has obvious merits. It gives workers an alternative to a local manager, creates a consistent record and allows the centre to see patterns. But a board should not confuse central intake with group-wide effectiveness. The relevant tests sit closer to the edge of the organisation: can an agency worker in a distribution subsidiary find the route; does a site manager know what to do with a concern about a colleague; is a complaint about a local finance director investigated by someone with genuine independence; and would a complainant be treated fairly six months later?

A review should therefore be subsidiary by subsidiary, not a reading of the group policy. The aim is not to centralise investigations or to second-guess local leadership. It is to establish that the group's stated standard is reachable, understood and applied, and that the board receives enough aggregate information to exercise stewardship without intruding into individual cases.

Access: test from the edge, not the centre

Access is not simply whether a telephone number exists. Boards should ask whether the route is visible where people actually work. Is the number on the intranet that employees use, or only on a group website they may never visit? Is it included in contracts, onboarding materials and agency worker information? Are there arrangements for workers whose first language is not English, or who do not routinely use a computer? Can someone raise a concern outside normal office hours?

Local managers should be able to answer a simple question: if a member of your team raised a concern today, where would they find the route, and what would you do next? The answer should not be a recitation of policy. It should describe a practical sequence. A periodic walk-through with managers and employee representatives can test that sequence without turning the review into an investigation.

Ownership: who holds the file?

Central intake does not mean central investigation. A group should define who owns each broad category of concern: local human resources, group legal, internal audit, the audit committee or an external investigator. The ownership map should also identify conflicts. A concern about a local finance director should not be investigated by that director's own team. A concern about a subsidiary's managing director may need to move to the group or to an external party.

The board does not need to see every file. It does need to know that the map exists, that local managers understand the hand-off, and that the centre triages without supplanting local accountability. Where a case is escalated, the reason should be recorded. Where a case remains local, the group should still be able to confirm that it was handled within the stated standard.

Non-retaliation: more than a policy sentence

Non-retaliation is the condition that makes a speak-up system credible. A policy that prohibits detriment is necessary but insufficient. The review should test whether complainants are told what will happen, whether confidentiality is explained and maintained where possible, and whether someone checks on their treatment after the case closes. Managers should be trained to recognise that a change in shift patterns, exclusion from meetings or a sudden performance review can amount to detriment.

Boards can ask for aggregate indicators without seeing identities: how many complainants remained employed twelve months after raising a concern; how many cases resulted in a management action; how many included a complaint about treatment following disclosure. These are not conclusive measures, but they are more informative than a policy statement. Legal review should also confirm that confidentiality clauses and settlement agreements do not inadvertently cut across protected disclosures.

Themes: aggregate insight without local intrusion

Theme reporting is where a group board can add real value without overreaching. The centre should report by entity, category, timeliness, outcome and repeat issue. The board should be able to see whether concerns are rising in one subsidiary, whether certain categories are closed unusually quickly, and whether particular locations are oddly absent from the data.

The discipline is to read the pattern, not the person. Local leadership should own the response to local themes. The group should set the reporting standard, challenge weak data and ensure that lessons are shared where appropriate. That is stewardship: a common framework, local ownership and board visibility at the right level of abstraction.

A practical review sequence

A board-level review can follow a modest sequence. First, confirm scope: which entities, which worker groups and which routes are in scope. Second, collect the artefacts: policy, access map, ownership matrix, case timeliness data and non-retaliation monitoring arrangements. Third, conduct local walk-throughs with managers and employee representatives. Fourth, test a sample of cases for process, conflict management and communication, not for the merits of the original concern. Fifth, review aggregate indicators and theme reporting. Finally, agree an action plan with named local owners and a group-level standard.

Questions for local managers

• Where would a worker find the speak-up route without asking you?
• What would you do in the first twenty-four hours after receiving a concern?
• Which concerns must leave the subsidiary, and who decides?
• How would you ensure a complainant is not treated less favourably afterwards?
• What local patterns have you seen in the last year, and what changed as a result?
• Do agency workers and contractors have the same practical access as employees?

Questions for board members

• Can we evidence access in every material subsidiary, not merely at group level?
• Is investigation ownership clear where local conflicts exist?
• Do we receive timeliness and outcome data, or only case counts?
• How do we know non-retaliation is monitored rather than assumed?
• Are themes reported in a way that informs strategy without identifying individuals?
• Does our group standard leave room for local accountability, or has the centre become the default owner of every difficult case?

A single front door is sensible. Assurance depends on what happens in the corridors behind it. For a UK group board, the task is to keep the door visible, the ownership clear and the reporting honest, while allowing local entities to remain accountable for the culture they manage.