Corporate report

Whistleblowing policy

Updated 14 January 2021

For SSRO staff, and staff at the MOD or working for industry who have a concern about their employer or third party regarding the single source procurement of defence equipment and services in the UK.

1. Introduction

The Public Interest Disclosure Act 1998 (PIDA) amended the Employment Rights Act 1996 (“the Act”) to create a framework for whistleblowing across the private, public and voluntary sectors. The Act provides individuals in the workplace with protection from victimisation where they make a protected disclosure about malpractice or wrongdoing at work in accordance with the Act’s provisions.

The SSRO is a ‘prescribed person’ for the purposes of the Act. This means that you do not need to be an employee of the SSRO in order to raise a genuine concern of malpractice or wrongdoing to the SSRO.

The SSRO is committed to providing a safe environment for both internal employees of the SSRO and workers in industry, the MOD or third parties to raise and discuss any concerns about potential malpractice or wrongdoing:

• by the SSRO; or
• during single source defence procurement.

Everyone should have the confidence to speak up, and to know that those raising a genuine concern will not suffer any detriment. Employees of external parties reporting a genuine concern of certain malpractice to the SSRO as an independent body will be afforded the same protection under the Act as if they had reported the concern direct to their own employer.

This policy sets out the SSRO’s procedure for receiving concerns of SSRO workers about malpractice or wrongdoing by the SSRO, and a separate procedure for receiving concerns of malpractice or wrongdoing in single source defence procurement by workers employed by industry, the MOD or third parties. Section 9 provides some guidance on the ‘dos and don’ts’ of reporting a concern.

It is important that the SSRO knows about potential malpractice or wrongdoing as soon as possible, so that, where appropriate, it can act quickly and effectively to put matters right. Prompt action may put a swift halt to malpractice, minimise the cost of remedial action, lessen the risk of claims and legal action, and increase the credibility of UK single source procurement of defence equipment and services and the SSRO as an accountable and well managed public body.

This policy:

• sets out the steps that all employees (whether of the SSRO or of an external body) can take to raise and resolve serious issues regarding the procurement of single source procurement of defence equipment and services in the UK, or the operation of the SSRO;
• outlines how the SSRO will respond; and
• provides a process for handling concerns made.

2. What should be reported under the Whistleblowing policy?

Issues which should be reported under this policy are referred to in the Act as ‘qualifying disclosures’. The circumstances in which a qualifying disclosure will be protected are set out in section 3 of this policy.

A qualifying disclosure is one which the worker reasonably believes is made in the public interest and tends to show one or more of the following:

• that a criminal offence has been committed, is being committed or is likely to be committed;
• that a person has failed, is failing or is likely to fail to comply with any legal obligation to which he or she is subject;
• that a miscarriage of justice has occurred, is occurring or is likely to occur;
• that the health or safety of any individual has been, is being or is likely to be endangered;
• that the environment has been, is being or is likely to be damaged; or
• that information tending to show any matter falling within any one of the preceding paragraphs has been, or is likely to be, deliberately concealed.

A disclosure of such information is not a qualifying disclosure if the worker commits an offence by making it.

Examples of disclosures which could be made to the SSRO include allegations of the following kind:

• dangerous practices at work that could cause harm to employees or the public;
• fraud, theft, corruption, extravagance or unnecessary waste by employees or contractors;
• corruption in letting or managing contracts;
• that a criminal offence is, or is likely to be, committed such as making unauthorised disclosures of confidential information described in Schedule 5 of the Defence Reform Act 2014 or the company not having the right insurance;
• risk or damage to the environment;
• offering, taking or inviting bribes; or
• a failure to comply with a legal obligation, such as those set out in the Defence Reform Act 2014 and Single Source Contract Regulations 2014, or other relevant statute.

Throughout this policy, we refer in general to such above matters as ‘concerns of malpractice’.

Any concern of malpractice by an employer or third party in the UK defence supply chain, or the SSRO as the independent regulator, must be a genuine concern, and cannot be made in bad faith. However, it does not matter if you do not have conclusive evidence of the concern occurring, or if you are in fact mistaken and the concern has in fact not occurred – as long as you reasonably believe what you tell us. The SSRO realises that employees are often the first to realise that there may be something wrong in their organisation, and therefore encourages all employees to raise genuine concerns about malpractice at the earliest stage rather than wait for proof. If you have any personal interest in the matter, we do ask that you tell us.

Employees will also need to be mindful of the distinction between a whistleblowing concern and a grievance. Grievances are concerns about an individual’s personal circumstances and should be addressed through their employer’s HR policies, or if you are an internal employee of the SSRO, through the SSRO’s HR policies, which can be found on the intranet.

Whistleblowing matters are those that are about unlawful conduct, financial malpractice or dangers to personal health or safety or the environment.

3. How to raise a concern as an employee of an external party

Step one

If you feel you can first raise your concern with your employer, you should do so. If after doing so, you would also like to raise the concern with the SSRO as an independent body, you are welcome to do so. You do not have to have reported the concern internally to your own employer first before you inform the SSRO if you have good reason not to, for example you are concerned that you will face detriment as a result of doing so or that the evidence will be destroyed.

Step two

To raise a genuine concern of malpractice or wrongdoing in single source defence procurement, you should contact the SSRO at the details below:

Telephone: 020 3771 4792

E-mail: disclosures@ssro.gov.uk

Postal address:

SSRO
100 Parliament Street
London
SW1A 2BQ

You will be asked for as many details as you can tell us so that we can establish whether your concern meets the requirements of the Act and whether we are the appropriate body to consider your concern. If so, we will consider the issue further.

As mentioned earlier, you do not have to have conclusive evidence to make your complaint and we would rather you tell us of your concerns at an early stage than wait until you have proof. However, the SSRO can only review matters which: meet the requirements of the Act as outlined in section 2 of this policy, are in the public interest, and where we are the appropriate body to consider the matter.

You are encouraged to provide your contact details so that we can provide you with feedback of the issue, and ask you for more information at a later stage if required to help progress our review. The information you provide us will be recorded securely and confidentially.

3.1 How the SSRO will respond

The SSRO will respond to your concern professionally, independently and in a timely manner within the scope of the SSRO’s responsibilities.

If we establish that your concern:

• seems to fulfil the requirements of the Act, and
• that the SSRO is the most appropriate body to consider this concern, then the SSRO will consider the issue further. This may involve contacting your employer and any third party or parties to whom the concern involves. In some cases, although the concern may be a qualifying disclosure, the SSRO may not be the appropriate body to consider the issue further and in such instances we may refer this matter to the relevant body. For example if it is a criminal matter, the SSRO would consider referral of the matter to the police.

Section 6 of this policy explains that if you raise your concern in confidence we will not disclose your identify to the parties unless required by law. Whether or not you raise your concern in confidence, you are protected from unfair treatment by your employer as a result of you raising a concern provided your disclosure is a qualifying disclosure under the Employment Rights Act and made in circumstances detailed in this document.

If the SSRO can review the concern under the SSRO’s existing statutory responsibilities, then the duration and steps involved in reviewing the concern will depend on the nature, seriousness and complexity of the genuine concern of malpractice.

3.2 Summary of how the SSRO will deal with your concern

This diagram shows that:

• Where the SSRO receives a phone call or email, it will log details and consider whether the matter falls within the Act and if the SSRO is the appropriate body to consider the matter.
• If the matter is not within the SSRO’s remit, it will refer the matter to the organisation Protect or another appropriate body, such as the police, the auditor or HSE.
• If the matter is within the SSRO’s remit, it will (if required) ask for further information and inform the whistleblower of the SSRO’s proposed action.
• If further information is not received, the issue will be referred to Protect or another appropriate body.
• If such information is received, the SSRO will investigate the issue as part of the delivery of its statutory functions. This could result in action being taken, including: a referral to an appropriate body; an anonymised formal letter or meeting with the regulated body; a summary in the SSRO’s Annual Compliance Report; a published case study on the SSRO’s website; inclusion in the SSRO’s Review of Legislation; and/or analysis.
• The whistleblower will be informed of the outcome of the investigation.

Once the SSRO has completed its review and come to a conclusion, it will decide what, if any, action is appropriate for it to take. The SSRO may make recommendations on what action should be taken to address any concerns. We may also make recommendations on how to prevent another issue like this happening again. If we feel that the SSRO is not best placed to progress your concern, we may refer the issue to another organisation who have the appropriate powers to deal with the issue. For example in cases with a possible criminal wrongdoing, this would be the police.

3.3 Your safety

Workers who make qualifying disclosures under the Employment Rights Act 1996 are entitled not to be subject to any detriment by reason of such disclosure if it is made in any of the circumstances specified in sections 43C to 43H of the Employment Rights Act 1996.

A qualifying disclosure made to the SSRO is protected in the following circumstances:

• It is made by an SSRO employee to the SSRO.
• It is made to the SSRO by any employee who reasonably believes that: (a) the relevant failure is a matter relating to single source defence procurement, including the application of and compliance with Part 2 of the Defence Reform Act 2014 and the Single Source Contract Regulations 2014; and (b) the information disclosed, and any allegation contained in it are substantially true.

This information is provided as a guide only. A whistleblower should satisfy him or herself as to whether a disclosure will attract protection under the Employment Rights Act and take advice as necessary. The SSRO does not have any powers to determine whether a concern raised should receive PIDA protection under the Employment Rights Act. If this were disputed, if would generally be up to an employment tribunal to decide after the event if you make a claim to the employment tribunal that you have been treated unfairly.

4. How to raise a concern as an employee of the SSRO

Step one

If members of staff have a concern about malpractice, we hope that they will feel able to raise it with their line manager. You can do this verbally or in writing. If you do not feel able to do so, the following internal steps and external contact choices are available to you.

Step two

If you feel unable to raise the matter with your manager, for whatever reason, or you do not feel that he or she has addressed the concern properly, please raise the matter with your Director.

Step three

If you have gone through Steps 1 and 2, or if you feel the matter is so serious that you cannot use Steps 1 and 2, you can raise the matter with the whistleblowing officer, i.e the HR Manager, or with the SSRO’s Chief Executive.

You may also raise concerns with the Chair of the SSRO’s Audit & Risk Assurance Committee. The SSRO’s internal auditor, GIAA, or external auditor, the National Audit Office, would also be an appropriate contact.

Please say if you want to raise the matter in confidence (so that your identity will not be disclosed) so we can make suitable arrangements. Section 9 gives some helpful dos and don’ts about raising your concern. Section 6 of this policy explains that if you raise your concern in confidence we will not disclose your identify to the parties unless required by law.

If as a SSRO employee you wish to report a concern anonymously, you can also contact the SSRO by an anonymous letter, email or telephone call at the details in section 3 of this policy. However, if a SSRO employee is concerned about their identity being disclosed we encourage a concern to be raised internally in confidence instead, as this will make it easier for us to thoroughly review the matter, and keep the whistleblower informed of the outcome.

4.1 Members

If non-executive Board members or Referrals Panel members have a concern about malpractice, they should in the first instance contact the Chair of the SSRO. Non-executive members may also contact the SSRO’s internal auditor, GIAA. If the issue cannot be resolved through these routes, they may contact the Permanent Secretary of the MOD.

4.2 How the SSRO will respond

Once you have told us of your concern, we will look into it to assess initially what action we will take. This may involve an internal inquiry or referral to an external body such as the police. We will tell you who is handling the matter, how you can contact them and whether your further help may be needed. If you ask it, we will write to you summarising your concern and setting out how we propose to handle it.

When you raise the concern we may ask you how you think the matter might best be resolved.

4.3 Your safety

Employees of the SSRO who make qualifying disclosures under the Employment Rights Act to the SSRO are entitled not to be subject to any detriment by reason of such disclosure.

The Board and Chief Executive are committed to this policy. If as a SSRO staff member you raise a genuine concern under this policy, you will not be at risk of losing your job or suffering any form of retribution as a result. Provided you are acting honestly and reasonably, it does not matter if you are mistaken about your concern. The SSRO will not tolerate the victimisation or harassment of employees who have raised genuine concerns through this policy. We will treat any reprisals as a serious disciplinary matter that may result in the dismissal of those responsible.

However, the SSRO also places a responsibility on its employees to act in good faith and to use this policy honestly and reasonably. We will treat any malicious and knowingly false allegations that you make as a serious disciplinary matter that may result in dismissal, and you may not benefit from the assurances in this policy. Again, keep in mind the distinction between whistleblowing and a grievance (section 2).

Section 6 of this policy explains that if you raise your concern in confidence we will not disclose your identify unless required by law. Whether or not you raise your concern in confidence, you are protected from unfair treatment as a result of you raising a concern provided your disclosure is a qualifying disclosure under the Employment Rights Act and made in circumstances detailed in this document.

5. Feedback

While the purpose of this policy is to enable us to look into possible malpractice and take proper steps to deal with it, we will give you as much feedback as we properly can. We will agree with you when and how we will keep you informed of how we are dealing with your concern. If you prefer, we will confirm our response to you in writing. Please note, however, that we may not be able to tell you the precise action we take where this would infringe a duty of confidence owed by us to someone else.

If after receiving feedback on the treatment of your concern, you need a further update, have seen evidence the issue is continuing, or fear that you may be subject to reprisals, please let us know straight away.

For external workers making concerns, it will only be possible to provide you with feedback if you do not raise the concern anonymously.

6. Raising a concern anonymously or in confidence

While it is preferable to deal with concerns openly, we recognise that this will not always be possible. You may wish to raise concerns in confidence or anonymously where you feel unable to deal with the matter openly. However if you do not tell us who you are, it will be much more difficult for us to look into the matter effectively. We will not be able to protect your position should someone guess your identity, or to give you feedback on how we have dealt with your concern.

If you raise a concern anonymously or in confidence, we will not disclose your identity unless required by law, for instance because you have to give evidence in court. If this happens, we will discuss with you how we can proceed.

You should note that we cannot guarantee that your colleagues or the people involved in your concern will not be able to deduce your identity. If it is likely that colleagues will be able to work out that you have raised a concern, dealing with the matter openly may be the best option.

7. Other information

7.1 Independent advice

If you are unsure whether to use this policy or you want independent advice at any stage, you may contact the independent charity Protect on 020 3117 2520 or whistle@protect-advice.org.uk. If needed, Protect will be able to advise you on the circumstances in which you may be able to contact an outside body safely.

7.2 If you are dissatisfied

While we cannot guarantee that we will respond to all matters in the way that you might wish, we will handle the matter fairly and properly. By using this policy, you will help us to achieve this. If you are unhappy with our response, you can contact Protect (details above) or the Advisory, Conciliation and Arbitration Service (Acas) or you may be able to make a complaint through the SSRO’s Complaints Policy.

7.3 Wider disclosure

Wider disclosures (for example, to the police, media and non-prescribed regulators) may be protected under the Act, but only where certain conditions apply. If you report your concern to the media, in most cases you will lose your whistleblowing law rights.

If you are considering a wider disclosure you should first seek advice about your rights and responsibilities, by contacting Protect.

8. The Responsible Officer and Assurance Arrangements

The Chief Executive has overall responsibility for maintaining and operating this policy, and will report as necessary to the SSRO Board.

The SSRO is committed to ensuring that we appropriately deal with genuine concerns of malpractice raised with us in an efficient and professional manner. To ensure this, alongside following the procedures set out in this policy, the SSRO’s Governance Team will carry out quality assurance checks on how concerns are dealt with and will report their findings, and any remedial action required to the SSRO Chief Executive and SSRO Audit & Risk Assurance Committee for scrutiny.

We also believe it is important that we analyse the number and types of cases, both to understand whether our procedures were effective, as well as to identify and share common ‘threats and opportunities’. In accordance with the Prescribed Persons (Reports on Disclosures of Information) Regulations 2017, we will report in our Annual Report and Accounts:

• the number of qualifying disclosures received during the reporting period and the number which fall within the matters in respect of which the SSRO is prescribed;
• of those, the number in relation to which the SSRO decided during the reporting period to take further action;
• a summary of the action taken by the SSRO in response to disclosures and a summary of how disclosures have impacted on the SSRO’s ability to perform its functions and meet its objectives during the reporting period; and
• an explanation of the functions and objectives of the SSRO

We will also publish anonymous summaries from any recommendations or actions we make in our Annual Compliance Report and website.

9. Dos and Don’ts for raising a concern

DO	DON’T
Deal with the matter promptly if you feel your concerns are warranted.	Do nothing
Report your suspicions to someone with the authority to deal with them (see How to raise a concern above).	Be afraid of raising your concerns. (See sections paragraphs 3.3 and 4.3 on Your Safety above).
Feel assured that we will take seriously disclosures based on honest and reasonable suspicions.	Try to investigate the matter yourself. (This might hinder a criminal investigation if this becomes necessary.)
Get to know the correct procedures, and follow them.	Approach or accuse any individuals directly.
Remember the main details behind your concerns (you may want to write them down).	Report your suspicions to anyone other than those with the proper authority.
Keep any documentation in a safe place.	Leave documentary evidence in an open area.