How UK Audit Committees Should Govern Whistleblowing in 2026

UK audit committees should govern whistleblowing by reviewing speak-up arrangements under the UK Corporate Governance Code, updated for Employment Rights Act 2025 and FCA rules.

Whistleblowing has moved from an HR policy line item to a documented audit committee duty, and 2026 is the year the gap between the two becomes visible to regulators. The UK Corporate Governance Code already requires the audit committee to review the arrangements by which staff can, in confidence, raise concerns about possible improprieties in financial reporting or other matters. What changes in 2026 is the legal weight sitting behind that review: the Employment Rights Act 2025 widens who counts as a protected whistleblower, and the Financial Conduct Authority’s non-financial misconduct rules sharpen how regulated firms must respond when a whistleblower is treated badly afterwards.

According to Safecall’s 2026 Benchmark Report, reports per headcount have risen for a fifth consecutive year to roughly 1 in 365 employees, up from 1 in 520 in 2020, while named reports have fallen from 37% to 25% of the total since 2019 as anonymous reporting climbs. According to NAVEX’s 2026 benchmarking data, UK organisations log just 0.69 whistleblowing cases per 100 employees against a global benchmark of 1.65, and the average UK case takes 49 days to close versus 28 days globally. Boards reading those two data points together face an uncomfortable conclusion: UK employees are reporting less than international peers, and when they do report, resolution is slower. That combination is precisely what a regulator or claimant’s lawyer will point to after an incident.

Why Is Whistleblowing Now an Audit Committee Priority in 2026?

Three pressures have converged. First, Ministry of Justice tribunal data shows public interest disclosure claims have grown sharply, reflecting rising employee awareness of protections. Second, the government has confirmed summer 2026 consultations on whistleblowing and the use of NDAs, signalling further reform is coming. Third, the audit committee’s existing Code duty to review speak-up arrangements now sits alongside the board’s broader material controls declaration under Provision 29 — internal reporting channels are, in substance, a control the board is already attesting to. See INFORMD’s briefing on Provision 29 and board internal controls for how that declaration interacts with whistleblowing evidence.

Executive Action:

• Request a whistleblowing effectiveness report at the next audit committee meeting, covering volume, anonymity mix, and average time to close.
• Map whistleblowing arrangements explicitly against the Provision 29 material controls declaration rather than treating them as a separate HR process.
• Benchmark case closure times against the 28-49 day range reported across UK and global peers.

What Does the Employment Rights Act 2025 Change for Whistleblowers?

From 6 April 2026, the Employment Rights Act 2025 amends section 43B of the Employment Rights Act 1996 to add sexual harassment explicitly to the categories of wrongdoing a worker can blow the whistle on. Previously, a worker raising a harassment concern often had to frame it as a health and safety or legal breach issue to secure whistleblowing protection. That workaround is gone. Workers are now protected from detriment and employees from unfair dismissal where the disclosure concerns sexual harassment that has happened, is happening, or is likely to happen — whether directed at them or at a colleague.

For the audit committee, this is not simply an HR update. It expands the population of protected disclosures flowing through the same speak-up channel the committee already oversees, which means policy wording, triage training, and case-handling protocols drafted before April 2026 need a substantive review, not a light edit.

Executive Action:

• Confirm whistleblowing policy and reporting-channel guidance explicitly reference sexual harassment as a protected disclosure category from 6 April 2026.
• Retrain triage and investigation staff on handling harassment-related disclosures under whistleblowing, rather than grievance, procedures.
• Brief the remuneration and people committees, since detriment or dismissal following a harassment disclosure now carries whistleblowing liability exposure.

How Should Audit Committees Govern Speak-Up Arrangements Under the Code?

Governing speak-up arrangements well means moving past “a hotline exists” to demonstrable oversight. INFORMD’s briefing on the UK Corporate Governance Code 2024 sets out the board’s wider accountability architecture; whistleblowing sits inside it as one of the few areas where the Code names the audit committee’s review duty explicitly rather than leaving it to board discretion. Good practice now includes an annual report to the audit committee on case themes, an independent escalation route bypassing line management, and evidence that concerns raised were acted on — not just logged.

Executive Action:

• Add an annual whistleblowing effectiveness review to the audit committee’s fixed agenda, distinct from the general risk report.
• Require case theme analysis (not just volume) to surface recurring issues before they become reportable incidents.
• Test the anonymous escalation route independently of management at least once a year.

What Do the FCA’s Non-Financial Misconduct Rules Mean for Retaliation Risk?

From 1 September 2026, FCA-regulated firms face stricter, clearer rules on non-financial misconduct, covering bullying, harassment, and retaliation against whistleblowers specifically. INFORMD’s briefing on FCA non-financial misconduct covers the broader conduct-risk implications; the whistleblowing dimension is that retaliation itself becomes a regulatory finding, not just an employment tribunal risk. For financial services boards, that turns the quality of anti-retaliation controls into a Senior Managers regime accountability question.

Executive Action:

• Identify the Senior Manager accountable for whistleblower protection and retaliation prevention ahead of 1 September 2026.
• Audit the last 24 months of whistleblowing cases for any pattern of adverse treatment toward the reporter.
• Align whistleblowing metrics with the board’s wider non-financial misconduct reporting to the FCA.

How Should Boards Prepare for the Whistleblowing and NDA Consultation?

The government’s confirmed summer 2026 consultation on whistleblowing and non-disclosure agreements signals that current settlement and confidentiality practice will face scrutiny. Boards do not need to pre-empt legislation that has not been drafted, but they should stress-test existing NDA templates now: are whistleblowing disclosures already carved out, and is that carve-out written in plain language a departing employee would actually understand.

Executive Action:

• Review standard settlement agreement wording to confirm whistleblowing disclosures are unambiguously carved out of confidentiality clauses.
• Log the consultation on the audit committee’s forward agenda for a policy update once outcomes are published.
• Use INFORMD’s governance self-assessment tools to benchmark current whistleblowing arrangements against Code expectations.

INFORMD provides intelligence briefings, tools and frameworks for senior business leaders across technology, finance, strategy and compliance. Based in Milton Keynes, UK, we help executives stay informed and act with confidence. Explore our full briefing library (/resources/) or access our free assessment tools (/tools-assessments/).

Stay ahead. Subscribe to INFORMD’s weekly executive briefing at informd.co.uk.