veresure

Implementing a Whistleblowing Program: Organisational Doʼs and Donʼts

Mon, 08 Dec 2025 00:30:47 GMT

Effective whistleblowing programs give employees and stakeholders a trusted way to speak up. When those frameworks work well, they strengthen governance, support fair investigations, and help leaders address issues with transparency.

This one-page guide distils the essential do’s and don’ts every organisation should consider when building or strengthening their whistleblowing framework. From establishing accessible reporting channels to designing fair investigation processes and avoiding common pitfalls, it provides a clear snapshot of what effective practice looks like.

Jointly produced with Duxton Hill and Veremark, this resource is designed to help leaders:

Create safe, confidential pathways for people to speak up
Strengthen trust through clear communication and a genuine non-retaliation culture
Ensure investigations are independent, timely, and transparent
Embed governance structures that meet legal obligations and withstand scrutiny
Continually improve through monitoring, insights, and feedback

Silence isn’t safety: Why whistleblowing needs a human touch

Tue, 02 Dec 2025 00:23:26 GMT

Integrity isn’t built in policies; it’s built in practice.

When someone speaks up, they’re not just raising a complaint, they’re raising a flag that something in your culture might be broken.

Across Australia, 15 separate whistleblower laws attempt to define how organisations should manage disclosures. But while legislation sets the rules, trust sets the tone . A whistleblower policy written in legalese won’t protect your people, or your brand, if it isn’t practical, human, and easy to use.

The reality check

According to the 2023 Speak Up Index, 43% of employees say they would stay silent rather than report misconduct for fear of retaliation or inaction. That silence doesn’t make problems go away; it buries them until they explode. And when they do, the fallout is fast and brutal: loss of trust, media exposure, regulatory investigation, and in some cases, criminal prosecution.

That’s why whistleblowing isn’t just a compliance exercise, it’s your advance warning system . Done right, it can protect your people, your profits, and your reputation.

Why many policies fail

We recently reviewed a whistleblower policy that ran to 34 pages. It ticked every legal box, yet not a single disclosure had been made in two years.
Here’s why:

Too complex: The contact details for reporting were buried on page 27.
Too many channels: Twenty-five possible people to report to, but no clarity on who to trust.
Too much jargon: Legal definitions replaced plain English, leaving potential whistleblowers confused and afraid.

The result? Employees disengaged, issues went unreported, and the business unknowingly sat on a reputational time bomb.

The solution

A modern whistleblower system should be:

Independent – creating psychological and procedural distance from internal politics.
Accessible – simple to navigate and anonymous by design.
Human-centred – written for people, not lawyers.

That’s why we’ve partnered with Veremark - their independent whistleblower platform goes beyond compliance. It gives your people the confidence to speak up safely and gives you the insight to act before headlines force your hand. Because when misconduct is allowed to grow in the dark, it’s your reputation that takes the hit, and rebuilding trust takes far longer than protecting it.

Don’t wait for the crisis, reach out to find out how we can help you build a culture of integrity that protects your people and your brand.

Strengthen third-party risk management and supply chain integrity

Tue, 18 Nov 2025 03:58:41 GMT

Veresure and Ethixbase360 Announce Strategic Partnership to Strengthen Third-Party Risk Management and Supply Chain Integrity Amid Growing Global Compliance Demands

18 November 2025 — Ethixbase360 , a global leader in third-party risk management and supply chain transparency solutions, and Veresure , a technology-driven integrity and risk-management company based in Australia that helps organisations embed transparency, ethical conduct, and compliance across their people, processes, and third-party networks, today announced a strategic partnership to deliver comprehensive third-party risk management solutions across global value chains.

The partnership will empower organisations—particularly small and medium-sized enterprises (SMEs)—to meet rising international compliance expectations.

Driving Integrity in a New Geopolitical Landscape

As defence and technology cooperation deepens under the AUKUS security pact between Australia, the United Kingdom, and the United States, governments and prime contractors are increasingly emphasizing supply-chain resilience and ethical business conduct.

This shift places new pressure on SMEs, which form the backbone of these supply chains, to demonstrate their commitment to international anti-bribery standards, robust due diligence, and transparent third-party governance.

“Partnerships like AUKUS are reshaping expectations for transparency and integrity throughout defence and security ecosystems,” said Simon Wardle, CEO of Ethixbase360. “Through our partnership with Veresure, we are helping SMEs and larger organisations alike meet these demands with Tcertification, a globally recognized due diligence review and compliance credential, alongside scalable, technology-driven solutions that align with international standards.”

Empowering SMEs Through Tcertification

A core component of the collaboration is Tcertification, Ethixbase360’s globally benchmarked due diligence and approval process that sets the standard for third-party integrity. As part of the review, candidates must complete global anti-bribery training, adopt a Code of Conduct, and update due diligence information annually. Reports include daily screening of names against international sanctions and enforcement lists.

For SMEs engaged in defence, security, or international trade, Tcertification provides a clear and credible way to demonstrate integrity, access global markets, and build trust with partners, investors, and regulators.

“By integrating Ethixbase360’s technology and certification process, we are helping organisations of all sizes manage third-party risk more confidently and position themselves for growth in complex, high-trust sectors,” said Guy Underwood, Co-Founder at Veresure.

Comprehensive Risk Coverage

Ethixbase360’s platform enables organisations to identify, assess, and mitigate risks across critical areas, including:

Anti-Bribery & Corruption: Risk-based screening, enhanced due diligence, policy management, and third-party certification.
Modern Slavery & Human Rights: Continuous monitoring, assessment, and reporting to meet global standards.
Cyber: From onboarding through assurance, managing vendor cyber exposure and digital resilience.

Together, Veresure and Ethixbase360 deliver visibility, control, and confidence across the value chain, helping organisations strengthen governance, uphold integrity, and build long-term resilience amid heightened global compliance scrutiny.

About Ethixbase360

Ethixbase360 empowers confident third-party risk management through smart automation, expert-led due diligence, and responsive support. Our platform provides a single, connected view of global third-party risk, with insight and audit readiness built in. Designed to flex with risk and change, it adapts to shifting regulations and priorities, giving organizations control and the ability to respond at pace. Its proven configurability is backed by expert teams who bring human intelligence to every decision. Covering Anti-Bribery and Corruption, Modern Slavery, Human Rights, and Cyber, Ethixbase360 helps organizations stay resilient and agile, enabling faster decisions, greater value chain transparency, and clarity in an increasingly complex risk landscape. Learn more at www.ethixbase360.co m.

About Veresure

At Veresure, we specialise in conduct risk and integrity strategy, providing practical, technology-driven solutions that drive cultural change and reinforce accountability. Our focus goes beyond compliance; we help organisations embed integrity at their core.

Our team has conducted numerous risk assessments across Australia, the APAC region, and the Middle East, developing risk registers and frameworks that strengthen governance and resilience. By combining proven methodology with innovation, Veresure helps clients anticipate threats, safeguard reputation, and build cultures of trust and accountability. Learn more at https://www.veresure.com .

For more information on this partnership, please contact Kirsten Trott, Co-Founder, Veresure at kirsten@veresure.com .

The role of whistleblowing in building integrity in the Aged Care sector

Tue, 04 Nov 2025 07:40:25 GMT

By 2050, a quarter of the Australian population will be over 65 and dependent on a sector already stretched to capacity. Resource and funding constraints increases the risks of poor treatment and health outcomes for those in Aged Care, and those persons who identify these risks will require safe and protected means to report to the appropriate stakeholders.

The need for a framework to protect potential whistleblowers has been recognised by the Australian government and as a result, from November 2025, the Aged Care Act 2024 has been amended to require, every aged care provider in Australia to implement a formal, secure whistleblowing system it’s not a nice-to-have, it’s a condition of registration.

Why this shift matters

One of the key findings from the Royal Commission into Aged Care Quality and Safety was that fear of reprisal was silencing staff and families from reporting their concerns. The Royal Commission found that many witnessed poor care but stayed silent, unsure if speaking up would make a difference, or cost them their job.

The new rights-based Aged Care Act changes this… It’s designed around people, not providers. It recognises that transparency isn’t just a compliance requirement; it’s a moral one.

What providers must do

Section 165 of the Act now requires every registered provider to maintain a whistleblowing policy and reporting system that’s accessible, secure and confidential. That includes anonymous reporting channels, whether a hotline or a digital platform, integrated with complaints and incident management processes.

The definition of who can report has also expanded. It now includes employees, residents, family members, advocates, contractors and even governing body members. Under sections 547 to 550, anonymity and confidentiality are protected by law, with civil and criminal penalties for breaches.

What this means for leaders

For boards and executives, the stakes are high. Directors and “responsible persons” now face personal liability for failing to uphold whistleblower protections, including penalties up to $165,000 for serious breaches. The Aged Care Quality and Safety Commission can also issue banning orders and conduct unannounced inspections for non-compliance.

This isn’t just regulatory reform. It’s a culture shift, from silence to safety, from compliance to integrity.

How do Veresure and Veremark support this change?

At Veresure , integrity is at the core of everything we do. We believe protecting people who speak up protects the organisations that serve them.

That’s why Veremark , our trusted partner, provides end-to-end whistleblowing technology and advisory solutions tailored for the aged care sector, from secure anonymous reporting platforms to expert triage, training and program design. Together, we help providers turn compliance into confidence and legislation into leadership.

Speak to us to find out how we can ensure your organisation meets the new standards and how we can strengthen integrity across your care network. Contact us for more information.

The overlooked connection: People risk and cyber risk

Wed, 19 Mar 2025 03:44:44 GMT

In today’s digital-first world, cyber risk is often viewed as a technical problem - one that requires firewalls, encryption, and sophisticated AI-driven threat detection. While these defences are crucial, they only address part of the issue. The greatest vulnerability in any cybersecurity strategy is not the technology itself but the people who interact with it. This is where people risk and cyber risk intersect, and where trust and integrity become essential in managing these challenges.

Understanding people risk: A dual perspective

People risk encompasses both risks to people and risks from people. Traditionally, people risk is considered in the context of workplace health and safety - protecting employees from harm. However, in the cybersecurity landscape, people risk also refers to vulnerabilities created by human behaviour, whether intentional or accidental. This includes:

Phishing Attacks – Employees clicking on malicious links, leading to credential theft or malware infections.

Weak Passwords – The reuse of simple, easy-to-guess passwords across multiple accounts.

Insider Threats – Malicious actions by employees or contractors who have access to sensitive information.

Human Error – Mistakes such as misconfiguring cloud security settings or accidentally sending sensitive data to the wrong recipient.

Lack of Process – Not verifying bank account changes by phone directly with the relevant parties.

Unscreened Staff – Not performing effective background checks on staff and contractors, leading to trust breaches within the organisation.

The concept of trust is central to people risk. Organisations must trust their employees, contractors, and third-party vendors to act with integrity. However, failing to implement the right safeguards can expose businesses to unnecessary risks.

How people risk drives cyber risk

Many of the most damaging cyberattacks occur because of human error or manipulation. Cybercriminals exploit people risk through tactics like social engineering, impersonation, and psychological manipulation. The increasing reliance on remote work and digital collaboration tools has only amplified these risks.

For example, an employee who unknowingly downloads a malicious attachment can compromise an entire organisation’s network, bypassing even the most advanced security measures. Similarly, an unintentional misconfiguration of cloud settings can expose vast amounts of sensitive data to cybercriminals.

When trust is misplaced, or integrity is compromised - whether due to a lack of due diligence or an internal bad actor—the consequences can be severe. Recognising that people risk extends beyond technical mishaps to ethical considerations is crucial for a resilient cybersecurity strategy.

Bridging the gap between people and cyber risk

To effectively mitigate cyber risk, organisations must address people risk through a combination of:

Cybersecurity Awareness Training – Regular training on phishing attacks, password management, and safe online practices.

Strong Access Controls – Implementing multi-factor authentication (MFA) and least-privilege access to limit data exposure.

Behavioural Analytics – Using AI-driven analytics to detect unusual patterns of behaviour that may indicate a security breach.

Culture of Security – Encouraging a workplace environment where employees feel empowered to report suspicious activity without fear of blame, including the implementation of an effective whistleblowing culture.

Clear Policies and Procedures – Establishing clear guidelines on data handling, remote work security, and third-party access.

Know Your Employees and Contractors – Ensuring your organisation has a robust employee and contractor due diligence program to ensure you know who is actually behind your organisation's firewall.

Cybersecurity is not just an IT issue - it’s a people issue. Organisations that fail to recognise the human element in cyber risk expose themselves to preventable threats. By addressing people risk through education, process improvements, and cultural change, businesses can significantly strengthen their cybersecurity posture and reduce the likelihood of costly breaches.

A strong cybersecurity strategy is built on both technical defences and a commitment to fostering a culture of trust and accountability. When people risk is managed with integrity, organisations can create a secure digital environment where both data and individuals are protected.

In the battle against cyber threats, technology is only as strong as the people using it. A comprehensive approach that considers both technical defences and human behaviour is the key to long-term cyber resilience.

Veresure and Apollo Secure are working together to reduce cyber risk and people risk for organisations. Contact us for more information.

When did you last review your reporting software? The problems to watch out for with a traditional whistleblower service.

Wed, 19 Mar 2025 02:53:00 GMT

Implementing a whistleblowing platform is a critical component for any business looking to create a safe, compliant workplace. This is the type of system that mitigates the risk of misconduct, improves employee trust, and provides a safe space for people to flag issues. But just by implementing a system alone isn’t enough to protect your workplace.

Many companies mistakenly believe that their traditional reporting platform is providing them with means to protect their business. Unfortunately, in many situations, their whistleblowing offering is at best outdated, at worst, unusable.

To understand the problem better, it’s a good idea to go back to a big milestone in whistleblowing service history: The 2001 Enron scandal .

After this event, which saw the collapse of the energy giant and its accountancy firm, a piece of legislation called the Sarbanes Oxley Act 2002 was brought in. Known as SOX, this was a federal law that established sweeping auditing and financial regulations for public companies. A component of which was for these organisations to have a whistleblowing hotline system.

This new law prompted a wave of new services offering independent whistleblowing reporting channels via a phoneline. While these covered the bases of what was required under SOX, innovation, new services and changing behaviours meant that a lot of the tech, cost structures and report handling processes soon became obsolete.

Considering the fast-moving nature of tech, and the fact that whistleblowing software is often a compliance must-have, it’s critical for all businesses to carry out routine checks of their reporting systems.

Why all whistleblowing services needs regular reviewing

Many organisations have had a whistleblowing policy for a long time. Over the years these systems were put in place, social, technological and regulatory changes have taken place.

Reports of misconduct may be non-existent in your business. But is that because your business has watertight systems in place and a 100% trustworthy workforce? Or, is it that perhaps your system hasn’t been usable for potential whistleblowers to flag issues?

From changes to the way we communicate, to obsolescent tech - has your whistleblowing system adapted to your modern workplace?

Here are a number of reasons why your traditional system might be letting you down:

Tech has transformed how we communicate: as smartphones, social media and digital tools have grown in prevalence, the way we communicate has changed. In a more digitally-native society, people are less inclined to speak via a phoneline, preferring to use messaging apps, voice notes and online tools to express themselves. Reflecting these trends is the ACFE’s report into occupational fraud , which talks about the rise of online reporting, stating that web-based/online reporting rose from 24% of complaints in 2016 to 40% in 2024. However, whistleblowing via telephone has decreased across the same timeframe, from 40% to 30%.

Traditional processes have huge drawbacks: The other risk with the traditional telephone hotline is that many are set up in costly, highly-structured call centres, where call handlers follow a script. Many users of these systems complain that reports often have limited information contained within them, and without a direct feedback mechanism, it can sometimes be difficult to effectively progress the complaint.

Existing tech is a poor fit for modern business: The tech and processes behind the telephone service have not advanced with newer ways of working and handling disclosures. Many of these pieces of technology don’t consider organisational integration (e.g. agile access controls) with newer technologies, whistleblower user experience and different mechanisms to progress the complaint (advice, education, refer etc).

Your ‘compliant’ system might no longer be so: Simply having a system in place doesn’t necessarily mean you’re conforming to your legal obligations. Laws and regulations governing whistleblowing often evolve, such as the EU Whistleblower Protection Directive or industry-specific rules. Regular reviews ensure the software remains compliant with these requirements, avoiding legal risks for your organisation.

Old tech can often equal big security risk: Whistleblowing software often handles sensitive information, and traditional systems have been known to be easily targetable. Modern software can massively reduce this kind of vulnerability, ensuring robust protection against data breaches or unauthorised access.

Is your system up to modern day demand? As your business grows, the volume of reports or the complexity of cases going through your business might increase. This is why it’s essential that your software helps ensure it performs efficiently, scales effectively, and meets organisational demands.

A regular focus on your whistleblowing system sends out a good signal: When your workforce is aware of updates, improvements and regular reviewing of the software that is so important to the safety of their environment, it reinforces trust in both you as employers and the system they might need to use one day.

Case Study

Organisation B was a provider of a traditional independent whistleblower telephone service. They subsequently updated their primary complaint intake method, from telephone to online reporting.

The organisation did a lot of internal work with its client base in designing a technology interface that could be easily used as online reporting only.

Over a 12-month period, B’s clients complaints went from 85% telephone, 15% online to 74% online and 26% telephone.

Most telling however was the extra volume of complaints received over the same 12-month period, with a 62% increase across the client base that used the platform.

This adaptation to more modern user requirements clearly shows better useability. But it’s important to remember the traditional methods were not removed - the ability to call through an issue remains, as there was clearly a requirement for it. The system has - through communication with its clients - simply added more popular methods of contact to its usage.

Whistleblowing software that moves with your business’s requirements

Like all workplace software, a business’s whistleblowing system needs regular reviewing for efficiency, useability and reliability. You may discover that different channels of reporting are needed, even though there still is a place for in-person and telephone reporting. But it’s key to closely assess the market and your existing provider and carefully consider the right solution for your risk profile and workforce.

Don’t let outdated processes hold you back.

Take the first step in ensuring your whistleblowing system is fit for today’s workplace. Contact us .

The perils of not having a secure and anonymous whistleblower reporting channel

Wed, 26 Feb 2025 02:39:18 GMT

With cultural shifts and an increase in legal protections, whistleblowing disclosures are on the rise. But for any business that wants a channel to flag unethical behaviour, the focus should be on the quality of the tech: your reporting software will only work for you, if it works for your people.

High profile cases, social movements and better safeguarding laws have done a lot to raise the profile of whistleblowing over the last decade. But in order to highlight potential issues, is the platform you provide your workforce up to the job?

Why your whistleblowing channel might not be helping your workforce

If your business is experiencing problems with your whistleblowing system, it’s likely due to issues with its design, your company culture or communication problems. In our experience, it’s usually down to the following:

It’s not anonymous

A huge problem in whistleblowing is the fear of speaking out. An employee may feel the need to stay quiet on an issue if they feel their safety or job prospects could be compromised. Which is why anonymity is critical, and the ability to facelessly flag a problem is fundamental to your system.

By providing this level of protection, you are demonstrating a commitment to ethical practices, employee wellbeing and compliance to whistleblowing protection laws.

It’s not secure

Whistleblowing can involve the handling of highly sensitive information, and the identity of the whistleblowing and the subjects involved must be protected.

Breaches or weak systems can expose whistleblowers, and lead to data being misused or extorted. End-to-end security measures, robust cybersecurity practices and a strong audit trail are non-negotiables for an effective reporting channel.

The dispute handling isn’t efficient

A poorly designed reporting process will put off users. Whether it’s slow, complex, or unclear, it’s your responsibility to research how your employees find it.

Simply the process by using software that makes reporting quick and accessible. Provide multiple reporting options - via phone, messaging portal or email that allows anonymous submissions. And ensure the resolution process is handled professionally and legally.

Your whistleblowing policy needs work

Many organisations have policies that were drafted years ago. Since then, the business has changed, evolved and processes developed. Does your policy reflect your business as it is today?

Evaluate your whistleblowing policy regularly and ensure that your workforce is kept abreast of changes, enhancements and new amendments to it.

People aren’t aware of the service

Implementing a whistleblowing channel isn’t a box ticking exercise. Its presence needs to be highlighted as often as possible, particularly in a new hire’s onboarding.

Educate your new employees on the existence, purpose and process of the channel - and also what typical issues can look like.

The channel is not separate from management

Misconduct can happen in every strata of the organisation. However, if employees witness unethical behaviour from senior management, they are less inclined to report it if disclosures are handled within the same team.

To avoid this conflict of interest, disputes need to be raised and handled by a team separate from the operations of the business. Either by a third party or a department separate from the main hierarchy.

Your workplace has a culture of silence

Culture or sub-culture issues typically emerge, such as a bystander culture, where people accept poor behaviour and don’t challenge it. It can turn into an attitude of ‘but that’s just how Bill is, he’s always been like that…’

Often, there will be staff inside the organisation that won’t ethically agree with what they see and know something is wrong, but some of the above cultural norms create a culture of silence and subsequently matters go unreported.

Fostering a culture of openness can change this, where speaking up is encouraged and valued. Train your leadership to model ethical behaviour and support employees who raise legitimate concerns.

Having impartial reporting channels also alleviates the above concerns by reporters. The case study below is a great example of this type of scenario.

Case Study: how an unclear whistleblowing policy enabled $2.5m fraud activity

We recently worked on a case where Organisation A was delivering a large infrastructure program. As part of the exercise, a senior manager was responsible for supplier engagement and onboarding vendors to help deliver the program.

Behind the scenes, the senior manager was colluding with some of the vendors, by allowing them to inflate invoices for goods and services delivered.

This type of procurement fraud is typically wrapped up and concealed in the subsequent invoice process with the senior manager approving invoices, and price variations to invoices, and so on.

The inflated amount was shared between the senior manager and the vendor. This is a common type of fraud and is sometimes referred to as a kickback or bribe.

Emboldened by the ruse, the senior manager and one of the vendors started to charge for goods and services not delivered at all - a crime known as dummy invoice fraud.

This was what brought them unstuck. An anonymous tip off was sent to the regulator directly, and led to an independent investigation.

The regulator commenced an investigation, and when a deep dive of the invoices was undertaken, it was discovered that some of the projects on the fake invoices never existed. The approval footprint and the invoice went back to the senior manager and supplier, which led to criminal proceedings and termination of both parties from the organisation.

What also transpired during the investigation, when other employees were interviewed, was that they had concerns about the senior managers’ conduct but did not know where or who to report to.

People were very nervous about going above him because of his seniority and perceived power.

There were also concerns about going to other people within the business, because of the ‘don’t shoot the messenger’ view and the power imbalance and lack of impartiality would leave them too much at risk. The result was silence, and that’s how a large fraud was able to take place.

There was not a secure, independent, anonymous reporting channel in place. The fraud was close to $2.5 million by the time the regulator concluded their investigation. It is highly likely an earlier, anonymous tip off would have saved the business a significant amount of money, and stopped the fraud earlier if staff had spoken up earlier.

How to implement a usable, but secure, whistleblowing system in your organisation

This case study demonstrates that both internal and external reporting channels are needed, including an online, secure, anonymous reporting channel. Ideally, this would be separated from line management, so employees feel more comfortable and confident in raising issues

At Veremark, we offer an end-to-end secure solution that focuses on well-designed online reporting - which helps our clients collect good quality information - and effective resolution through a best practice policy framework.

Take the first step towards an effective whistleblowing framework today. Contact us to assess your current system and create a safer, more ethical workplace.