Speak up culture: how to build one and handle what comes through it

Every employer says it wants to hear about problems early. Far fewer can describe what happened to the last person who raised one. That difference is the whole subject, because a speak up culture is built out of precedent rather than policy wording.

This article is written for the employer. It covers the legal floor you are standing on whether you like it or not, how to design reporting routes people actually use, how to talk about anonymity honestly, what suggestion boxes and anonymous surveys are genuinely good for, and how to handle a concern once it arrives.

Concerns surface earliest where asking and answering is ordinary. See how New Dynamics continuous feedback keeps those conversations part of the working week rather than an event.

It describes the law in Great Britain. Northern Ireland has its own employment legislation and the detail differs there, so check guidance for Northern Ireland before you rely on this. It is general information rather than legal advice. Take advice on your own facts, particularly before you dismiss or discipline anybody who has raised a concern.

The legal floor comes first

Culture work that ignores the law tends to produce a warm policy that quietly breaches it. Five points set the floor.

A qualifying disclosure has to be in the public interest. GOV.UK's guide to whistleblowing puts the test plainly: "The wrongdoing you disclose must be in the public interest. This means it must affect others, for example the general public." The same page lists what a worker is protected for reporting, in its own words: "a criminal offence, for example fraud", "someone's health and safety is in danger", "risk or actual damage to the environment", "a miscarriage of justice", "the company is breaking the law", "you believe someone is covering up wrongdoing", and "sexual harassment".

Who is protected is broader than your payroll. GOV.UK: "You're protected if you're a worker", and its examples include an employee, a trainee such as a student nurse, an agency worker and a member of a Limited Liability Partnership. Acas, in its guidance on whistleblowing at work, says protection starts from the beginning of employment and continues after someone has left the employer they are disclosing about. There is no probation grace period in this area.

A worker does not have to raise it with you first. This is the point employers most often get wrong. GOV.UK states that "There are other options if you do not want to report your concern to your employer", and that "If you tell a prescribed person or body, it must be one that deals with the issue you're raising, for example a disclosure about wrongdoing in a care home can be made to the Care Quality Commission." Acas, in its guidance on how to make a whistleblowing disclosure, advises an individual to "consider making the disclosure to your employer first", and adds that "you can skip people in the list if you think it's not appropriate to disclose to them". So an internal route is a courtesy your culture earns, not a hurdle you can impose. If a regulator contacts you before you have heard anything internally, that is a verdict on your routes.

Dismissal for whistleblowing is automatically unfair. Acas states: "If someone with the legal status of employee is dismissed for whistleblowing, it will be treated as an automatic unfair dismissal." GOV.UK lists unfair and constructive dismissal reasons that are likely to be unfair, including where someone "exposed wrongdoing in the workplace (whistleblowing)". The qualifying period of service that applies to an ordinary unfair dismissal claim does not apply to these automatically unfair reasons, so a person three weeks into a job has the same protection as a person of twenty years' service.

Confidentiality is a request a worker can make. GOV.UK's chapter on who to tell and what to expect says: "You can give your name but request confidentiality - the person or body you tell should make every effort to protect your identity."

Our companion article on the meaning of whistleblower covers the definition, the grievance boundary and the position outside the United Kingdom in more depth. This one stays with the employer's build.

Detriment: what it covers, and why it decides everything

Protection is not limited to keeping someone's job. Acas describes detriment as someone being "treated worse than before" or "having their situation made worse" because they made a disclosure, and its examples include bullying and harassment, being denied training, missing out on promotion and having hours reduced.

In practice detriment is rarely a formal act. It is the project that moves to somebody else, the invitation that stops arriving, the sudden interest in a timekeeping record that nobody minded last year, the reference that goes cold. Each is deniable on its own. Together they are legible to everybody watching, and what everybody watching learns is the actual policy.

That is the central argument of this article. Organisations lose trust in a speak up route because of what happened to the person who used it, not because of the original wrongdoing. A fraud, a safety failure or a bullying manager damages an employer once. Visible retaliation against the person who reported it closes the route for years, because it teaches every colleague the price of the next report. Protect the reporter and you can survive the finding. Punish the reporter and you will stop hearing about findings.

Retaliation versus retribution

Search for this pair and you will find American answers, because it is an American framing. In United States employment law "retaliation" is the term of art, and "retribution" is the everyday word for punishment or revenge, with no legal meaning in this context.

Neither word is the one that matters here. In the United Kingdom the statutory concept is detriment, and that is the word a tribunal, Acas and your own policy should use. Write "we will not tolerate retaliation" if your people understand it, by all means, but make sure the policy also says detriment and explains it, because detriment is the test anybody will later be judged against. Importing American terms makes a policy sound borrowed and leaves the real standard undefined.

Designing routes people actually use

A single route is a single point of failure. Three routes, published together in the same sentence, is the minimum that works.

Route one: the line manager. It is the fastest, the most informal and the one most concerns should be settled through. It is also where most concerns die, for reasons that have nothing to do with bad managers. The manager may be the subject of the concern, or close to whoever is. The manager may not recognise a disclosure when they hear one, because almost nobody opens with the word whistleblowing. The manager may try to fix it quietly and kindly, and so never record it, which leaves the organisation unable to see a pattern and leaves the person unprotected if it goes wrong later. Train managers on exactly two things: how to recognise a concern that is bigger than their authority, and whom to hand it to within one working day.

Route two: a named alternative. Name a person, with a job title and a direct contact, who sits outside the normal reporting line. "Contact HR" is not a route, it is a department. A name makes the route usable at the moment someone needs it, which is usually at eleven at night when they have decided to do something about it.

Route three: an independent channel. This may be an external service, a non-executive director, an audit committee or a sector regulator. Its purpose is to work in the case your other two routes cannot cover, which is when the concern is about the people who run the organisation. Publish the relevant regulator alongside your internal routes. Employers worry that this invites external reporting. It does the opposite more often, because a route that admits its own limits is more credible than one that insists it is sufficient.

Our guide to a working open door policy deals with the informal end of this, which is the part that decides whether anybody ever reaches route one.

Anonymity, handled honestly

Most speak up policies overpromise here, and then break the promise under pressure.

What you can promise: that you will not share someone's name beyond the people who must have it, that you will say who those people are, and that you will treat any detriment as a disciplinary matter. The Information Commissioner's Office guidance on collecting and keeping employment records is the standard to design to: records should "only be accessed, altered, disclosed or deleted by those who are authorised to do so", and for sensitive information "you should think carefully about its security - for example, limiting access only to those who need to see it". The same guidance says you must take all reasonable steps to keep workers' information accurate, and that where a record holds an opinion it should be clear that it is an opinion and whose it is. An investigation file is full of opinions about named people, so label them as such.

What you cannot promise: total anonymity in every circumstance. A case may become a tribunal claim, a police matter or a regulatory investigation, and disclosure obligations can follow. Say that in the policy rather than discovering it together later.

An anonymous report is harder to investigate, and it is fair to say so. GOV.UK is direct about it: "You can tell your employer or a prescribed person anonymously but they may not be able to take the claim further if you have not provided all the information they need." You cannot ask the clarifying question that would turn a rumour into a finding. Accept anonymous reports anyway, because an anonymous report is better than no report, and because a pattern of them tells you something even when each one is unactionable.

The small team problem is real. In a team of five, "somebody in the team raised a concern about overtime records" identifies the person as effectively as naming them, especially once the subject of the concern starts working out who it was not. Where numbers are small, be honest that confidentiality cannot be guaranteed by arithmetic, offer the independent route, and consider holding the investigation outside the team entirely.

Suggestion boxes and anonymous surveys

An online suggestion box and an anonymous questionnaire are useful tools aimed at a different job from the one people try to give them.

They are good for ideas with no personal risk attached, for gauging how widely a known frustration is felt, for giving quieter people a way to contribute, and for finding the question you should be asking in person. Our article on workplace engagement surveys covers how to run the survey end of this well.

They are poor for serious concerns. There is no dialogue, no record that protects the person, no clock, no owner, and no way to tell a safeguarding allegation from a request for better coffee until somebody opens the box. If a serious matter does arrive by that route, take it as seriously as any other disclosure and route it immediately, but do not design on the assumption that it will.

The failure mode has a shape. A box is launched with enthusiasm, fills up, and then nothing visibly happens. Within two months submissions stop, and the box sits there as a monument to being ignored. Avoid it with three commitments: a named owner, a published cycle such as a monthly review at a leadership meeting, and a visible answer to every theme, including "we are not doing this, and here is why". A refusal with a reason keeps a channel alive. Silence kills it.

Handling a concern once it arrives

1. Acknowledge it, quickly and in writing. Within days, not weeks. Thank the person, say what happens next and give a date for the next contact. This single step does more for your speak up culture than the rest of the policy combined.
2. Decide the route, and record the decision. Is this a disclosure in the public interest, a grievance about the person's own treatment, or both? Acas warns that "grievance procedures are not designed to address these sorts of concerns", and GOV.UK says personal grievances are not covered by whistleblowing law unless the particular case is in the public interest. Our article on the meaning of grievance sets out that route. Many real cases are both, so run both and tell the person you are doing so.
3. Investigate proportionately. Match the effort to the risk. A query about expense coding is not a forensic exercise. An allegation of falsified safety checks is. Decide the scope, the evidence and the decision maker before you start, and never appoint anybody in the reporting line of the person complained about.
4. Protect the person deliberately. Agree who is told, brief them on what they may not do, and check in with the reporter on a schedule rather than waiting for a complaint. If a performance concern about the reporter genuinely exists, it needs documented evidence predating the disclosure and a decision maker who is not involved in the investigation.
5. Feed back what you can. You may not be able to share the detail of an outcome affecting another employee. You can always say that the matter was investigated, that it has concluded and what changed as a result. Silence is read as a cover-up, and that reading spreads faster than any finding.

Malicious compliance, and why it belongs here

Malicious compliance is following an instruction, rule or process exactly as written in the knowledge that doing so will produce a poor or absurd result. Working precisely to the letter of a rota. Escalating every decision because the policy technically requires it. Filling in the form as literally specified so the nonsense becomes somebody else's.

It is usually told as a joke, and it is worth taking seriously, because malicious compliance is a symptom with a clear cause. People comply maliciously when they can see a problem, have no safe way to say so, and have learned that objecting costs more than complying. The rule is followed because disagreement is unaffordable. Every instance is a concern that was raised sideways because the direct route looked closed.

Read it as data. Where you find it, the diagnosis is not an attitude problem in an individual. It is an unanswered question: who could this person have told, and what would have happened to them? That is the same question a speak up culture exists to answer, which is why this apparently flippant topic sits squarely in the middle of the subject. Our code of conduct examples cover how to word the expectation that people raise a problem rather than engineer one.

What goes wrong

• A policy with no owner. Nobody is accountable for the routes, the records or the pattern across cases, so nothing improves between incidents.
• No feedback loop. Concerns go in and nothing comes out. Reporting volume falls and the organisation reads the fall as progress.
• Investigations run by the person complained about, or by their manager, or by somebody who depends on them. The outcome may even be correct, and nobody will believe it.
• A concern treated as a performance problem. The reporter becomes difficult, negative or not a team player. This is the most common form detriment takes, it is the hardest to defend in a tribunal, and it is the single clearest signal to colleagues that speaking up is a career decision.
• Routes nobody can find. If it takes more than a minute to locate the policy and the name of the person outside your reporting line, the route does not exist in any practical sense.
• Reporting the wrong number. Counting concerns received tells you little. Count how long acknowledgement took, how many were substantiated, how many led to a change and how many reporters reported detriment afterwards.

An organisation that receives no concerns at all is rarely one with nothing to report. It is usually one where people have concluded there is no point.

Frequently asked questions

What is a speak up culture?

A speak up culture is a workplace where people raise problems, risks and wrongdoing early because they expect to be heard and not punished for it. The test is not whether a policy exists. It is what colleagues have seen happen to the last person who used it.

Does a worker have to report a concern to us before going to a regulator?

No. GOV.UK says there are other options if a worker does not want to report a concern to their employer, including telling a prescribed person or body that deals with the issue being raised. Acas suggests considering the employer first, but an internal route is something you earn rather than something you can require.

What is the difference between retaliation and retribution?

Both are American framings. Retaliation is the legal term in United States employment law and retribution is an everyday word for revenge. UK law uses detriment, meaning someone is treated worse or has their situation made worse because they made a disclosure, so that is the term your policy should define and use.

Can we promise an employee complete anonymity?

No, and promising it is a risk in itself. You can promise to limit who knows, to say who they are and to treat detriment as misconduct. You cannot promise anonymity will survive a tribunal claim, a police investigation or a team of five where the arithmetic identifies the person anyway.

Are online suggestion boxes and anonymous surveys enough?

No. They suit ideas, sentiment and spotting the question you should ask in person. They offer no dialogue, no protection and no owner, so serious concerns need a named route with a clock on it. A box with no visible response becomes a reason not to bother.

Is dismissing someone for whistleblowing automatically unfair?

Acas states that an employee dismissed for whistleblowing will be treated as an automatic unfair dismissal, and GOV.UK lists exposing wrongdoing in the workplace among reasons a dismissal is likely to be unfair. The qualifying period of service needed for an ordinary unfair dismissal claim does not apply, so length of service is no protection for the employer.

Your next step: test the routes you already have

1. Time how long it takes to find your speak up or whistleblowing policy from your intranet home page, then ask somebody who has never looked for it to do the same.
2. Check that it names a person outside the line management chain, with a direct contact, and names the regulator for your sector.
3. Take last year's concerns and measure four things: days to acknowledgement, who investigated, what changed, and whether the reporter was asked about detriment afterwards.
4. Ask three managers what they would do tomorrow if someone told them safety checks were being signed off without being done.

For wording you can adapt on speaking up, reporting routes and protection from detriment, read and download our code of conduct guide. The guide is free to read, and the PDF uses our short download form.

Want regular, recorded conversations where concerns surface before they become cases? Book a New Dynamics demo and bring your current policy. You can also email contact@new-dynamics.com.