Whistleblower policy

This policy outlines how identified wrongdoing and misconduct can be reported safely and securely, and how we protect and support the whistleblower. It is important to understand what matters can be reported and who can make a disclosure under the law.

Our Whistleblower Policy aims to:

• Promote ethical behaviour - to create a culture of honesty, transparency, accountability and compliance within NMHPA policies and values.
• Provide a safe reporting process - for employees, contractors or stakeholders to report misconduct without fear of retaliation, harassment or dismissal.
• Detect and prevent wrongdoing early - reports may involve fraud, corruption, theft, discrimination, bullying, harassment, safety violations, breaches of law or good faith, and unethical conduct.
• Establish clear procedures - this policy explains what can be reported, who can make a report, how reports are investigated, and how outcomes are managed.
• Strengthen trust and governance - stakeholders such as employees, participants, regulators and funding bodies are more likely to trust organisations that handle misconduct transparently.

Whistleblowers - who can make a report

An eligible whistleblower is a person who is, or has been:

• An employee of NMHPA (current or former, permanent, part-time, fixed term or temporary, interns, and secondees)
• An NMHPA Board member (former or current)
• A supplier of goods or services to NMHPA, or an employee of a supplier (including current or former contractors, consultants, external service providers and business partners)
• An associate of NMHPA, including a relative, dependant or spouse of any person referred to above.

Anonymous disclosures - it's your choice

Whistleblowers may choose to remain anonymous when disclosing a Reportable Matter, over the course of the investigation, and after the investigation is finalised.

We encourage whistleblowers to share their identity when making a disclosure, as this helps us communicate and assist with investigations, but it is not a requirement. If a whistleblower doesn't share their identity, we will still assess and investigate the disclosure. However, there may be some limits to conducting the investigation.

Reportable matters - what can be disclosed

An eligible whistleblower who has reasonable grounds to suspect serious misconduct can disclose:

• Negligence, default, breach of trust, or breach of duty
• Financial impropriety such as fraud, corruption, bribery, misuse of funds, and unauthorised use or alteration of financial documents
• Concealment of wrongdoing, other serious impropriety or corrupt conduct
• Improper state of affairs or circumstances within NMHPA
• Behaviour that represents a danger to the public or the financial system
• Breaches of the Corporations Act
• Breaches of the Taxation Administration Act.

Not covered by whistleblower protections

Personal work-related grievances, which generally relate to an individual's own employment, are not Reportable Matters and are not protected under this policy or associated legislation - unless they also involve a breach of law or significant misconduct.

Making a report

The first step is to gather information for the initial assessment of the matter, including:

• Details of the suspected wrongdoing - what happened and the names and roles of the people involved
• Type of misconduct - fraud, corruption, harassment, safety breach, legal violation, etc.
• How the conduct may breach laws, policies or ethical standards
• Any witnesses or others who may have relevant information
• Dates, times and locations
• When and where the events occurred, and whether the conduct is ongoing
• Evidence or supporting material, including emails, documents, invoices, photos, messages, recordings, or other records including notes of conversations or meetings
• Whether the whistleblower directly witnessed the conduct or learned of it through other means
• Contact details (if not anonymous).

Proof beyond doubt - do you need it?

A whistleblower generally does not need proof beyond doubt before reporting. It is assumed that the reporting person acts honestly and has reasonable grounds to suspect misconduct. Eligible whistleblowers are entitled to legal protections, even if the disclosure is not substantiated. This protection extends to a person who assists with or participates in an investigation.

Who to report an alleged matter to

Disclosures should be made to an Eligible Recipient, as defined under the Corporations Act 2001 (Cth).

Stopline

Stopline is an independent whistleblowing service engaged by NMHPA to receive disclosures. You can contact Stopline via:

• Phone: 1300 30 45 50, 
• Website: Stopline NMHPA - make a report
• Email: makeareport@stopline.com.au
• Post: NMHPA, c/o Stopline, PO Box 403 Diamond Creek, VIC 3089

Alternative Eligible Recipients include:

• NMHPA Board members
• ASIC or APRA - regulatory bodies
• NMHPA senior leaders - our CEO, General Operations and Human Resources Manager, Company Secretary, or Risk and Compliance Officer

Handling and investigating an eligible disclosure

Investigation process

NMHPA is committed to conducting objective, fair and independent investigations of disclosures. For some disclosures, we will opt for an external investigation by Stopline.

Our step-by-step process for disclosures that qualify for protection:

1. Receive - by an eligible recipient
2. Acknowledge receipt - within a reasonable timeframe
3. Assess and address any immediate risks
4. Confirm it meets the whistleblowing criteria
5. Investigate or review
6. Send regular updates - to the discloser and NMHPA
7. Share the outcome - recommendations and findings will go to all involved
8. Close the investigation and record the outcome
9. Support disclosers - disclosers and other employees will be referred to professional services
10. Review and improve our processes - for continuous improvement.

Assessing a disclosure

An eligible recipient assesses a disclosure to determine:

• If it meets the criteria outlined in the Corporations Act 2001 (Cth)
• The seriousness of the disclosure
• The quality of information or evidence provided
• If it concerns serious systemic conduct
• Whether similar disclosures have been received
• If it involves eligible recipients, significant financial matters, or noncompliance
• If we should investigate.

If the disclosure does not meet the criteria or does not warrant an investigation, we will try to resolve the matter with the discloser or refer them to the appropriate personal grievance policy.

Information security

NMHPA must take all reasonable precautions to securely store records relating to reportable conduct and limit access to authorised persons only.

Any unauthorised disclosure of information about a report, the identity of a discloser, or information from which the identity of the discloser could be inferred, will be regarded seriously and will be subject to disciplinary action, up to and including dismissal.

Disclosers implicated in an action of reportable conduct

Even though a discloser may be implicated in the reportable conduct, they must not be subjected to any actual or threatened retaliation or victimisation for making a disclosure in accordance with this policy. However, these protections do not absolve the discloser from the consequences of their own involvement in wrongdoing.

Concluding the investigation

Final report

A final report will be prepared by the investigator, detailing:

• The substance of the initial report and reportable conduct
• The initial inquiry and the investigation process, including who was responsible and how independence was maintained
• A summary of the evidence obtained through information gathering and interviews
• A summary of the responses or defence of any person(s) implicated (if applicable)
• A final conclusion or opinion based on the evidence obtained
• Recommendations for actions based on the conclusion, including disciplinary actions if appropriate
• Recommendations to prevent the occurrence of similar issues, such as process or policy changes, sharing case studies, or training.

The final report will consider any privacy and confidentiality requirements and is not intended for general distribution. The final report will be provided to the Board for information and consideration of the conclusion and recommendations, for endorsement or other action. The outcomes may be referred to other committees as appropriate.

Communications with person(s) implicated

Reasonable steps will be taken to ensure fair treatment of any person who is the subject of a report during the assessment and investigation process.

NMHPA will ensure that the person who is the subject of any report:

• Is informed of the substance of the allegations
• Can respond to the allegations before any investigation is finalised
• Is informed of any adverse comments included in the formal report before finalisation
• Has access to the Employee Assistance Program (EAP).

If preliminary inquiries determine that the allegation is unfounded and that no formal investigation is warranted, the matter will be dismissed. The CEO (or Board Chair) decides whether the person named is informed - they may choose not to inform the named person to preserve integrity, support workplace harmony, or protect the discloser.

Where a formal investigation does not substantiate the report, the facts, outcomes and the identity of any person(s) allegedly implicated will remain confidential.

Record keeping and transparency

Irrespective of outcomes, the CEO and any appointed investigators must:

• Maintain appropriate records of the disclosure, inquiries, investigations, outcomes and any decisions or recommendations, with appropriate security in place
• Inform the discloser of the progress and outcomes of inquiries and investigations in a timely manner, subject to privacy and confidentiality considerations.

Responsibilities

Receiving a disclosure

Disclosure recipients are responsible for:

• Ensuring the integrity of the whistleblower process within NMHPA
• Receiving and assessing whistleblower reports and disclosure reports of wrongdoing confidentially and sensitively
• Taking steps to protect the whistleblower's identity (e.g. redacting identifying details, ensuring document security)
• Ensuring whistleblowers are provided the protections due under this policy and by law
• Where a whistleblower disclosure is identified, determining the appropriate nature and scope of the investigation and initiating it at the earliest possible opportunity
• Assessing the risk of detriment to a whistleblower and taking practical and supportive action to protect a whistleblower from the risk of detriment as soon as possible.

Board members

The NMHPA Board is responsible for:

• Ensuring a culture of integrity, good governance and reporting of wrongdoing and/or misconduct is fostered across NMHPA
• Leading by example and upholding the highest standards of conduct
• Maintaining the confidentiality of a protected whistleblower, and ensuring that protected whistleblowers are systemically and practically protected
• Promoting and overseeing the effective implementation of this policy.

CEO

The CEO is responsible for:

• Exhibiting high standards of integrity and conduct
• Maintaining the confidentiality of a protected whistleblower, and ensuring that protected whistleblowers are systemically and practically protected
• The provision of training and ongoing awareness of this policy to staff
• Ensuring disclosures are investigated appropriately with reference to legal requirements, principles of natural justice and procedural fairness.

Senior leaders

Senior leaders are responsible for:

• Promoting a culture of integrity and reporting misconduct
• Identifying wrongdoing at the earliest possible opportunity
• Advising staff regarding what constitutes a reportable matter
• Maintaining the confidentiality of a protected whistleblower, and ensuring that protected whistleblowers are systemically and practically protected
• Directing employees to eligible recipients (within and outside NMHPA).

Employees

Employees are responsible for:

• Acting with integrity and reporting alleged misconduct in accordance with this policy
• Understanding the types of disclosures that are protected under this policy
• Respecting the confidentiality of whistleblower reports and the investigation process, and cooperating with investigations when required.

Legal protections for disclosers

Under whistleblower laws, NMHPA and any person receiving confidential information must keep the identity of the discloser confidential, unless the discloser provides consent.

Disclosers are entitled to protection from detrimental acts or omissions (e.g. malicious reporting, dismissal, demotion, threats), access to compensation and remedies if they suffer loss, damage or injury, and protection from civil, criminal and administrative liability in relation to their disclosure.

Definitions

• ASIC - Australian Securities and Investments Commission
• APRA - Australian Prudential Regulation Authority
• ACNC - Australian Charities and Not-for-profits Commission. NMHPA is registered as a not-for-profit organisation with the ACNC. The ACNC is not an eligible recipient under whistleblower protections. A disclosure made directly to the ACNC will not be covered by the protections in this policy.
• Eligible Recipient (including Disclosure Recipient) - A person or position to whom a protected disclosure of a Reportable Matter can be made.
• Whistleblower / Discloser - A person who reports a Reportable Matter. In this policy, the term "Discloser" is used when referring to legal protections, and "Whistleblower" is used in practical guidance.

Legislative compliance

This policy and its associated procedures have been developed using up-to-date information and resources. This policy is aligned with, and guided by, the following legislation:

• Corporations Act 2001 (Cth)
• ASIC Corporations (Whistleblower Policies) Instrument 2019/1146 (Cth) — Public Interest Disclosure Act 2013 (Cth)
• Income Tax Assessment Act 1997 (Cth)
• Taxation Administration Act 1953 (Cth)

Review of this policy

Mandatory annual training will be provided to staff via the Sentrient course, Whistleblower Rights and Protections.

A formal review of this policy will occur annually, or earlier where there has been a change in law or regulation. This policy will be reviewed by the Risk and Compliance Officer and submitted to the CEO, who will make recommendations to the Board. The Board is responsible for approving this policy.