The Unclaimed Whistle: Making Group Speak-Up Routes Accountable Across Every Entity

A group can publish a speak-up policy, promote a hotline and train its managers. Yet the most revealing test is not the policy document. It is what happens when an allegation about the managing director of one operating company lands in the parent company's inbox on a Friday afternoon. Who acknowledges it? Which entity investigates? Who decides whether the subject is too close to the channel? And what does the board actually see three months later?

For UK groups with six or seven operating companies, whistleblowing is often less a cultural problem than a routing and accountability problem. The policy exists. The channel exists. The weakness sits in the handover between entities, where employment, line management, investigation resource and board oversight do not naturally align.

Start with the reporter, not the org chart

A speak-up route should not require the reporter to understand the group structure. Workers are protected under the Public Interest Disclosure Act 1998 when they make qualifying disclosures, and the group should avoid designing a process that makes protection depend on which entity signs the payroll. The intake route can be group-wide, but the record should capture the employing entity, the location, the entity or individual concerned and the reporter's relationship to the subject.

This matters because the reporter may be employed by one company, managed by another and raising a concern about a third. A policy that says "report to your line manager" is therefore not a group-wide channel; it is a local route with a group logo. A confidential route should be available alongside line management, with a clear statement that the reporter does not need to decide which company is responsible before raising a concern.

For regulated firms, the Financial Conduct Authority and Prudential Regulation Authority whistleblowing rules require internal arrangements that support workers in raising concerns. For listed groups, the UK Corporate Governance Code expects the audit committee to review the effectiveness of whistleblowing arrangements. Unregulated private groups are not exempt from the underlying governance question: can the board evidence that reasonable steps were taken when a concern is raised?

The handover is the control

A group channel needs a named owner. In practice, that means a group speak-up coordinator with sufficient seniority to direct an enquiry, not simply an inbox monitored by a shared services team. The coordinator should not sit in the line of the subject and should have a pre-agreed route to the company secretary, audit committee chair or a nominated non-executive director.

A simple triage standard helps. Every disclosure should be logged within one working day and assessed against a decision matrix. If the subject is an operating company manager, the case should ordinarily be investigated at group level or by an independent investigator, not by the subsidiary's HR team. If the subject is a group executive, the case should be escalated to the audit committee chair. If the subject is a board member, an external investigator should be appointed under a scope agreed by the non-conflicted directors.

The coordinator should acknowledge receipt within a defined period, normally five working days, and explain the next steps without promising a particular outcome. Where a concern is not taken forward, the reason should be recorded and, where appropriate, communicated to the reporter. Silence is not a control.

Quarantine conflicts rather than hoping to avoid them

Conflict is most likely when the channel sits close to the subject. A subsidiary HR director may report to the very managing director who is the subject of an allegation. A finance controller may be asked to review expenses relating to the finance director. A company secretary may be line-managed by the group general counsel whose conduct is in question.

The answer is not to rely on individual good judgement in the moment. The group should maintain a conflict matrix that identifies, in advance, who can act as case owner, investigator and reviewer for each senior role. Independence declarations should be signed at the start of every case. Where the conflict cannot be managed internally, an external investigator should be appointed from a pre-approved panel with an agreed fee authority.

Cost allocation should not determine independence. A group recharge mechanism can ensure the entity concerned bears the cost without giving its management control over the investigation. The audit committee should approve the panel and the budget framework annually.

What the board should see

The board does not need raw allegations. It needs assurance that the system is working. A quarterly reporting pack should include the number of disclosures received by entity and route, the categories of concern, acknowledgement and investigation timeliness, outcomes, cases escalated to the audit committee, conflict declarations, external investigator appointments and any policy or control changes prompted by cases.

The pack should also identify cases where the subject sat close to the channel and explain how independence was preserved. Trends matter more than individual stories, but the audit committee should receive anonymised summaries of significant cases and the corrective action taken. The company secretary should retain board minutes that show the review took place and that actions were assigned.

Evidencing reasonable steps

Regulators, courts and counterparties may ask whether the group took reasonable steps to prevent or address wrongdoing. The evidence is not the hotline number on a website. It is the policy version control, training completion records, promotion of the channel, triage logs, conflict declarations, investigation scopes, outcome letters, board minutes and follow-up actions.

Data protection also needs to be built in rather than bolted on. The group should explain what confidentiality means in practice, collect only the information needed, restrict access to the case file and set retention periods. Reporters should not be promised absolute anonymity where the group cannot deliver it.

A practical checklist for finance, HR and company secretarial teams

• Adopt one group policy with entity-level annexes setting out the local HR lead, nominated case owner and escalation route.
• Name a group speak-up coordinator with authority to commission investigations across entities.
• Agree a conflict matrix for senior roles before a case arises.
• Pre-approve an external investigator panel and a fee authority.
• Use a single intake record that captures employing entity, subject entity and relationship to the subject.
• Set service standards for acknowledgement, triage and investigation updates.
• Report a quarterly dashboard to the audit committee, including independence and timeliness metrics.
• Test the route annually with a mock allegation involving a subsidiary managing director.
• Record lessons learned and confirm that corrective actions have been completed.

The test of a group speak-up framework is not how many concerns are reported. It is whether a concern about any entity can reach the right owner without the reporter having to navigate the group structure alone. Groups should test that route before they need it, because the Friday afternoon allegation will not wait for the org chart to be redrawn.