Investigating complaints of protected disclosures (whistleblowing) are trickier and riskier than ‘ordinary’ workplace investigations. They use many of the same skills but there are several potential traps, such as those concerning the anonymity of the whistleblower, and the cost of getting it wrong could be sizeable – interim relief that could mean the continuation of the contract of a dismissed worker, an unlimited award of compensation, automatic unfair dismissal and joint and several liability, so that individual managers could be fined, as well as the employer. And that’s before we start on the damaging publicity that could result from a whistleblowing claim.

Liam Ennis is an expert in whistleblowing and their investigation.

In this webinar recording, Liam discusses what makes investigating protected disclosures so dangerous and how you might minimise the risks to you, your workers and your organisation.

Note: Last year, Andrew Spratt from A&L Goodbody gave us a short introduction video (with transcription) on Whistleblowing Legislation in Northern Ireland.

Transcription

Scott: Good morning, everybody, this is Scott Alexander. I'm from Legal Island. Today our guest is Liam Ennis, who's the founder and director of The Debrief Group, an organisation focussed on the delivery of professional and transparent investigations. We're going to be looking at some of the differences between investigations where whistleblowing is involved, Public Interest Disclosure claims, and I suppose ordinary investigations.

Liam has over 30 years of policing experience. He's investigated some of the most complex and serious of crimes. As a Detective Superintendent, his skills and expertise in this field have been recognised and commended by national and international law enforcement agencies, including the FBI, PSNI, and An Garda Síochána.

Liam understands the real difficulties and fears victims and whistleblowers face when speaking out against wrongdoing and he's passionate in ensuring those charged with investigating such wrongdoings have the necessary skills and processes in place to conduct impartial and professional investigations. He also recognises, of course, the real difficulties faced by organisations in dealing with those complex and difficult areas of business. Liam developed the only recognised UK whistleblowing investigative management training course. We'll be chatting about that as well without it being a plug. The course is endorsed by, accredited by the Training Qualifications UK.

You'll see on your screen there's a little chat box. I have a series of questions here for Liam, but if you want to ask questions live, send them through the chat box and I will ask them anonymously of Liam. If you want to contact Liam afterwards, the details are on the slides that will come up, but its liamennis@thedebriefgroup.co.uk.

Skills for Investigating Whistleblowing Allegations ⚓︎

So Liam, I think it's fair to say that the whistleblowing investigations include all the basic skills required to conduct an everyday workplace investigation, but they also have a few more.

Liam: Yes, yes. In essence, it's a routine investigation plus in that you're dealing with an individual who is, by nature, vulnerable. They will more than likely have passed information on via in person or anonymously to an employer. And they will be, in essence, telling tales on their colleagues, so they are vulnerable. They'll be in a bad place. They'll be under enormous amounts of stress and they may not want to be there at all, to be brutally frank.

The Public Interest Disclosure (Northern Ireland) Order 1998 places a certain number of requirements on employers over and above what a routine investigation would be. And I have to say that clear policies and procedures, just to publish information about whistleblowing, to have to be able to explain to the whistleblower what their expectations are. There are certain requirements for the whistleblower.

They must ensure confidentiality. In other words, unless a good reason applies, the whistleblower should not be identified. They must be able to deal with anonymous information. And in my opinion, that should be able to assess the anonymous information, store the anonymous information, and keep abreast of reports by individuals who are reporting things anonymously, which I don't believe is done. And a prescribed person should be able to write feedback to the whistleblower, if possible, providing that not anonymous obviously. But that should be made clear in company policies and procedures, so that there is a lot more than just your normal investigation.

Process/Stages for Investigating Whistleblowing Allegations ⚓︎

Scott: And I suppose you've set out a kind of process that you'd normally go through when it's dealing with whistleblowing claims rather than ordinary grievances.

Liam: Yes.

Scott: So not the kind of thing where Liam and Scott are having an argument at work, so Liam was maybe saying Scott is up to no good. He's breaching some kind of statute.

Liam: Yes, absolutely. And the process, and it's really important in that just there are only five stages to it, which are:

Stage 1: Your initial report from the whistleblower, is that overt to covert, is it anonymous?

Stage 2: Your first contact. How are you going to meet the whistleblower? Is it going to be a solicited approach or has someone complained about something and you're, as a result of that, going to speak to the whistleblower?

Stage 3: You speak to the whistleblower, his or her self, and find out what they have to say. I would call that a scoping. And you get enough information from the individual to allow your management team to make an informed decision as to the relevance of the allegation. Is it a whistleblowing allegation? Has the whistleblower the mental capacity to stand up to the rigours of giving evidence, if you like, or giving intelligence, or making allegations against their fellow workers?

Stage 4: And then if you decide to do, to go to the next stage, the actual investigation, is who's going to manage this? Do the people that are doing the investigation, do they know the individual? If so, should they even be involved in the investigation? Is it of such a nature that you may want to put the investigation out to a different department or right to another agency? Are you going to pass it to law enforcement? Are you going to keep it in-house? These are issues that must be looked into at the start.

Stage 5: At the end of the investigation, is what lessons have we learned here? How are we going to review it? Are there disclosure issues here? Is there a media? Are there costs to all this? So there is a lot that needs to be done as part of the investigation, and having a process with stages in it that everybody makes decisions around and risks assess, this is the secret of the proper investigation.

Scott: Yes, and it's to do with employees. I don't suppose we really emphasised that at the start, but it is. If you take a fairly famous case in Northern Ireland, of the Lee and Ashers gay cake case, Mr. Lee, who didn't get his cake and took a claim, wasn't blowing the whistle as such because he wasn't an employee. Had it been an employee complaining about the McArthurs not providing cakes, on an individual basis it might not matter. But if they were arguing it was a breach of equality legislation by their employer that could qualify as a whistleblowing claim.

Liam: Potentially, yes, potentially. But this is one of the main processes of your investigation at the very outset. You need to sit down with a legal advisor, with your top team, to say is this a whistleblowing matter, and if so, where do we go to next. Do we contact the whistleblower? Do we, if it's an anonymous complaint, how are we going to manage that? How are we going to assess it? Where do we go from here?

Standards Required of Whistleblowing Investigation ⚓︎

Scott: And could you refer to the legislation and any standards that might be required under the Public Interest Disclosure Order?

Liam: Yes. Legislation enforcement is not going to stipulate the standards that your investigation should reach. It will outline the specific law and its requirements. In the South of Ireland, there's an attorney codes of practice. In the North of Ireland, there is some guidance, but there are no codes of practice. But having said that, any investigation that's completed and goes before a tribunal and/or a court of law will be subject to judicial review and firm examination. So if you haven't followed procedures, if you stepped outside any procedures, your investigation will fail.

Risks Associated with Investigating Whistleblowing Allegations ⚓︎

Scott: And the legislation, I suppose it infers that there are risks and recognises those to the whistleblower, to the organisation. And I suppose there are risks to the investigator as well.

Liam: Absolutely.

Scott: So could you maybe say a bit more about those?

Liam: Right. Your risk to the organisation is obviously reputational. If you get this wrong, and I think if you look at the, if you Google any whistleblowers on the internet, there are many, there are banks, government departments. I think the most famous one within the Island of Ireland would be Morris McCabe, which was horrendous for him and for the Gardaí and for the whole reputation of Irish society, I would argue to a certain extent.

This legislation now places, says it's good practice that you have a person within an organisation, a prescribed person within an organisation or a regulatory body who will manage these complaints. And it says it's his or her responsibility to try and ensure that there's a level of professionalism, both when it's transparent and it's open and it's disclosable, and you have your media, so everything should be working together, in theory.

Scott: Should be working together, but of course, the trouble is if I blow the whistle on this organisation, then it could put at risk jobs in this organisation and therefore not everybody's going to love me for it. But it's why you end up on the, protect the name of the person that comes forward. Even if they're not anonymous, you've got a duty to protect that individual.

Liam: Yes. And that's part of your process. So to say, if after your initial report, you then go and say, right, we're going to go and speak to the individual, we're going to contact him, you have to say, well, who is it? How do we contact him? Where do we contact him? Do they have the mental strength to stand up to this process that they're going to put them and their family through? It's not just the whistleblower. It could be their family. It could be relatives.

It could be the actual, their colleagues work if the allegation is so wrong, that the Health and Safety Executive for arguments sake, could come in and close the organisation down because they're not following the rules. For example, contaminated food, that just springs into mind. If someone's going to blow the whistle that they're putting contaminated meat into the food chain, what happens then? What happens to them? It's immediate closure of the factory, if Health and Safety decide. So how are you going to manage that risk?

Risk Assessing Whistleblowing Claims ⚓︎

Scott: And just what about, I suppose, assessing those risks? You were chatting to me earlier there about managing the risk assessments. So what's so special about the risk assessment here and what do you have to do in whistleblowing investigations?

Liam: Risk assessments, if you say the risk assessments, they're many things to many people. Within this particular process, it's a matter of looking down. Very quickly — I couldn't be able to go through it all right now, but in essence, you would say who is the person? What is the risk to the individual? What's the risk to the organisation? How am I going to manage it? Is it an immediate risk?

And it's . . . for example, if you decided that you were going to meet Liam Ennis, the whistleblower, but in meeting Liam Ennis, you find out that Liam has had a history of alcoholism or has a nervous breakdown, would you then say, "Well, how are we going to manage this? Do we need to get Liam additional help? Do we need to get Liam professional help? Is this a thing that the company is willing to pay for?"

There, when I say risk assessments, I don't mean buildings falling down. I mean the whistleblower. Then you can look at the risk assessment to the company, i.e., reputational damage. Then you can look at the risk assessment to the investigation. But it must be discussed and it must be identified and recorded.

Scott: Okay, you run workshops and such like, and they include managing the media and external communications. So why is that necessary in whistleblowing investigations in particular?

Liam: That's enormous in that if the organisation who's the subject of the allegation, for argument's sake, if the organisation doesn't have a media strategy to deal with it, so then that strategy must be in compliance with their strategic aims and their strategic goals that are up on their website. So if it's the NHS and you have a whistleblower in the NHS and they're not dealt with correctly, that whistleblower can then go onto Twitter or they can go public. And you have two different strands.

So you need to get a senior person within the organisation who's aware of the investigation process, who's aware of what your aims and objectives are, where do you want this investigation to go? How do you want this to work? What's your plan? And is it legal? Is it compliant with what you want it to be with your strategic objectives? So you have to have someone to front up, front and centre for the media. You must do that.

Who Should Investigate Whistleblowing Allegations? ⚓︎

Scott: Okay. You also state about senior executives dealing with this situation, Liam. So in ordinary grievances, a manager might handle it or do, it might go up the chain at some stage. But when it comes to a whistleblowing complaint, which could go anywhere, could go external, could end up in the media, and so on, could impact on the organisation, lots of employees, lots of customers, whatever, it has to be senior. Is that set out anywhere, that it has to be senior, or is it just intuitively correct?

Liam: No. Well, it's intuitively correct, but it's set out in legislation within the UK and the Republic of Ireland. Northern Ireland doesn't state it, but the UK and the Republic of Ireland do. And in essence, I'll simply put, investigations, where they're mismanaged or they're unprofessional or they're illegal, they're just simply going to erode the public confidence within all the organisation. So it's really important that there is a senior manager within that organisation who will take responsibility for it and ensure that you don't have investigations that are illegal or go wrong. And apart from anything else, it will certainly build up a culture of trust within the organisation, that they're managed.

Scott: There's a difficulty there if you take that particular point there, because you've got a senior manager who's doing the investigation. There may be somebody even more senior who needs to be kept abreast of things and where they get involved. So do they keep a watching brief? Is that what you do? Or do you go straight to the top? Or is that part of your risk assessment?

Liam: Well, it should be a prescribed person within organisations. So that particular individual would be responsible for the strategic development of the whistleblowing. If you're going to appoint an investigator, that person needs to A, have the skills to do the investigation, B, I would argue strongly should have absolutely no contact with the complainant or not be aware of the individuals against whom the complaint is made, so you can have some form of integrity, and where possible, should sign up to some form of confidentiality agreement that during the course of the investigation, they're not going to discuss it. And all of that then feeds back up to your person at the top. And he or she will control the investigation strategically, to ensure that the company, the whistleblower, and the investigation are running to the same aims and objectives.

Scott: Hopefully, it's not the person at the top who's doing the wrongdoing, and that might happen.

Liam: That has happened.

Scott: That might happen once in a while.

Liam: Yes, yes, absolutely.

Current claims in UK/USA ⚓︎

Scott: You've got this worked up as well, that provides a structure that's recognised in the courts, you say, in the UK, in both civil and criminal courts. Indeed, one such disclosure matter is coming before the UK Supreme Court soon. Can you give us any reference or any background? I know might be difficult, but anything at all about this?

Liam: Well, I can't mention, I think it would be wrong for me to mention any ongoing court cases. That's the first thing. But I would say the training is based on policies and procedures that I developed through new legislation within the Serious and Organised Crime Police Act. And if there are any lawyers listening, they would know that the Assisting Offender legislation, commonly known as supergrasses legislation, so how those matters were investigated, we've now taken it out of so the criminal aspect, but used those same skill sets to bring in whistleblowers.

It's not the same level, I accept that totally, but it's used in the same policies and processes. It's to ensure that your investigative process, should it get as far as a tribunal or a criminal court or whatever type of judicial tribunal, that it will stand up to the independent rigorous processes that it's designed to do. So from that point of view, it's been through courts a number of times, and it's been successful. So the process works. But I think it's unfair to ask individuals with no training to do it, because they simply don't know how.

Scott: And so I suppose, there are a number of things that are going on at the moment. There's an allegations over in the United States at the moment about certain, I suppose, well-known individuals who have bent the rules to make sure that their kids get into the best universities and such like.

Liam: Yes, students….

Scott: And with those types of things, had that come from an employee of the colleges over there, that would be a whistleblowing thing. It may or may not be criminal. It may be that they're giving a donation and in return, something gets something. But it's one of those ones that could still be in the public interest, and it's certainly going to be damaging, not just to the individuals who may, I understand, face criminal charges in the US, but damaging to their reputation at the colleges and the universities. And it's that really that elevates this above everything else.

Liam: Yes, well, the fact that we're talking about it, and then this happened in the States, now, was it criminal? I don't know. I suppose it's bribery, off the top, I'm shooting from the hip here. I'm thinking it might be bribery, yes? So it would be, certainly wrongdoing. Would be potentially criminal, and yes, it could be whistleblowing, depending on who actually made the allegation. If it's an employee saying that Candidate A is getting better preference over Candidate B because of a lot of money coming in, therefore it's wrong, so yes, that would certainly fall into the category, yes, absolutely.

The Anonymity of Witnesses in Whistleblowing Investigations ⚓︎

Scott: One of the common factors, I think, in whistleblowing investigations in particular, is that the witnesses, particularly the whistleblower, may even ask to be anonymous. So you may get an anonymous complaint, but more often than not, you'll get an individual who says, look, I'll tell you this in confidence, but you're not allowed to say because I might be in danger and such like. The initial report may refer to anonymous witnesses for intelligence purposes, or there may even be criminal activity reported. So what kind of problems might this create over normal workplace investigations?

Liam: Well, in essence, if an individual . . . well, first and foremost, if at the very outset, if the person reports it anonymously and you have something in place within your organisation then that collects this information or collates it and records — normally the HR department — records the number of complaints, if the complaint is of a nature and you say yes, this is whistleblowing matter, but the individual making it does not want to be known, you would treat it as anonymous. But your problem then is how do you assess it? So do you take an investigative step to make further inquiries?

Let's presume on this case, it's an allegation of sexual impropriety. You have an individual working in an office who continually makes inappropriate advances or inappropriate touching of women working in the office. And some people say he's just an office pest. But you have a number of incidents . . .

Scott: Incidents . . .

Liam: . . . yes, and you've a number of reports of this, but none of the victims, if you like, want to put their hands up. How are you going to manage that? So you know that there's a number of complaints so you have to do something about it. So you then have to be able to assess it. And by doing that, you could say, "We've got four complaints. They're all anonymous. But because the four complaints say the same person and they may be identifying his MO, for want of a better word, then these complaints could be real or are real. We're going to have to investigate it."

And then you have to sit down and work out a way you're going to do that, to tackle this alleged wrongdoing, and at the same time, protect the victims, but protect the individual who's being complained against. And this is where you work out your strategies at the start, and how to do that.

But you have to have someplace, as well as all that, to store all this. So if there have been obligations over five years and somebody says this happened five years ago, well, how are you going to test that? Where is your department who's holding that, who's retaining all this information to assess it? There has to be something someplace.

Scott: And a lot of people, I suppose, wouldn't even see that as whistleblowing because it's the sex pest in the office. You would deal with that as a normal type of complaint. You might do.

Liam: Yes.

Scott: But the fact it is that some of those complaints might be criminal, and therefore it automatically becomes Public Interest Disclosure. Or it may be that it's impacting on a number of individuals, and therefore the person who complains is saying it's not just me, because if it was just me that was complaining about you touching me up here a little, then that's not probably a whistleblowing or a criminal offense if it didn't go that far.

Liam: Yes.

Scott: But if it's a number of people that are being there, or if there's a culture that's being complained about, that's suddenly elevates it up to the area of whistleblowing.

Liam: Well, it doesn't have to be multiple allegations to be wrongdoing, put it that way. Whether it's criminal or not, it could be argued. However, you still have a duty of care to the individual who's being, shall we say, "assaulted," and unwanted touching, or whatever is wrong. So how do you manage that? And you have to do it carefully, and this is the bit…. and is if I put my hand up and say, "That's me, he's been touching me wrong," or, "He's been touching me over the last six months," and no one else backs me up, where do I go then?

So this is the bit that you need to be aware of at the very start. And I keep coming back to this. You need to risk-assess this at the start and define where you're going and how you're going to do it. And it could be that you need to approach all the girls or all the victims and ask them discreetly what happened, when, where, and how. And if you get something to say that this is a definite ongoing problem, you may have to try and persuade all the victims to stand together and say, "Right, let's do this together and get this behaviour stopped."

Scott: Yes. But you've got to risk-assess that...

Liam: You've got to risk-assess it.

Scott: ...because the danger is you're actually creating a hare there that you're going to chase and could be wrong. Because you don't know, at that stage, you haven't worked out the bona fides. Or if the individual who's making the complaint, it could just be that you and I don't like each other . . .

Liam: Absolutely.

Scott: . . . and therefore I'm making a complaint about you.

Liam: And this goes back to my argument, is the company or the organisation or the HR department, are they keeping these complaints, and if so, where, even though they are anonymous?

Investigative Interviews for Whistleblowing Allegations ⚓︎

Where do you hold investigative interviews for whistleblowing allegations?

Scott: And interviews as well, they could be different. We were chatting earlier about sometimes you have hold meetings in secret locations because of this requirement to keep the whistleblower's name private and so on. You've highlighted risk, you've got various red flags that come up. You have to manage conversations quite carefully. You've got to assess whether the person's being genuine when they're making some kind of complaint and whether it's there. You've got to check it out, corroborating evidence, and so on. So what kind of problems do you see in those areas that you come across when it comes to whistleblowing complaints and the whole interview process?

Liam: The interview process, and again, I think from the very start you're going to have to say the person is what we have determined to be vulnerable. They're in a bad place. They're not confident. Maybe if they don't want to be identified, they're going to say hold it in a secret location. I think that's the wrong terminology. What should we say, should we hold it at a location where the complainant or the whistleblower's comfortable with and your investigators are comfortable with. And you can have the conversation in peace and quite, and if necessary, take your notes or record it. Do whatever processes that you're going to do before you go out.

And give the person who's making the complaint confidence that you're not there — you're being professional. You're listening to what they have to say. You're being open. You're not passing any comment one way or the other on it, and you'll come back to them. And you will respect their privacy and confidentiality. It may be just getting certain methodologies in place to ensure that any contact is recorded, it's done in a safe place, and it's done at a time and at a duration that the whistleblower is comfortable with. And you outline, you give them a road map of where you're going.

Scott: I suppose you might get similar problems arising with topics or restrictions on what can be said or follow-up investigations, so how would you manage that? Just closing down the initial meeting, if you like, with the whistleblower, agreeing what's going to happen next?

Liam: Yes, you would have to. So if you go back to the phases, if you say you've got five phases and your decision is that you're going to speak to the individual to find out exactly what the issue is, that's Phase 1. Then you would have to say, "Are you happy enough to move on here?"

You would have to delve into the person's private life. Does their family know about this? Has this happened before? Do they have any background mental issues? Have they had a nervous breakdown? Is this completely stressing them out at work? Do they have the actual strength to go through this? Are they aware that if this investigation goes to its conclusion and their allegation is proven, the consequences of that? Is there another way that you can do the investigation without involving the whistleblower directly?

These are issues that need to be ironed out at the very start. But you have to be open. You have to be honest. You never make any promises. You never make any threats. And you never offer any inducements. And perhaps if I was going to give any advice today, of any interview, I would say before you start, confirm with the person, there's no threat, no inducements, and no promises here today, before we go any further. And let them tell you what's gone on. Ask open questions. Let them give it out. And if you have to go back a second, third, or fourth time, so be it.

Scott: Yes I suppose …on one of the problems that you chat about, there were promises. You can't absolutely guarantee the anonymity . . .

Liam: No.

Scott: . . . of the whistleblower. It usually comes out at some stage. So we were chatting about maybe somewhere private. We were meeting in the offices of Legal-Island here. People have seen us come in. If some kind of whistleblowing investigation takes place afterwards, people might put two and two together and come up with five or not. So you're looking for somewhere that's a distance away that . . . you can do your best, but you can't obviously protect people all the time.

Liam: No, you can't, and that's one of the things. You can never promise that we're going to keep your anonymous. That's a foolish thing to say. It's wrong. But you're not going to turn up at a person's house unless they're happy that you're there. You contact them first, arrange a meeting. You're not going to turn up in a suit and tie, too, with pen and papers and sit in a restaurant and start taking notes. That's not the way it goes. You have to make things natural, and it has to be comfortable for both the investigators and the whistleblower. But the people doing the investigating, they should be given a brief before they go out as to what you want and where they're going.

Disclosure of Information from Investigation into Whistleblowing Allegations ⚓︎

Scott: Okay. And so was one of the other issues, is that if those goes ahead, let's say you've complained about me, I would expect to know who's making the complaint about me. And certainly, if it goes to a tribunal and I've lost my job and I'm going to adjudication service in Ireland and I'm going to an industrial tribunal to try and get my job back in Northern Ireland, the witnesses may end up having to be brought forward. Or there may be protocols around that. But there's going to have to be some kind of areas around disclosure of information. Indeed, that might include disclosure of all the statements and witnesses and so forth.

Liam: Absolutely. Your disclosure, if it's criminal, it's covered by the CBIA Act. In other words, the easiest way to put it was if you've anything that's going to assist the defence, you must disclose it. Or if it's anything that's going to undermine your argument, you must disclose that as well. And the tribunal will ask for all those matters. So there's no point in trying to hide stuff. It's not going to work. Disclose everything would be my mantra on that.

Scott: Just before we finish, Liam, is there anything you'd like to say? Your contact details are there on the slides for everyone to see if they want to get in touch with you about these or any training requirements that they might have.

Liam: Oh, please do. It's a matter of just contacting me on the slides. Send me an email. I do appreciate, it can be a difficult subject at times. If you keep it simple and do it step by step and be open with the individual and don't take the side, be impartial, it will work. It will work.