Aged care risk and response series – Whistleblowing in aged care: what providers need to know now

CLAYTON UTZ - TEN MONTHS ON: WHAT HAS THE WHISTLEBLOWER REGIME TAUGHT US?

9 SEPTEMBER 2026

---

Good afternoon everyone. And thank you Amanda.

I would like to begin by acknowledging the Gadigal people of the Eora Nation, their Elders past and present, and acknowledge and thank the Aboriginal and Torres Strait Islander colleagues with us today.

As you have just heard, the new whistleblower regime is not really just about whistleblowing.

It is about whether organisations can hear concerns early enough that they never become whistleblower disclosures in the first place.

My challenge to you this afternoon is a different one:

What are you doing today that means the disclosure never has to become a whistleblower disclosure in the first place?

Amanda has done an excellent job explaining the legal framework that has now been operating for about ten months.

I imagine that most organisations represented here today have already reviewed policies, updated procedures, briefed boards and trained staff.

So I do not want to spend the next fifteen minutes talking about what the legislation requires.

Instead, I want to ask a different question.

Ten months on:

Has it actually changed how we listen?

Because legislation can require systems TO DO STUFF.

It can require policies, it can require training.

But legislation cannot create trust.

And trust remains the thing that determines whether people speak up.

Let's start with an uncomfortable reality

The whistleblower framework didn't arrive in isolation.

It arrived alongside one of the biggest periods of reform the sector has seen in decades. A new Act, new standards, new registration arrangements, new reporting expectations landing at roughly the same time.

And all of that landed at a time when providers were already managing workforce shortages, financial pressure and significant reform.

In government, we have become very good at creating obligations. Every inquiry, every review, every failure creates pressure to add another safeguard, another process, another assurance mechanism. Most of the time those things are well-intentioned. The problem is that they accumulate.

And when they do, it's easy to find ourselves spending more time asking whether something has been done than whether we've actually created the conditions that help people succeed in delivering the intended outcome.

Public debate can sometimes leave the impression that providers, consumers, advocates, regulators and government are all pulling in different directions.

But more often, I find people from all walks wrestling with exactly the same questions everyone else was wrestling with.

How do we identify problems earlier?

How do we create environments where older people, their loved ones, and staff feel confident raising concerns? and how do we get curious about concerns

before they are even raised?

What I see, are good people trying to deliver something profoundly human inside systems that can sometimes make that much harder than it should be.

And that's precisely why I think this conversation is so important.

Because if the whistleblower regime becomes simply another compliance requirement, we'll probably comply with it.

But we'll miss the bigger opportunity.

The opportunity is to use it as a prompt to ask a much more fundamental question:

How do we build organisations that hear the truth earlier?

Because if concerns are only becoming visible once somebody feels they need statutory whistleblower protections to speak safely, then from a governance perspective we’ve likely negated something significant.

The thing that struck me when I first read the provisions was that they seem to be built around a very realistic view of human behaviour;

People don't generally move from silence to whistleblower disclosure in one giant leap.

• What they do is test the water.

• They look for signals.

• They work out whether they trust the person in front of them and they decide whether they're likely to be heard, dismissed, believed, blamed or ignored.

In fact, I suspect most disclosures begin with:

"Can I just ask you something?"

Or:

"Something happened the other day and it didn't sit quite right with me."

Or:

"This might be nothing, but I'm worried about..."

And I think the legislators have recognised that reality.

They've recognised that concerns usually emerge through relationships long before they emerge through formal systems.

Which is why, for me, this legislation is ultimately not a story about compliance.

It's a story about trust.

Disclosure is not prevention

If we step back for a moment, disclosure is not actually where we should want the system to start.

Disclosure is what happens when somebody has seen enough, worried enough, or lost enough confidence in the ordinary pathways that they've decided they need to act.

In other words, it is already telling us that something has happened.

The question needs to be: what was visible before that moment?

• What conversations were happening?

• What concerns were bubbling away?

• What opportunities existed to hear that information earlier?

The strongest organisations are not simply the organisations that respond well once concerns are raised.

They are the organisations that create conditions where concerns emerge while they are still small.

Before harm has escalated, trust has collapsed and before people feel they need legal protection in order to feel safe.

Organisations that truly listen look for weak signals

One of the patterns I saw repeatedly in inquiries and oversight work across human service systems – not just aged care - was that significant failures rarely arrive without warning.

• The warning signs are usually there.

• Not as one dramatic disclosure.

• But as fragments:

• Maybe  an unexpected resignation nobody can quite explain.

• Maybe  a concern raised by a staff member that appears minor at the time.

• Maybe a family member asking a question that doesn't quite fit with everything else you're hearing.

• On their own these things seem insignificant but together they can tell you something important.

Once we have reached a disclosure, we find the reason we did not know earlier was not necessarily an absence of information.

The problem was that the information was sitting in different parts of the organisation, being viewed through different lenses, and nobody was responsible for joining the dots.

Somebody has to own the view across the whole landscape.

Often complaints sit in one place, HR data sits somewhere else and consumer feedback sits somewhere else again.

Home care operations may sit in a completely different reporting line.

The question is not whether the information exists - the question is whether anybody is seeing it together.

That's why I think boards should be very cautious about looking at whistleblowing as a standalone issue.

A protected disclosure is rarely the first signal that something is wrong.

More often, it is the moment when a collection of smaller signals finally become impossible to ignore.

The real governance challenge is working out how those fragments come together earlier.

·       How are complaints data being considered alongside workforce data?

·       Do leaders ever look at exit interviews alongside incident trends?

·       Does the board receive information that allows it to see patterns across these sources, or only individual datasets in isolation?

Viewed separately, most weak signals look unremarkable.

Viewed together, they can tell you something profoundly important about culture, trust and emerging risk.

Which means the question for boards and executives is not simply:

"How do we manage whistleblower disclosures?"

It is:

"How do we create enough organisational visibility that weak signals become visible before they need to become whistleblower disclosures?"

The danger of becoming reassured by silence

One of the things I said recently at the National Elder Abuse Conference was that

I've become increasingly wary of institutions that draw comfort from the information they already possess.

Not because the information is wrong. But because there is always another category of information that organisations struggle to see.

• The things that never enter the system in the first place.

• The concern that isn't raised.

• The question that isn't asked.

• The employee who decides to keep their head down.

• The family member who quietly concludes that nothing will change.

• The longer I've spent in oversight roles, the more I've come to believe that those missing pieces often tell us as much about organisational safety as the data we are reporting to our boards.

Which is why I think silence can be one of the most deceptive indicators in any safeguarding system.

We tend to assume that no news is good news.

But sometimes no news simply means nobody thinks it's worth telling us.

And they are two very different things.

Why home care leaders should be paying particular attention

I think this conversation is one that still remains a sleeper for Support at Home, and even to some degree, CHSP.

In residential care, there are many natural sources of visibility. There are colleagues, supervisors, other residents, visitors and families. People are constantly observing one another, whether intentionally or not.

A person's home is different.

Much of what happens there occurs beyond the view of managers and beyond the view of other workers.

And that means the challenge for providers is not simply whether concerns are being reported. The challenge is whether the organisation has enough visibility to know what is happening at all.

When we talk about whistleblowing and speaking up, we often imagine a worker identifying a safeguarding concern and bringing it to the organisation's attention.

But in home care, what if the inappropriate conduct, neglect, exploitation, boundary violation or abuse is being perpetrated by the sole person delivering the service?

In a residential environment there are at least opportunities for that behaviour to be observed by others.

In a home, there may be no witness, and older people may be isolated, dependent on the worker, fearful of jeopardising the relationship, or simply unsure that what is happening is wrong or who they could safely tell.

That reality becomes even more challenging when services are delivered through contractors, agency staff or highly dispersed workforces who may have less connection to organisational culture and fewer opportunities for direct supervision.

Which means the governance challenge is not simply:

"Would a worker tell us if something was wrong?"

It's also:

"How would we know if one of our workers was causing harm?"

And I think that requires a different level of organisational curiosity.

Not just waiting for complaints, Not just reviewing incidents.

But actively asking whether the organisation's visibility extends far enough into people's lived experience to identify concerns that may never be voluntarily disclosed.

If I were sitting on a board, I think I'd want to know three things.

First, how much of what we're hearing about home care is being filtered through organisational reporting, and how often are we hearing directly from older people themselves?

Second, do we have a way of spotting patterns around particular workers, contractors or service teams before a serious issue emerges?

And third, what assurance do we actually have that concerns involving contractors or agency workers would become visible just as quickly as concerns involving directly employed staff?

Ten months on, are we testing the system or merely implementing it?

Ten months after commencement, I suspect most providers have done what we would expect responsible organisations to do:  updated their policies, delivered the training, clarified reporting lines.

The more important question now is whether you've tested your assumptions about it.

Because every board paper can tell you a process exists. Every policy can tell you what is supposed to happen.

But what they can't tell you is whether people trust it.

And that requires a different kind of inquiry. It requires leaders to get curious about how the system is actually experienced by the people expected to use it.

Which is why I would be asking questions like...

·       Have you asked agency staff whether they understand it?

·       Have you spoken to casual workers?

·       Have you asked frontline managers how they would respond if a disclosure came to them tomorrow morning?

There is a fundamental difference between implementing a whistleblower framework and having confidence that concerns will genuinely surface through it.

And then moving this up a level, there are four overarching questions I would ask every Executive Leadership Team:

Rather than asking whether your whistleblower policy is compliant, I would ask four different questions.

First:

Which groups in our workforce are least likely to raise concerns?

Second:

How would we know if people had stopped trusting our speak-up systems?

Third:

What information are we not seeing?

And fourth:

If I were the most junior casual worker in this organisation, working my second shift, seeing something that worried me, would I genuinely believe speaking up would make things better?

Or would I believe it would make my life harder?

The answer to that question tells you more about organisational culture than almost any dashboard ever will.

And I would add one final governance challenge.

Be cautious about drawing comfort from metrics such as:

• no whistleblower disclosures;

• very low complaint numbers;

• no matters escalated externally.

Sometimes those are indicators of healthy culture.

But Sometimes they are indicators of organisational silence.

Closing

If there is one lesson I have taken from all my oversight roles, all the Royal Commissions and the inquiries, it is that organisations rarely fail because nobody knew anything.

More often, somebody knew something.

The challenge is that nobody connected the dots quickly enough.

For me, that is the real opportunity hidden inside this legislation.

Not simply to build stronger whistleblower systems - but to build organisations that become curious earlier, learn faster and hear the truth sooner.

Thank you.