Whistleblower Policy and Procedure

What is the purpose?

Northcott is committed to maintaining a culture of honest and ethical behaviour and high standards of corporate governance. This policy is to provide an avenue for any person to report instances of corruption, misconduct or illegal conduct by Northcott, its Board, employees, volunteers, or contractors without fear of retribution. It also ensures that Northcott and its employees act at all times in compliance with all laws and the ethical standards set out in the Northcott Purpose, Values and Code of Conduct.

Who needs to know about this Policy and Procedure?

• All Northcott employees, Board of Directors, volunteers and contractors.

What is Northcott’s Policy?

• The organisation and its staff act at all times in compliance with all laws and the ethical standards set out in the Northcott Mission, Values and Code of Conduct.
• This Policy provides Whistleblower Protections to any individual who is an Eligible Whistleblower making a qualified Disclosure to an Eligible Recipient.
• A whistleblower is a person, usually an employee, who exposes information or activity within a private, public, or government organisation that is deemed illegal, immoral, illicit, unsafe, fraud, or abuse of taxpayer funds. An employee can also expose or report such information via the usual reporting lines through to their manager or People and Culture.
• This Policy also applies to an eligible whistleblower making a complaint that is considered ‘Reportable Conduct’ (as defined below) or of a public interest disclosure or an emergency disclosure, where the requirements of subsections 1317AAD (1) and (2) of the Corporations Act 2001 (Cth) (Corporations Act) are met, respectively, it further includes where complaints were made historically under whistleblower protection.
• An individual is not afforded whistleblower protection if their disclosure is not a disclosable matter as per Northcott’s policy definition below.
• A disclosure is not a disclosable matter if it concerns Personal Work-Related Grievances (as defined in the Corporations Act), unless it concerns a contravention or an alleged contravention of section 1317AC of the Corporations Act (that involves detriment caused to the discloser or a threat made to the discloser, this includes victimisation. For personal work-related grievances, see the Northcott Grievance Policy and Procedure (employees). This policy does not include general complaints covered by the Northcott Feedback and Complaints Policy.
• Staff can report their concerns freely and without fear of repercussion where the person explicitly claims whistleblower status and the matter reported meets reportable conduct threshold of a disclosable matter.
• Northcott services operate to the highest ethical standards by allowing any person to report instances of corrupt, serious misconduct or illegal conduct by Northcott, its Board, management or staff.
• Where the whistleblower complaint meets the reportable conduct threshold, the whistleblower will be protected from retribution or victimisation and the complaint will be investigated in accordance with this Policy.
• Northcott will not retaliate against:
  • any person acting in good faith, who has raised a complaint against a practice of:
    • Northcott
    • another individual involved within Northcott, or
    • an entity that Northcott has a business relationship with on the basis of a reasonable belief that the practice is in violation of the law or Northcott’s Code of Conduct
  • any person who discloses or threatens to disclose to a supervisor or a public body – any activity, policy or practice of Northcott that the person reasonably believes is in violation of a law or a clear mandate of public policy concerning the health, safety or welfare of people or protection of the environment.

What are the procedures?

Who can be a whistleblower?

An eligible whistleblower maybe a person associated with Northcott who reports or discloses known or reasonably suspected misconduct within the organisation. As an example, a whistleblower can be:

• current or former employees or their spouses,
• contractors, agents or suppliers (and their employees or volunteers, whether paid or unpaid), or
• a relative or dependent of an above individual, or a dependent of an above individual’s spouse.

If someone is to make a disclosure under whistleblower protection, they must have reasonable grounds to suspect serious misconduct by:

• the organisation; or
• an officer/ employee of the organisation.

Reporting Whistleblower complaints

A report can be made by any person acting in good faith who believes the conduct reported against Northcott, its Board, or its employees falls within the definition of reportable conduct.

Reportable Conduct

Reportable conduct is defined as “misconduct” or an “improper state of affairs,” which are broadly defined but are not limited to the following types of incidents:

• a serious breach of policies and procedures
• unsafe action or activities (an action that is seriously harmful or could be seriously harmful)
• fraudulent or corrupt activities
• unethical actions or intentionally breaching the Code of Conduct
• substantial mismanagement of resources
• intentionally hindering or obstructing of audit or investigation processes
• an abuse of authority
• behaving in a way that could damage the organisations reputation, financial position, or is otherwise seriously opposed to the interests of the organisation
• disclosure of information that indicates an offence against, or contravention of, certain prescribed Commonwealth laws, including the Corporations Act, or any act that is punishable by imprisonment for a period of 12 months
• concealment of a wrongdoing, or any retaliation against, a whistleblower.

What is not reportable conduct?

All whistleblower reports are assessed by either the General Manager, Quality and Risk or the General Manager, People and Culture to determine if the matter being reported meets the reportable conduct threshold.

Reportable conduct is not considered a reasonable management direction, matters relating to individual performance or complaints that would otherwise be regarded as a workplace grievance between two parties.

A personal work-related grievance including any grievance relating to an employee’s current or former employment, which has implications for the employee personally, but does not have significant implications for the organisation or does not concern an offence or an alleged offence, is not to be considered Reportable Conduct.

Grievances such as personal conflicts and workplace bullying disputes should be addressed under the Grievance Policy and Procedure (Employee). However, a personal work related grievance may still qualify for whistleblower protection if it is a mixed disclosure, that is, it relates to a grievance and a reportable conduct matter as outlined above.

If a whistleblower complaint does not fall within the definition of reportable conduct the matter can be referred to the appropriate pathway for investigation or resolution. The whistleblower must be advised if the matter is to be reported or investigated outside of the whistleblower investigation framework.

How can I report a whistleblower matter?

The report can be an oral or written report to any of the following eligible recipients:

• A director on the Northcott Board
• A member of the Northcott Executive Leadership Team, including the CEO
• The Whistleblower Protection Officer – General Manager People and Culture
• KPMG’s Fair Call Reporting Service
• General Managers
• Complaints of wrongdoing can also be reported to the relevant external regulator

Can you report a whistleblower report anonymously?

Yes, you can choose to stay anonymous during the course of the whistleblower investigation. Sometimes you may not be able to remain anonymous as your identity may be apparent to the organisation from the information you provide. However, if you choose not to identify yourself, all effort will be made to ensure that you remain anonymous. It should be noted that your identity may need to be disclosed in some circumstances, particularly where offences have alleged to have been committed and it is required by law.

• If a whistleblower does not consent to their identity being disclosed, it will still be lawful to disclose their identity to the following:
  • ASIC, APRA, the Australian Federal Police or the NDIS Quality and Safeguards Commission
  • a legal practitioner for the purposes of obtaining legal advice or representation about the disclosure; or
  • to a body prescribed by the Corporations Regulations.

The above parties may also disclose the whistleblower’s identity to relevant authorities to assist in the function of the authority. However, all parties must reduce the risk to the whistleblower’s identity by where possible redacting of information that may lead to their identity being disclosed, secured record keeping and ensuring confidentiality is maintained by all parties involved in the investigation.

Protection for Whistleblowers

To encourage whistleblowers to come forward with their concerns and protect them when they do, the Corporations Act provides certain people legal rights and protections as whistleblowers. A person who discloses information as a whistleblower must be genuinely protected from retaliation or victimisation.

It is illegal to terminate, harass or discriminate against a whistleblower or potential whistleblower because of the nature of the disclosure. The civil penalties that apply for a breach of a whistle-blowers’ confidentiality or victimisation of a whistle-blower include fines of up to $200,000 for an individual; or $1 million for a body corporate. It should be noted that if the person disclosing information has participated in any of the conduct that they are reporting, they may still be liable for any misconduct they took part in.

The Whistleblower Protection Officer (WPO) is the individual authorised to receive whistleblower complaints and who is responsible for safeguarding the whistleblower’s interests and the interests of any supporting witnesses. At Northcott, the WPO is the General Manager People and Culture.

More information about whistleblower rights can be found here:

https://asic.gov.au/about-asic/asic-investigations Col-and-enforcement/whistleblowing/whistleblower-rights-and-protections/

False Reporting

Where it is shown that a person has made a vexatious or false whistleblower report and has knowingly made a false allegation, they will be subject to Northcott’s Discipline Policy and Procedure.

Unauthorised Release of Information

• Any information given by the Whistleblower must not be released without authority to any person who is not involved in the investigation or resolution of the matter. For circumstances where the whistleblower’s identity is requested by external parties, such as Police, the whistleblower will be advised and informed of the reason their identity is being shared with an external party.
• This includes information that may lead to the identification of the Whistleblower.
• A breach of this policy will be dealt with under Northcott’s Discipline Policy and Procedure .
• All whistleblower complainants will be referred to by a name that does not identify their name or the name of any potential person subject of allegation; this is to ensure the identity of the whistleblower is protected at all times.
• All reporting relating to a whistleblower investigation should be conducted in a manner that does not disclose the investigation as a whistleblower complaint, this includes the file having a case name that does not identify the complainant or their place of work.
• All evidentiary documentation and records should be secured and maintained for record keeping purposes with clear parameters regarding who within the organisation has access to the information.

How to report a Whistleblower complaint

How do I report?

Northcott has a range of ways in which you can report a whistleblower complaint, these include but are not limited to the following:

• The KPMG FairCall service provides Northcott staff with the option of contacting an independently monitored, external, anonymous service to report their concerns of possible fraudulent or reportable conduct if they are not comfortable contacting an eligible recipient. If the matter does not relate to such issues, please contact Northcott directly either through your line manager or Northcott’s complaints and or grievance process.
• An eligible recipient is a member of the executive leadership team. The team are able to confidentially receive your complaint and report the matter on your behalf, with your consent. The investigation is conducted the same, it is just reported to an executive member, rather the KPMG Fair Call hotline. It is important to articulate at the time of reporting the matter to an eligible recipient that you are reporting the matter under Northcott’s Whistleblower Policy and whether or not you wish to have your identity disclosed to the investigator.

An eligible Recipient

• You can contact a member of the executive leadership team by email or mobile phone and contact details are located on Nula.

How do you contact them?

KPMG FairCall Hotline

• A toll-free service for the use of Northcott staff, which is monitored by trained and experienced professional personnel.
• The phone number is 1800 500 965.
• Calls will be received by FairCall on recognised business days between 7.00am and 5.00pm (AEST).
• Outside these times, calls are diverted to a mobile phone.
• In the unlikely event that calls are not answered by the mobile, a voicemail service provides staff with the ability to leave their details or to call back during normal operating hours.

Email access

• Northcott staff can report matters using the email address
  [email protected].
• This may restrict the ability of the caller to remain anonymous; however
  FairCall will ensure all details are kept confidential.
• This facility may also be used to communicate with our operators subsequent to a call.

KPMG Mailing Service

• Northcott staff are able to mail reports or additional call information to a secure mailbox at the following address:

The FairCall Manager PO Box H67
Australia Square
Sydney NSW 1213

How my information is kept confidential

• KPMG will allocate each staff member who contacts FairCall with a confidential identification number and will provide Northcott with a call reference number.
• KPMG will not ask for or record other personal details of the staff, unless the staff expressed that they do require their details to be retained by KPMG or forwarded to Northcott.
• Where KPMG collects personal information as part of this service, it is provided in accordance with KPMG Australia’s Privacy Statement.
• This statement can be found at https://home.kpmg.com/au/en/home/misc/privacy.html
• You can contact an eligible receipt using your work or personal email, or by any other means you feel comfortable, in outlining your complaint please advise your consent for your complaint to be investigated and if you would like to keep your identity confidential. If you use your work email account, remember your name will be disclosed, however you can request that your name be kept confidential when reporting your complaint, if you wish to do so.
• Investigators will not disclose your name to another party, unless the matter falls within the reasons outlined above. Your matter will be given a case name and you will be referred to as the complainant, rather than your identity disclosed. There may be some occasions where your identity may be assumed when interviewing other parties, however investigators will attempt at all times to not disclose your identity without your consent.

How is my report investigated?

• In making a complaint you should include as much information about the incident as possible, this will assist the investigator to undertake enquiries related to your complaint. It is helpful to include the following key pieces of information if known:
  • Names of people involved
  • Names of any witnesses
  • Date, time, location of the incident
  • Any customer impact
  • Details of any evidence you have to support your complaint
  • Has the incident happened before?
  • Have you reported the incident to anyone else?
• Once a report has been made, your report will be assessed by the GM Quality and Risk and the GM People and Culture to ensure the nature of the report meets the whistleblower reportable threshold definition.
• Your complaint will then be allocated to the appropriate Northcott Officer who will initiate an investigation of the allegation, taking care to protect the whistleblowers identity and from any repercussion from the organisation or individual staff, such as dismissal, demotion, any form of harassment, discrimination, current or future bias.
• Depending on the nature of the matter reported, the investigation may be conducted by the GM Quality and Risk, the GM People and Culture, or a person authorised by them such as the Manager of Investigations, the Industrial Relations Manager or a qualified external investigator. If the matter is allocated to an external party, the GM People and Culture or GM Quality and Risk will assign the matter and regularly liaise with the investigator.
• All external investigators are to comply with all Northcott Policies and Procedures and relevant Fair Work Act requirements when conducting a workplace investigations. The external person must maintain the strictest confidence, while observing the principles of natural justice in their investigation.
• When the report is finalised, any recommendations are the responsibility of the GM People and Culture to implement.
• The person reporting the matter should be provided with feedback on the outcome the investigation and also provided with regular high level summary updates as the investigation reaches significant milestones in the investigation progress.
• Where the whistleblower is not satisfied with the outcome of the investigation they have the option of referring the matter to the CEO, the GM Quality and Risk or GM People and Culture, Chair of the Board, or to an external body, such as the NSW Ombudsman or NDIS Quality and Safeguards Commission.

Where can I get help?

Contact People and Culture

What other Northcott documents are related?

You may need to refer to these documents for more information:

• Code of Conduct
• Discipline and Policy and Procedure
• Fraud Prevention and Control Procedure
• Grievance Policy and Procedure
• Whistleblower Policy and Procedure

Who is Responsible? What are they Responsible for?

• Chief Executive
  • Final review and approval of this policy.
• General Manager People and Culture
  • Maintain this policy, its related procedures and documents.
  • Make sure the Whistleblower is protected in the event of them making a report.
• Eligible Recipients
  • A Director on the Northcott Board
  • A member of the Northcott Executive Leadership Team, including the CEO
  • The Whistleblower Protection Officer – GM People and Culture
  • KPMG’s Fair Call Reporting Service
  • General Managers
• Level 3 and 4 Manager
  • Make sure the policy is effectively implemented in their services.
  • Make sure staff follow the policy and procedure.
  • Make sure staff are made aware of the protection that this policy offers them.
  • Make sure that staff feel supported to report illegal or corrupt Conduct under the Whistleblower policy, and that their anonymity is protected if they request it.
• Supervisor
  • Make sure staff have read and understand the policy and procedure, and have sufficient skills, knowledge and ability to meet the requirements.
  • Make sure that staff feel supported to report illegal or corrupt conduct under the Whistleblower policy, and that their Anonymity is protected if they request it.
• All Employees
  • Follow the requirements of the policy and procedure.
  • Only make reports which they believe, in good faith, meet the terms of the policy.

Definitions, Legislation & Standards Compliance

Definitions:

• Nil
• For other definitions, please refer to the dictionary on the Northcott Intranet.

Legislation:

• This policy was developed in accordance with the National Disability Insurance Scheme (Provider Registration and Practice Standards) Rules 2018 and the Corporations Act.
• For other Legislation and Standards Compliance, refer to the Service Management Policy.

Note: version 6.0