By: James Helme, Will Morris, Jacky Griffiths, Ali Crotch-Harvey
22 Jun 20267 min read
There are overlapping drivers that are reshaping speak-up and frameworks and investigations. A range of overlapping legal, regulatory and organisational drivers are reshaping speak‑up frameworks and investigation practices.
First, employment law: The Public Interest Disclosure Act 1998 (PIDA) and the Employment Rights Act 2025 position. The baseline remains the protected disclosure regime. Effective earlier this year (6 April 2026), the Employment Rights Act 2025 removed ambiguity, making it clear that disclosures about sexual harassment are protected disclosures. Organisations should check whether their policies and processes need to be updated to reflect this change.
Second, the Economic Crime and Corporate Transparency Act. Whilst ECCTA did not amend whistleblowing law directly, it raised the legal and operational stakes, with whistleblowing frameworks a key ingredient within reasonable procedures for preventing fraud. For unlisted firms that are not covered by the Financial Services legislation, this may be the first time that there has been a legal imperative to have an effective whistleblowing framework. Taken together, they increase the value of effective internal escalation routes and defensible investigations, because delay, weak documentation, or unclear ownership creates avoidable exposure.
Third, FCA (Financial Conduct Authority) expectations are pushing firms towards more structured governance and oversight. This includes bringing a much larger pool of firms within the regulations relating to serious non-financial misconduct. The key planning point is the 1 September 2026 implementation date, so firms need to align HR, speak up and investigation processes now, not later.
Fourth, the Institute of Internal Auditors (IIA) Topical Requirements on organisational behaviour will require internal audit functions to formally assess organisational behaviour, including behavioural drivers and culture. This is effective from December 2026.
Across all regulatory and professional standards, behaviours that promote transparency, accountability and psychological safety are increasingly recognised as critical to sustaining an effective speak‑up culture
There may also be further changes in the pipeline, as the government has announced consultation in summer 2026 on whistleblowing and the use of NDAs, both of which may lead to changes in policy or legislation.
Together, these drivers matter because they leave far less room for discretion or informality: firms need faster routing of concerns to the right governance channels, clearer audit trails and demonstrably robust handling from intake through to outcome.
A continuing trend emerging from investigations is the overlap between financial and non-financial misconduct. Investigation mandates are increasingly covering conduct and culture alongside financial wrongdoing as primary subjects from investigations often displaying indicators of both. This convergence is often behavioural, with the most common red flags demonstrated including:
The UK is beginning to explore whistleblower incentivisation more actively with the SFO (Serious Fraud Office) and FCA both signalling openness to reward-based models. However, it is in relation to tax fraud where there has been substantive change with HMRC strengthened reward scheme, announced in November 2025, offering between 15% and 30% of recovered tax (with a minimum threshold of £1.5 million recovered) for people who report serious tax avoidance or evasion. This represents a significant shift from earlier approaches, where rewards were limited and not directly linked to outcomes. Questions remain about the effectiveness of incentivisation with research consistently highlighting two key barriers to reporting: a fear of reprisals and a lack of confidence that the business will tackle the issues being reported.
Financial incentives do not necessarily address these concerns. In practice, individuals most likely to come forward, including those in senior or informed roles, are motivated by factors other than financial reward.
The statutory audit industry is changing, with a renewed industry focus on audit quality, and changes to ISA 240 placing greater emphasis on auditors and their obligations to obtain reasonable assurance that the financial statements are free from fraud. As a result, they are increasingly:
Internal Auditor functions have an increasingly important role to play and with the introduction in December 2026, of the IIA Topical Requirements on organisation behaviour, IA functions will be expected to assess not only what outcomes are achieved, but how activities are performed and the behaviours that underpin delivery. Assessment of behaviours will become an integral component of audit plans, whether through whistleblowing, speak up reviews, broader culture and behaviour review or feature as part of every audit.
This will support an organisation in identifying gaps or misalignment between expected and actual behaviours, including how these are managed by the organisation and overseen by the Board.
As noted previously Responding to whistleblowers in 2026, reports are becoming longer and more detailed, with many individuals now using generative AI to prepare submissions. In some instances this is giving organisations clearer insights, but it is also placing greater demand on compliance teams, as AI generated reports tend to be longer and may include specific terms designed to trigger an investigative response. On the other side of the coin, AI is speeding up document review processes and creating a new repository of evidence of wrongdoing in the record of contemporaneous AI prompts used by employees.
Taken together, these developments point to a clear set of priorities. Organisations should focus on:
Whistleblowing is no longer just about enabling individuals to speak up. It is about how organisations listen, respond and demonstrate that they can act decisively and transparently in an increasingly complex environment.
Whistleblowing is entering a new phase. Recent legislative changes, including updates under the Economic Crime and Corporate Transparency Act and the Employment Rights Act, are reshaping what effective reporting and response look like for large organisations.
The Department for Business and Trade recently commissioned us to independently review the whistleblowing framework in England, Wales, and Scotland (Great Britain). Ali Crotch-Harvey, Peter Harris, Will Morris, and James Helme share our findings, which reveal a complex and challenging landscape.
Unethical behaviour can damage an organisation's reputation. Knowing the warning signs and using data to assess risk are critical for shaping interventions.
