Treasury's whistleblower review closes as ASIC finds only 39 per cent of disclosures qualified

Australia's corporate whistleblowing regime is now formally under the microscope its own legislation demanded. Section 1317AK of the Corporations Act 2001 required a review of the protections to begin after 1 July 2024 and a written report to be given to government. Treasury opened that review with a consultation paper carrying the reference c2026-676558, and submissions closed on 29 July 2026. The report has not been published.

What is being reviewed is the settlement reached in 2019, when the corporate and financial sector protections were consolidated into Part 9.4AAA of the Corporations Act and a separate tax whistleblowing regime was created in Part IVD of the Taxation Administration Act 1953. Five years on, the question Treasury put to stakeholders is whether those frameworks actually protect people who speak up and whether they encourage disclosures at all.

The most useful evidence in front of the review comes from the corporate regulator. On 4 December 2025 the Australian Securities and Investments Commission published Report 827, its first systematic benchmarking of how Australian companies run whistleblower programs, covering July 2024 to June 2025. One hundred and thirty four companies reported receiving 8,095 disclosures. The volume was extremely concentrated: 13 entities, about a tenth of those surveyed, accounted for roughly 74 per cent of all disclosures, while 22 per cent of companies received none at all.

The more awkward figure is the filter. Only 39 per cent of disclosures were assessed by the receiving company as falling within the statutory protection criteria. Investigations took an average of 49 days, and about 24 per cent of investigated allegations were substantiated. Around 18 per cent of surveyed companies reported at least one disclosure that alleged mistreatment of the discloser.

ASIC also found the machinery patchy. More than a third of entities did not provide a dedicated whistleblower web page. Around a quarter did not train staff regularly. Fifty eight per cent had never asked employees for feedback on the program, and 30 per cent did not review its effectiveness on any regular cycle. The regulator's own numbers suggest training matters more than exhortation: companies that trained at induction and annually recorded 0.45 reports per 100 employees, against 0.05 where no training was given, on a survey median of 0.22. ASIC Commissioner Alan Kirkland said whistleblower practices go "to the core of good corporate governance".

Submissions to Treasury have pushed at a different problem. The Law Council of Australia, in comments reported on 13 August 2026, argued that the fragmentation of Australian frameworks leaves disclosers unable to work out which door to knock on when suspected wrongdoing crosses regulatory mandates, for instance a corporate disclosure that also engages competition law or tax administration. It urged a no wrong door approach, express statutory provisions allowing regulators to refer matters to each other rather than relying on memoranda of understanding, and coverage defined by how an entity functions rather than its legal structure. It also cautioned against extending coverage without funding the regulators to match, and accepted that a single Act with a clearing house, while preferable in principle, would be expensive.

The public sector track is moving on a separate and slower timetable. Stage one reforms to the Public Interest Disclosure Act 2013 commenced on 1 July 2023, implementing 21 of the 33 recommendations made by Philip Moss AM in his 2016 review. An exposure draft, the Public Interest Disclosure and Other Legislation Amendment (Whistleblower Protections) Bill 2025, was released for consultation by the Attorney-General's Department between 10 September and 1 October 2025 and drew 16 submissions. It would create a Whistleblower Ombudsman inside the Office of the Commonwealth Ombudsman, clarify protections for disclosers and reduce the Act's complexity. Submitters pressed for adequate funding and for the same no wrong doors principle. The Bill has not been introduced.

The reform argument runs alongside a criminal case that has already concluded. David McBride, a former army lawyer who gave classified defence material to journalists, was sentenced in May 2024 to five years and eight months with a non-parole period of two years and three months. The ACT Court of Appeal dismissed his appeal on 28 May 2025 and the High Court refused special leave in October 2025. Attorney-General Michelle Rowland granted him parole on Thursday 13 August 2026, the first day he was eligible.

What is not yet known is the shape of Treasury's recommendations, whether it will propose a standalone protection authority or merely tidy the existing Parts, and when its report will be given to government or made public. Nor is there any published count of how many Australians have actually recovered compensation under Part 9.4AAA since 2019.