Whistleblowing & Speak-Up Policy

1. Purpose and intent

Provides a framework for raising concerns about suspected wrongdoing, misconduct, safety or serious control failures. This policy is intended to provide a consistent reference for decisions, conduct and controls. It should be read alongside applicable laws, contractual obligations and relevant internal procedures. Where requirements differ, the applicable legal requirement and formally approved internal control take precedence.

2. Scope and application

Available to employees and, where appropriate, contractors, suppliers, business partners and other stakeholders who raise concerns connected with the organisation.

Business partners are expected to observe equivalent standards where these are relevant to the services they provide or the activities they undertake on the organisation’s behalf. Application should be proportionate to role, activity, risk and applicable legal requirements.

3. Core principles

• Good-faith reporting: concerns may be raised on a reasonable belief; proof is not required before reporting.
• Confidential handling: information is shared only with those who need it to assess or investigate the matter, subject to law.
• Fair assessment: reports are reviewed impartially and proportionately.
• Protection: retaliation against a person for raising a concern in good faith or participating in an investigation is prohibited.
• Due process: persons named in a report should be treated fairly and findings should be evidence-based.

4. Minimum standards and controls

The following controls describe the expected minimum approach. Specific procedures, approval limits, forms and technical controls may be established separately and updated through controlled internal documents.

• Report suspected fraud, bribery, harassment, discrimination, serious safety breaches, environmental harm, retaliation, falsification or deliberate control circumvention.
• Provide dates, locations, persons involved and supporting information where safely available.
• Do not conduct unauthorised investigations or access records unlawfully.
• Preserve relevant evidence and cooperate with authorised enquiries.
• Escalate urgent threats to life, safety or the environment immediately through emergency channels.

5. Roles and accountability

Reports should be directed to an appropriate manager or designated independent reporting contact. Where a concern involves the normal reporting line, an alternative senior or independent channel should be used.

Any person who is uncertain about the application of this policy should seek guidance before taking action. No individual may override a legal obligation or approved control without appropriate authority and documented justification.

6. Reporting and escalation

Concerns, suspected breaches, control weaknesses and incidents should be raised promptly through the relevant management or designated reporting channel. Urgent threats to health, safety, the environment or the security of information must be escalated immediately. Reports should be handled fairly, sensitively and in accordance with applicable privacy and records requirements.

7. Monitoring, assurance and review

Acknowledgement, triage, investigation and closure should be documented where practicable. The organisation should monitor themes, response times, substantiation and retaliation risks. Knowingly malicious allegations may be addressed separately.

Where improvement actions are identified, they should be assigned to an accountable owner, given a proportionate target date and monitored to closure. Material changes in law, risk, organisational context or operating arrangements should trigger an earlier review.

8. Non-compliance

Failure to follow applicable requirements may result in corrective action, additional training, restricted authority, disciplinary measures, contractual remedies or referral to relevant authorities, depending on the circumstances and applicable law. Any response should be proportionate and follow fair process.

9. Related policies and standards

Anti-Bribery; Code of Conduct; Human Rights; QHSE; Data Protection.

Additional policy requirements

The following provisions expand the practical expectations set out in this policy. They should be applied in conjunction with applicable law, approved internal procedures, contractual obligations and the circumstances of each activity.

Reportable concerns

Concerns may include suspected fraud, bribery, corruption, unlawful conduct, serious safety or environmental risks, harassment, retaliation, deliberate concealment, misuse of assets, material data misuse or attempts to suppress a report.

Good-faith reporting

Reports should provide as much factual detail as reasonably available, including dates, locations, persons involved, relevant records and immediate risks. A reporter is not required to prove wrongdoing before raising a genuine concern. Knowingly fabricated or malicious allegations may themselves be addressed under applicable procedures.

Confidential handling

Information should be shared only with persons who need it to assess, investigate or resolve the concern. The identity of a reporter should be protected to the extent reasonably practicable and permitted by law. Absolute anonymity or confidentiality cannot be guaranteed where disclosure is legally required or necessary for a fair process.

Non-retaliation

Retaliation, threats, adverse treatment, intimidation or attempts to identify or punish a good-faith reporter are prohibited. Any suspected retaliation should be escalated and assessed as a separate concern.

Assessment and closure

Reports should be acknowledged where contact details are available, triaged for urgency and conflicts, and assigned to an impartial reviewer. Outcomes and corrective actions should be documented. The reporter may receive a status or closure update where lawful and appropriate, while respecting privacy and investigation confidentiality.

10. Document governance

This web page is a public policy statement. The controlled internal version, where formally approved, is maintained through the organisation’s document-control process. Approval status, document owner, effective date, review cycle and revision history must be confirmed in the controlled document register before this text is represented as a formally issued internal policy.