Whistleblower Policy NZ: Template And Employer Checklist

Wondering what a whistleblower policy in New Zealand actually needs to say? The good news is that it doesn't have to be complicated, but it does need to give your team a safe, clear way to raise serious concerns before they become bigger problems.

A good policy helps you deal with reports of serious wrongdoing calmly and fairly. It also supports your obligations under the Protected Disclosures (Protection of Whistleblowers) Act 2022, while giving managers a practical process to follow.

If you're putting together a workplace policy, the aim isn't to encourage complaints for the sake of it. It's to make sure genuine concerns reach the right person, get handled properly, and don't end up being ignored, mishandled or retaliated against.

What Is A Whistleblower?

A whistleblower is someone connected to your business who reports serious wrongdoing because they genuinely believe something improper, unlawful or dangerous is happening.

In New Zealand, the legal wording is usually about a person making a protected disclosure. Under the Protected Disclosures (Protection of Whistleblowers) Act 2022, a discloser can include people such as:

• current and former employees
• contractors and subcontractors
• volunteers
• people seconded to your business
• board members or people involved in governing the organisation

This is wider than many employers expect. It means your reporting process shouldn't only be written for permanent employees.

For example, say Aria runs a food manufacturing business in Hamilton. A maintenance contractor notices that a supervisor has been signing off machine safety checks that weren't actually done. If the contractor reports this because they believe it creates a serious health and safety risk, that may be a protected disclosure.

Not every workplace complaint is whistleblowing. A complaint about a roster, a personality clash or a single payroll error will usually be handled under your normal employment, HR or complaints process. A whistleblower policy is for more serious issues, such as suspected fraud, serious safety risks, corruption, unlawful conduct or serious misuse of information.

Your policy should make that distinction clearly. If everything is treated as whistleblowing, managers can get confused and everyday employment matters may not be dealt with through the right process.

Do You Need A Whistleblower Policy In New Zealand?

It depends on your business, but if you employ staff, use contractors or handle sensitive operations, a written whistleblower policy is a smart step alongside your other workplace policies.

New Zealand law doesn't require every private business to have a standalone whistleblower policy in the same way some overseas laws do. However, the Protected Disclosures (Protection of Whistleblowers) Act 2022 gives protection to people who make qualifying disclosures, and it sets expectations for how those disclosures are received and handled.

A written policy helps you show that your business has a safe internal pathway for serious concerns. It can also help you meet related obligations under laws such as:

• Employment Relations Act 2000, especially your duty of good faith and obligations around fair workplace processes
• Health and Safety at Work Act 2015, where a disclosure involves serious risks to workers or the public
• Privacy Act 2020, because reports often include sensitive personal information
• Fair Trading Act 1986, where concerns involve misleading conduct, unsafe products or dishonest customer practices
• Companies Act 1993, where concerns involve director conduct, accounting records or company governance

Your policy also becomes a practical management tool. When a report comes in, your team won't need to invent a process under pressure.

This matters even more if you have multiple worksites, remote workers covered by a remote work policy, a high trust finance function, safety sensitive work, vulnerable clients or a mix of employees and contractors.

What Should Count As Serious Wrongdoing?

Serious wrongdoing should be defined in your policy by using the protected disclosure concepts, then translating them into examples your team will recognise.

Under the Protected Disclosures (Protection of Whistleblowers) Act 2022, serious wrongdoing can include things like an offence, a serious risk to public health, public safety or the environment, and certain serious failures involving public funds, public functions or the maintenance of the law.

For most private businesses, the examples that matter day to day are likely to be:

• fraud, theft, bribery or corruption
• serious health and safety risks
• deliberately falsifying company records
• serious breaches of privacy or misuse of customer data
• conduct that may be criminal
• serious environmental harm
• covering up serious misconduct
• serious breaches of legal or regulatory obligations

It helps to also say what your whistleblower policy doesn't cover. Otherwise, every workplace frustration may be channelled through the wrong system.

Your policy can say that ordinary performance feedback, pay or rostering questions, interpersonal conflict, minor policy breaches, customer complaints and personal employment issues are usually handled under other workplace processes, unless they also raise serious wrongdoing.

Be careful, though. A report can start as an employment complaint and still reveal serious wrongdoing. For example, if an employee complains about bullying and also says a manager is pressuring staff to falsify safety records, you may need to treat the safety issue as a protected disclosure and the bullying issue under your workplace conduct process.

The safest wording is to say your business will assess each report and decide which process applies, rather than automatically rejecting reports because they don't use the right label.

What Should A Whistleblower Procedure Include?

A whistleblower procedure should tell people who they can report to, what information to include, what you'll do next, and how you'll protect them from retaliation.

Keep it practical. Your team should be able to read the policy and understand exactly what happens after they raise a concern.

1. Reporting Channels

Give people more than one reporting option. If the report is about their direct manager, they need another safe person to contact.

Common options include a senior manager, the owner or managing director, a designated HR contact, a board chair or director, or an external reporting email monitored by an appropriate person.

You should also explain that, in some situations, a person may report to an appropriate authority. Depending on the issue, that might include a regulator or government agency. For example, a serious workplace safety issue may involve WorkSafe New Zealand, while a privacy breach concern may involve the Office of the Privacy Commissioner.

2. What The Report Should Include

Ask for useful details, but don't make the process so formal that people stay silent. Your policy can invite the person to include what happened, when and where it happened, who was involved, who else may know about it, any documents or messages, and whether there's an immediate safety or privacy risk.

3. The First Response

Under the protected disclosure process, a recipient is expected to acknowledge the disclosure and take steps to consider and deal with it. A useful benchmark is the 20 working day timeframe in the Act for acknowledging, assessing, checking whether it qualifies, dealing with the matter and informing the discloser of what has been done or is being done. If that can't be completed within 20 working days, the recipient should explain what is happening and when an update is expected.

Your policy should turn that into a simple internal rule: acknowledge promptly, assess quickly, protect confidentiality, and keep the reporter updated where it's appropriate and lawful to do so.

Whistleblower Policy Template: What To Include

A whistleblower policy template should be treated as an outline, not a finished document. It needs to be tailored to your business structure, reporting lines, industry risks and existing employment policies before you use it.

Here is a practical structure you can use as a starting point:

1. Purpose: Explain that the policy gives people a safe way to report serious wrongdoing and helps your business respond properly.
2. Who The Policy Covers: List employees, former employees, contractors, subcontractors, volunteers, secondees, officers and board members where relevant.
3. What Counts As Serious Wrongdoing: Use plain English examples, such as fraud, serious safety risks, unlawful conduct, privacy misuse and serious record falsification.
4. What Is Not Usually Covered: Point people to your grievance, complaints, bullying, disciplinary or HR process for ordinary workplace issues.
5. How To Make A Report: Set out named roles, email addresses or channels, including an alternative if the concern involves a manager.
6. Anonymous Reports: Say whether anonymous reports are accepted and explain that anonymity may limit your ability to investigate or give updates.
7. Confidentiality: Explain who may see the information, when it may need to be shared, and how you'll handle personal information under the Privacy Act 2020.
8. Protection From Retaliation: State that victimisation, dismissal, demotion, threats, bullying or other retaliation won't be tolerated.
9. Assessment And Investigation Process: Describe how you triage the report, decide the right process, appoint an investigator and keep records.
10. Updates And Outcomes: Explain when the reporter will receive updates, while recognising that privacy and employment obligations may limit what you can disclose.
11. False Or Malicious Reports: Say that knowingly false reports may be dealt with under your disciplinary process, while honest mistakes won't be punished.
12. Record Keeping And Review: Set out where records are stored, who can access them and when the policy will be reviewed.

If you already have an employee handbook, code of conduct, health and safety policy, privacy policy, conflict of interest policy or disciplinary procedure, make sure the documents line up. Conflicting policies can make a difficult situation harder to manage.

For example, your whistleblower policy might promise complete confidentiality, while your investigation process requires you to put allegations to the person accused. A better approach is to promise that information will be kept as confidential as reasonably possible, while allowing disclosure where needed to investigate, comply with the law or protect safety.

How Should You Investigate A Whistleblower Report?

You should investigate a whistleblower report by first protecting people and evidence, then deciding whether a formal investigation is needed and running a fair process.

When something serious lands in your inbox, it's tempting to jump straight into interviews. Pause first. A rushed process can create privacy issues, damage trust or make later employment steps harder.

Step 1: Triage The Risk

Ask straight away whether anyone is at immediate risk, whether there's a privacy or cyber incident, whether records could be deleted or altered, whether a named manager needs to be removed from the process, and whether the issue is too sensitive to handle internally.

If there's an immediate safety issue, deal with that first. For example, stop unsafe work, secure equipment or separate people if needed.

Step 2: Preserve Records

Keep a clear record of the report, who received it, the date, what was done and why. Preserve relevant emails, CCTV, payroll records, access logs, invoices, rosters, safety records or messages.

Be mindful of the Privacy Act 2020. Collect and use personal information only for proper purposes connected to assessing or investigating the report. Limit access to people who genuinely need to know.

Step 3: Choose The Right Investigator

The investigator should be impartial and have enough authority to do the job properly. In a small business, that might be an owner or senior manager. In a sensitive matter, it may be better to use an external investigator or adviser.

If the report may lead to disciplinary action, your process needs to be fair. That usually means putting the relevant allegations and information to the person accused, giving them a genuine chance to respond, and not deciding the outcome before you've heard from them.

Step 4: Close The Loop

You may not be able to tell the reporter every detail, especially where another person's employment or privacy rights are involved. You can still confirm that the matter has been assessed, whether action has been taken in general terms, and who they can contact if they experience retaliation.

What Does This Look Like In Practice?

A practical example can make the process much easier to picture.

Mike runs a cleaning business in Christchurch with 24 employees and 6 regular contractors. One contractor emails the operations manager saying a team leader has been using unapproved chemicals at a school site, removing warning labels and telling staff not to record incidents because it would make the company look bad.

Here is how Mike's business could handle it:

1. Day 1: The operations manager forwards the report to the designated whistleblower contact because the allegation involves serious safety risks and possible falsification of records.
2. Day 2: The business acknowledges the report, thanks the contractor and asks whether there's any immediate risk at the school site.
3. Day 2: Mike pauses use of the relevant chemicals at that site and secures chemical logs, incident forms, rosters and staff messages.
4. Day 3: Because the report involves a team leader, Mike appoints a manager from another region to assess the issue and keeps the team leader away from the reporting contractor's work allocation.
5. Week 1: The investigator interviews key people, reviews purchasing records and checks the safety data sheets.
6. Week 2: The team leader is given the substance of the allegations and a fair chance to respond before any decision is made.
7. Within 20 Working Days: The contractor is told the matter has been assessed, safety steps have been taken, and the business will continue with appropriate employment and health and safety processes.

Mike doesn't need to share disciplinary details with the contractor. What matters is that the business acted quickly, protected safety, kept records, respected privacy and avoided retaliation.

Common Mistakes To Avoid

The most common mistake is having a policy on paper but no real process behind it.

Here are the issues to watch for:

• Only Naming One Reporting Person: If that person is involved in the concern, the reporter may have nowhere safe to go.
• Promising Absolute Confidentiality: You may need to share information to investigate properly, protect safety or meet legal obligations.
• Treating The Reporter Like A Trouble-Maker: Retaliation can include subtle conduct, such as cutting shifts, excluding someone from work, changing duties unfairly or threatening their contract.
• Skipping Fair Process: Even serious allegations need to be tested fairly before you take employment action.
• Forgetting Contractors: Many reports come from people who see the business from the outside, such as contractors, suppliers or temporary workers.
• Mixing Up Every Complaint: A payroll question, bullying complaint and protected disclosure may need different processes, even if they arrive in the same email.
• Keeping Poor Records: If you can't show what you received, what you assessed and why you acted, you'll struggle to justify your process later.

Training is also worth thinking about. Your managers don't need to become legal experts, but they should know how to recognise a possible protected disclosure and who to escalate it to. A simple manager guide can be just as valuable as the policy itself.

Key Takeaways

• A whistleblower policy gives your team a safe way to report serious wrongdoing, not everyday workplace complaints.
• New Zealand's Protected Disclosures (Protection of Whistleblowers) Act 2022 is the key law to build your process around.
• Your policy should cover employees, contractors and other people connected to your business, not just permanent staff.
• A strong procedure sets out reporting channels, confidentiality limits, retaliation protections, investigation steps and record keeping.
• When a report comes in, act quickly, preserve evidence, protect safety and follow a fair process before making decisions.
• Templates are useful starting points, but your policy should be tailored to your business, reporting lines and industry risks.

If you'd like help with your whistleblower policy, workplace reporting procedures, employment policies or investigation process, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.