The guidance is 76 pages long and is quite detailed. Some of the most important information contained in the guidance is set out below and will help inform what constitutes best practice for employers when dealing with reports made under the updated protected disclosures regime.

General Guidance

• The guidance states that overall responsibility for procedures for internal reporting should rest with the head of the public body. Oversight of the procedures should rest with the Board of the public body (or equivalent), while day to day responsibility should be delegated to an appropriate function of the public body with the requisite authority, independence, knowledge and expertise to operate the procedures correctly.
• Public bodies should also consider appointing a senior individual in the organisation to “champion” the protected disclosures process and to promote and drive cultural change and a change in attitudes to protected disclosures among all employees of the body. Bodies should strive to create a culture where the making of protected disclosures is seen as a positive thing, rather than having any negative connotations. Training and awareness on protected disclosures and on the procedures should be provided to all employees, and regularly refreshed.
• Bodies should ensure that the procedures are easily available to all categories of workers (including current and former employees, independent contractors, trainees, agency staff, volunteers and job candidates). In addition to providing a copy of the procedures to its workers, it is also recommended that the public body communicates the existence of the procedures appropriately. General awareness training should be provided to all workers.
• Senior management should be kept appraised of protected disclosures received by the public body. The level of detail needed to be provided may vary from case to case, however for a disclosure that raises serious issues for the public body, senior management may need to be provided with all details of the disclosure. Only where it is absolutely necessary should this information include the identity of the reporting person.
• The guidance also contains a handy checklist for protected disclosures policies, most (although not all) of which is relevant for employers generally at Appendix B of the guidance.

Internal reporting channels and procedures

The guidance recommends that the following information be included in the internal reporting channels and procedures:

• a succinct policy statement confirming the Board’s commitment to creating a workplace culture that supports the making of protected disclosures and provides protection for reporting persons.
• encouragement to workers to provide specific factual information in any disclosure to allow the appropriate assessment and investigation of the disclosure but should be informed that they are no required or entitled to investigate matters themselves to find proof of their suspicion and should not endeavour to do so.
• confirmation that no reporting person will be penalised simply for getting something wrong so long as the reporting person had a reasonable belief that the information disclosed showed, or tended to show, wrongdoing, along with confirmation that motivation is irrelevant when determining whether or not a report is a disclosure protected by the Act.
• a statement that the worker must make a report in the manner set out in the Act to gain the protections of the Act and that higher standards apply when the protected disclosure is made externally.
• confirmation that it is preferable in most circumstances to disclose to the employer and, if that is not appropriate, to use one of the options of prescribed persons, Minister or Protected Disclosures Commissioner. The procedures should explain that there are stringent requirements for alternative external reports to qualify as protected disclosures under section 10 of the Act (i.e. disclosures to other third parties).
• information in relation to the external remedies available to workers who believe they have been penalised for making a protected disclosure.
• a dedicated email address for receiving written reports or a dedicated phone number / voicemail system for receiving oral reports or both, as appropriate. Access to the email inbox or voicemail system used must be restricted solely to persons designated to receive and handle reports.
• the information that should be included in the initial acknowledgement. The acknowledgement should provide further information about the protected disclosures process and enclose or link to the procedures that will apply to the handling of the report. The acknowledgment should endeavour to set expectations early as to what will happen – and when – after the report is made. Information should be provided in relation to the protection of the identity of the reporting person and protection from penalisation.
• confirmation that an initial assessment, or screening process, must be undertaken when a report is made. This need not be solely carried out by the designated person, but can be delegated to another authorised person, as appropriate.
• information in relation to feedback, namely the type of feedback that will be provided, as well as the type of feedback that will not be provided, and that the reporting person may request in writing further feedback at three month intervals.
• the measures that will be taken to protect the identities of reporting persons and persons concerned. The measures should address such matters as document security, IT, digital and manual filing in the context of fulfilling the confidentiality obligation in the individual public body and within its systems.
• the definition of penalisation in the Act which is very comprehensive (but not exhaustive).

Information which should be included in a report

The guidance recommends that the following information should be included in a report (and that such recommendation be contained in the procedures):

• that the report is a protected disclosure and is being made under the procedures;
• the reporting person’s name, position in the organisation, place of work and confidential contact details;
• the date of the alleged wrongdoing (if known) or the date the alleged wrongdoing commenced or was identified;
• whether or not the alleged wrongdoing is still ongoing;
• whether the alleged wrongdoing has already been disclosed and if so, to whom, when, and what action was taken;
• information in respect of the alleged wrongdoing (what is occurring / has occurred and how) and any supporting information;
• the name of any person(s) allegedly involved in the alleged wrongdoing (if any name is known and the worker considers that naming an individual is necessary to report the wrongdoing disclosed); and
• any other relevant information.

Dealing with a protected disclosure informally

Interestingly, the guidance states that public bodies should recognise that workers may raise concerns informally at first rather than immediately using the formal internal channels. This is particularly the case where the concern is a minor one, albeit that it may technically be a relevant wrongdoing under the Act (e.g. a minor health and safety concern). Where the line manager is comfortable doing so, the guidance states that these concerns can be addressed by the line manager in the first instance. It states that should a worker raise such concerns with a line manager, there is no obligation to follow the requirements in the Act regarding formal acknowledgement, follow-up, feedback, etc., since these reports are not being made through the formal channel. The line manager may need to follow up on the concern and provide feedback to the worker, but this can be done in a more informal manner. However, despite a concern being raised in an informal manner with a line manager, the worker may still be entitled to the protections of the Act. Line managers should have basic awareness of the Act and the protections it provides, and should be able to direct a worker to the formal internal reporting channel if necessary.

Interpersonal grievances

The guidance notes that care should be taken when assessing whether a potential protected disclosure concerns the worker exclusively. If the potential protected disclosure refers to information that could also apply to other workers, or other workers could also be affected, then it may be a relevant wrongdoing for the purposes of the Act. If a body is unclear as to whether a report is an interpersonal grievance exclusively affecting a reporting person/a complaint concerning the worker exclusively, or a protected disclosure, they should consider seeking legal advice.

Keeping records

• The guidance states that any person to whom a report is made or transmitted must keep a record of every report made to them, including anonymous reports. Records management policies may need to be reviewed and updated to ensure that records related to protected disclosures are held and managed in a manner compatible with the requirements of the Act.
• If a recorded telephone line or voice messaging system is used, a recording or transcript of the report may be kept, with the consent of the reporting person. If the call is not recorded, minutes of the call may be made. If a meeting takes place in person, subject to the consent of the reporting person, a recording of the meeting may be made by the person receiving the report. If the meeting is not to be recorded, accurate minutes should be taken. The reporting person should be given the opportunity to check, rectify and agree by way of signature the transcript or minutes of the call or meeting.
• For anonymous disclosures, the person receiving the report shall record in a manner they deem appropriate, the receipt or transmission of the disclosure, and such information relating to the disclosure that the person receiving the report considers necessary and appropriate for the purposes of the Act, should the person making the report be subsequently identified and penalised.
• Records should be retained for no longer than is necessary and proportionate to comply with the provisions of the Act or any other legislation.

Designated persons

• The guidance stated that it is important that the designated person has sufficient seniority, authority and autonomy within the organisation to be able to effectively follow-up on reports independently and impartially. This is a matter for individual public bodies to consider in the context of their own particular structures and resources. However, it is recommended that the role of designated person be assigned to a person or persons in an area of the organisation responsible for internal corporate governance, compliance etc.
• An alternative designated person or point of contact should also be provided should circumstances arise such that it is inappropriate that the primary designated person be involved in the process. Specific training in the receipt, handling and follow-up of reports of disclosures, as well as the requirements of the Act, should be provided to designated persons.
• The designated person should always ensure that the identity of the reporting person is only ever shared on a “need to know” basis and only where it is necessary to carry out proper follow-up of a report. Where action is to be taken following a protected disclosure, it is recommended that a process is put in place for consulting with the reporting person and, where possible, for gaining the informed consent of the reporting person, prior to any action being taken that could identify them.

 Investigations

• The guidance stated that if an investigation is required, the public body should consider the nature and extent of the investigation. This could consist of an informal approach for less serious wrongdoings, a detailed and extensive investigation of serious wrongdoings, or an external investigation by another body.
• It is important to note that some matters may be of such seriousness that the investigation will more appropriately be carried out externally or by professional experts in a particular area. In some cases the matter may need to be reported to, and investigated by, An Garda Síochána or another body with the statutory power and function of investigation of particular matters.
• The guidance stated that the incorporation of a detailed and prescriptive investigative process in the procedures may impede the public body’s ability to respond flexibly and in a responsive way to reports of wrongdoing. Specific timeframes as part of the investigation process may also create a difficulty as the nature of protected disclosures are such that they will range from being quite simple and relatively easy to assess / investigate to being quite complex and cumbersome, thus requiring a much more substantial period of time to carry out an investigation.

Provision of feedback

• The Act defines feedback as the provision to the reporting person of information on the action envisaged or taken as follow-up and the reasons for such follow-up. Follow-up is defined as meaning any action taken, by the recipient of a report, or a person to whom the report is transmitted, to assess the accuracy of the information and, where relevant, to address the wrongdoing reported. Therefore, follow-up includes the assessment and investigation of the report of a disclosure and actions taken to address the wrongdoing. The guidance states that the overriding requirement when providing feedback is that no information is communicated that could prejudice the outcome of the investigation or any action that ensues (e.g. disciplinary, or other legal action, including prosecution), by undermining the right to fair procedures enjoyed by the person against whom a report or allegation is made.
• The extent of the feedback will depend on the report itself. If there is no relevant wrongdoing identified, this can be communicated in the feedback. If an alleged relevant wrongdoing is identified, this can be noted in the feedback, as well as identifying actions that have been taken, or are intended to be taken, to address the wrongdoing, and the reasons for these actions.

Confidentiality

• In order to comply with the obligation to protect the identity of the reporting person under the Act, the guidance cautions that it is generally unlikely to be permissible for the identity of the reporting person to be disclosed to an individual who is the subject of an allegation. The designated person will need to consider this when determining whether a protected disclosure can be investigated and the nature of any investigation.

The interim guidance will be reviewed by the Government with a view to issuing full formal statutory guidance in the first quarter of 2023.  We will keep you updated when further guidance is published.