A Quiet Log Is Not a Clean Bill: Auditing the Speak-Up Channel Each Quarter

A board pack that records no whistleblowing disclosures for four consecutive quarters can look like a certificate of health. It may instead be a warning that the route is unknown, mistrusted or quietly discouraged. The distinction matters. Regulators, external auditors and employment tribunals increasingly ask not whether a policy exists, but whether the channel works in practice. For directors, the assurance question is therefore not how many reports were received, but what has been done to prove the route is open, safe and acted upon.

Silence has several causes

A low volume of disclosures is ambiguous evidence. It may reflect a healthy culture in which concerns are raised early and resolved locally. It may also reflect a channel that staff do not trust, a process that is unclear, or a managerial culture in which raising a concern is treated as disloyalty. Contractors, agency workers and former employees may be excluded in practice even where the policy appears broad. Language barriers and poorly explained confidentiality can have the same effect.

Boards should therefore resist treating a quiet log as a clean bill. The more useful question is whether the company has tested the route recently, followed a case through the system, and looked for signs that people who raise concerns are treated fairly afterwards. That is an assurance exercise, not a policy review.

Test the route as a user would

At least once a quarter, the company should test each advertised route into the speak-up process. That means a test report submitted through the telephone line, the web form, the postal address and any other channel named in the policy. The test should be made by someone independent of the executive team, and the results should be logged: date, method, time to acknowledgement, time to triage, whether confidentiality was explained, and whether the tester received a substantive response.

A test that only confirms an inbox receives mail is not assurance. The exercise should check whether the route is available outside normal office hours, whether it can be used anonymously where the policy says so, and whether the language and instructions are clear to a reasonably informed user. If the channel is operated by an external provider, the contract should require evidence of testing and response times, not merely service availability.

Follow the case file, not the policy

Policy documents describe what should happen. Case files show what did. Each quarter, the audit committee or a delegated subgroup should sample open and closed cases and trace them from receipt to outcome. The sample should test whether triage decisions were made against stated criteria, whether conflicts of interest were checked, whether the investigation was independent, whether the audit committee chair was informed where the policy required it, and whether the complainant received appropriate updates.

Where there have been no cases, the board should not simply record a nil return. It should run a tabletop exercise using a plausible scenario and document how the process would operate. The resulting note should identify who would decide, on what basis, within what timeframe, and with what oversight. That record is more credible than an untested assertion that the process is understood.

Non-retaliation requires evidence

Non-retaliation is often treated as a statement in a policy. In practice, it is a pattern that must be tested. The review should examine what happened to complainants and to those who supported them: appraisals, promotions, role changes, shift allocation, contract renewals, disciplinary action and exits. It should also consider whether confidentiality was preserved in practice, and whether managers received guidance on handling concerns without signalling disapproval.

A small company may not have enough cases for statistical comparison, but it can still review individual outcomes and ask whether the treatment of the individual was consistent with the treatment of comparable colleagues. The point is not to assume retaliation. It is to look for it deliberately, because an employment tribunal will ask whether the board took the risk seriously before a claim arose.

Board reporting should show proof, not just counts

A single number of disclosures invites false comfort. A more useful quarterly report covers channel availability, test results, acknowledgement times, case ageing, outcomes, repeat themes, training completion and non-retaliation indicators. It should distinguish between concerns resolved locally and those escalated formally, and it should record the questions the board asked rather than only the answers it received.

Minutes should capture challenge. If the report shows no cases and no testing, the board should say so and require action. If it shows cases but no outcomes, the board should ask why. The report is not an operational dashboard for its own sake; it is the evidence trail that shows the board exercised oversight.

A quarterly routine that leaves a trail

A practical sequence is straightforward. In the first month, test every channel and record the results. In the second, sample case files or run a tabletop exercise, then check escalation and independence. In the third, review non-retaliation indicators, approve remedial actions and take the consolidated report to the board or audit committee. The company should retain the test logs, case sample notes, meeting minutes and action tracker in one place.

That file should be capable of being shown to a regulator, auditor or tribunal without reconstruction. If a regulator asks in 2026 what assurance the board had over its speak-up arrangements, the answer should be a dated record of testing and oversight, not a recollection that the policy was reviewed some years ago. A quiet log may be good news. Without evidence, the board cannot know.