Raising Concerns (March 2026): A Good Practice Guide for the Northern Ireland Public Sector

Part One: Introduction

Purpose of this Guide

1.1 This updated Guide is aimed at helping public sector organisations to understand the value of an open and honest reporting culture, where concerns can be raised and dealt with effectively as part of normal business, leading to strengthened governance.

Key principles when dealing with concerns

This guide identifies a number of important principles that public organisations should follow when dealing with raising concerns. They include the following:

• Public bodies should promote an open and supportive culture that values raising concerns
• Public bodies should have clear and accessible policies to deal with raising concerns
• Public bodies should ensure confidentiality and protection against victimisation
• Public bodies should investigate concerns promptly, fairly, and transparently
• Public bodies should monitor, review and learn from raising concerns
• Public bodies should ensure there is appropriate oversight of raising concerns
   

What is a concern?

1.2 Raising a concern in the public interest is the action of telling someone in authority, either internally or externally (e.g. regulators or media), about wrongdoing, risk or malpractice.

1.3 The term ‘whistleblowing’ does not exist in law. It is a word that has become commonly associated with the action of raising a concern, usually by an employee or worker, about what they believe is wrongdoing within their organisation. However, the term ‘whistleblowing’ can have negative connotations and can contribute to some of the barriers that prevent concerns being raised.

1.4 Concerns raised provide public bodies with an important source of information that may highlight serious risks, potential fraud or corruption. Workers are often best placed to identify deficiencies and problems before any damage is done, so the importance of their role as the ‘eyes and ears’ of organisations cannot be overstated.

A concern, a grievance or a complaint?

1.5 The nature of the issue being raised will determine whether it is a concern, a grievance or a complaint, and therefore the appropriate policy under which it should be addressed.

A Concern:

1.6 When someone raises a concern, the person raising the concern is usually not directly or personally affected, they are simply trying to alert others who can address the issue. For this reason, they should not be expected to prove the malpractice. Such concerns should be handled in line with an organisation’s raising concerns policy.

1.7 A concern may be raised by someone internal to the organisation, generally a member of staff, or by someone external to the organisation.

A Grievance:

1.8 When a worker in an organisation raises a grievance, they are saying that they personally have been treated poorly. This may involve, for example, a breach of their individual employment rights or bullying, and the person is seeking redress or justice for themselves. They therefore have a vested interest in the outcome and, for this reason, are expected to prove their case. Such issues should be handled in line with an organisation’s grievance policy.

A Complaint:

1.9 A customer or service user may complain about a product supplied or a service provided to them. They will have been personally affected by a faulty product or poor service and will be seeking some form of compensation or redress. Such issues should be handled in line with an organisation’s complaints policy.

Figure 1 summarises the types of issues that may be raised and the relevant policies which should apply

*Organisations should have a raising concerns policy which can deal with issues raised both by workers and members of the public. This policy should be readily accessible to both staff members and members of the public.

What if it’s not clear cut?

1.10 There can be instances where a person raises an issue which has elements both of a wider concern affecting others and of personal interest. The challenge for organisations is to disentangle the issues and deal with each in accordance with the relevant policy.

Concerns from members of the public

1.11 A member of the public can raise concerns directly with any public sector organisation. As Figure 1 shows, the nature of the issue raised will determine the policy under which the organisation should consider the matter.

1.12 Such concerns must be treated seriously and should be dealt with in the same way as concerns raised by staff members. It is the issue being raised which is important, not the person raising it.

1.13 Although not covered by the Public Interest Disclosure legislation, concerns raised by the general public can play a vital role in identifying wrongdoing, risk or malpractice within the Northern Ireland public sector.

Part Two: Key principles

Key principle 1: Public bodies should promote an open and supportive culture that values raising concerns

2.1 An organisation that is serious about addressing misconduct, risk, abuse and wrongdoing, must take steps to instil a culture in which workers have the confidence to raise concerns openly. It must also listen to all concerns raised and protect those who speak up.

2.2 As part of this, an organisation’s policy for raising concerns and its code of conduct should include a clear commitment from senior management to develop and maintain an open and ethical culture. The head of the organisation should strongly endorse the policy. There should be a clear message that no issue or concern is too small.

There are a number of factors that will encourage workers to raise concerns:

• a supportive organisational culture where raising concerns is welcomed;
• clear and explicit management commitment, from the top of the organisation, to an open and honest culture;
• a strong policy and code of conduct reinforcing the expectation of ethical behaviour from staff at all levels;
• clear roles and responsibilities in relation to dealing with concerns;
• clear procedures and lines of reporting for workers wishing to raise concerns;
• consistent handling of concerns raised, which should all be treated seriously;
• an individual with detailed knowledge of raising concerns, who can provide advice to management and staff and be an alternative to line management for workers wishing to raise a concern;
• effective awareness training for all staff so they know what concerns they can raise and how to raise them;
• effective training for line managers in dealing with concerns raised;
• a clear understanding of the benefits of raising concerns;
• continuing communication of the organisation’s commitment to an open and ethical culture, for example through circulars, posters, emails and the intranet; and
• regular attitude surveys to determine the level of confidence staff have in arrangements for raising concerns.

Visible leadership is an important part of establishing a positive culture around raising concerns

2.3 The right kind of leadership, at different levels throughout an organisation, is essential to creating a culture where people feel comfortable raising concerns.

2.4 If senior managers and board members have a presence across an organisation and speak with staff informally on a regular basis, they are better placed to influence the culture, encourage openness and get a better understanding of the issues which are important to staff.

Culture is key to offering protection for those raising concerns

2.5 An open and honest culture and good practice by employers is the key protection for those wishing to raise concerns in their place of work. While public interest disclosure legislation may provide a legal remedy, it may only be accessed after things have gone wrong internally.

Public bodies should work to normalise raising concerns

2.6 Staff may feel content to mention a concern to their line manager but fear “whistleblowing”, seeing it as something more formal and serious, with potential repercussions. In reality, however, raising concerns and whistleblowing are the same thing.

2.7 Some concerns, by their nature and scale, will require a more formal process of review and investigation than others, but the fundamental purpose in every case is the same - to bring into the open an issue of concern so that it can be properly addressed by those in authority, thereby avoiding or minimising harm, risk, wrongdoing or malpractice, and protecting the reputation of the organisation. The issue being raised is the key thing, not the person raising it.

2.8 Organisations should strive to establish a culture in which raising concerns is regarded as natural and routine. An open, honest culture, which seeks to learn and not apportion blame, is essential.

2.9 To ensure a positive culture around raising concerns, organisations should consider appointing a ‘Speak Up Champion’. This is an important role in promoting and developing a positive culture around raising concerns. Champions are responsible for raising awareness about raising concerns and encouraging a culture of curiosity and challenge. They can also be a key resource for connecting the organisation to service users and the wider public.

Raising concerns should be a normal part of business, not an exceptional act

There are practical steps an organisation can take to make raising concerns a part of normal business. These include:

• Have regular manager-led team meetings and encourage informal discussion around raising concerns. In this way, staff should become more relaxed about raising a concern, when it is part of normal business.
• Publicise examples of concerns that have been raised and dealt with effectively. This can be done via staff newsletters or the organisation’s intranet. This will help staff see the positive value of raising concerns.
• Focus on the issue being raised and not on the person raising the issue. If staff see evidence of concerns being listened to and responded to effectively, they will be happier to raise concerns in the course of normal business.
• Regular internal communications of how and why to raise concerns – this helps to raise awareness and foster a positive culture.
• Have a policy and procedures that encourage all concerns to be raised, no matter how small, giving examples. If staff can become more comfortable raising minor everyday issues, this will help them feel comfortable raising more serious concerns. Always treat low level concerns seriously – the person may be “testing the system” before raising a major issue.

Key principle 2: Public bodies should have clear and accessible policies to deal with raising concerns

2.10 It is vital that all organisations have a raising concerns policy in place. Policies should be clear and accessible and accompanied by strong procedures. Policies should also be easily accessible on the organisations website to those who are external to the organisation, including members of the public.

2.11 All policies related to raising concerns should be publicly visible and easy to access, with clearly designated contact points to support a streamlined and inclusive reporting process. This includes providing anonymous reporting channels to foster a secure environment where individuals – both internal staff and external stakeholders can express concerns freely and without fear of punishment.

2.12 Policies should be written in a way that is easy to understand and avoids legal jargon where possible. It is also important that policies are regularly reviewed to ensure that they remain relevant and up to date.

Key criteria for an effective policy include:

Commitment, clarity and tone from the top

2.13 The policy should make clear that all concerns are welcomed and will be treated seriously. It should reassure those who may be thinking of raising a concern that the organisation’s leadership will take the concern seriously and will not punish the employee if the concern turns out to be untrue, as long as they had reasonable suspicion of wrongdoing.

Structure

2.14 The policy should be easy to use so that readers are clear about how they should raise concerns. It should be clear, concise and avoid including irrelevant detail that might confuse readers. Flow charts or diagrammatic representations that outline the step-by-step process are useful techniques to support a well laid out policy.

Openness, confidentiality and anonymity

2.15 The policy should make sensible and realistic statements about respecting the confidentiality of those raising concerns and outline the potential issues that could arise from employees and those external to the organisation reporting concerns anonymously.

Offering an alternative to line management

2.16 Concerns may relate to behaviours of line management, or employees may be unwilling to discuss concerns with immediate management. The policy should offer alternative reporting channels inside the organisation.

Access to external bodies

2.17 The policy should make employees and external stakeholders aware of how they can raise concerns outside the organisation, e.g. to an external auditor or prescribed person.

Access to independent advice

2.18 Employees may need advice where they feel unsure or unaware of how to raise a concern. The policy should indicate where employees can seek advice, e.g. Protect.

Reassuring those who may wish to raise a concern

2.19 The policy should make clear that it is an offence for management and staff to victimise employees who may raise a concern.

Addressing concerns and providing feedback

2.20 The policy should set out procedures for handling concerns. It should reassure employees and external stakeholders that their concerns will be taken seriously and that, where instances of malpractice are identified, they will be dealt with appropriately.

Organisations should provide training and build capacity

2.21 Whilst a policy is essential, it is, in itself, not enough. Organisations must ensure that staff are aware of the policy and how to use it. To achieve this, policies must be made accessible. This is typically achieved by ensuring they are widely communicated and made easily accessible, normally on the internet and intranet and included within induction packs.

2.22 It is important that all staff receive training on the raising concern policy and what protections exist for those who raise concerns. Line managers and those who handle concerns should receive appropriate, and extensive specialist training. Training should be refreshed regularly.

Key principle 3: Public bodies should ensure confidentiality and protection against victimisation

Organisations should ensure confidentiality where appropriate

2.23 A concern raised anonymously means that the person raising the concern does not reveal their identity to anyone. If a concern is raised anonymously this can make it difficult to:

• investigate the concern;
• liaise with the individual;
• seek clarification or further information; and
• assure the individual and give them feedback.

2.24 Organisations may still receive anonymous concerns and these should not be ignored. They still need to assess the information provided and take appropriate action in line with the organisation’s policy. Policies should emphasise, however, that by making their identity known, workers are more likely to secure a positive outcome.

2.25 If an organisation receives a significant proportion of concerns anonymously, this may be an indication that the organisational culture is not open and ethical, and that cultural change is required.

2.26 While openness is the ideal, in practice some staff will feel anxious about identifying themselves at the outset and so any policy for raising concerns should ensure they can also approach someone confidentially. This means that their identity will only be known by the person with whom they raise their concern, and will not be revealed further without their consent, unless this is required by law.

There are practical steps that an organisation can take to protect the confidentiality of those raising concerns. These include:

• ensuring that paper files are properly classified as confidential and held securely, and that electronic files are password protected;
• ensuring that the minimum number of people have access to case files;
• being discreet about when and where any meetings are held with the individual; and
• ensuring that confidential case papers are not left on printers or photocopiers.

Victimisation

2.27 Victimisation can be a concern that prevents people from speaking up. Therefore, supporting and protecting those who raise concerns is potentially beneficial for both the individual and the organisation.

2.28 Bodies must ensure that, where the identity of the person raising a concern becomes known, they are protected and supported. As such, it is important that all policies make it clear that there is a zero tolerance approach to the victimisation of those who raise a concern. Appropriate and timely action must be taken against anyone who victimises them, regardless of seniority.

2.29 There are practical steps that organisations can take. These include providing training for those dealing with raising concerns on how to handle victimisation and engaging with those who raise concerns to highlight risks and discuss potential means of mitigating those risks.

2.30 As victimisation can be both subtle and long term, it is also worth considering checking in with those who raise concerns after any investigation.

Key principle 4: Public bodies should investigate concerns promptly, fairly, and transparently

All concerns must be treated seriously

2.31 Public bodies must take all concerns raised seriously. Some concerns, by their nature and scale, will require a more formal process of review and investigation than others. The policy for raising concerns should set out the range of possible actions. The action taken will depend on the nature of each case, for example:

• Explaining the context of an issue to the person raising a concern may be enough to alleviate their worries.
• Minor concerns might be dealt with straight away by line management.
• A review by internal audit as part of planned audit work might be sufficient to address the issue, e.g. through a change to the control environment.
• There may be a role for external audit in addressing the concerns raised and either providing assurance or recommending changes to working practices.
• There may be a clear need for a formal investigation.

2.32 Having considered the options, it is important the rationale for the way forward is documented on the case file. The raising concern policy should make clear whose responsibility it is to decide on the appropriate action to be taken. If necessary, advice and guidance can be sought from the relevant prescribed person.

Manage expectations

2.33 While those raising concerns should expect their concerns to be taken seriously and given due consideration, not all cases will require a full investigation. Policies should explain the possible courses of action that may be taken and, if appropriate, those raising concerns should be notified as to what the proposed course of action will be.

2.34 Policies should make clear that when individuals raise a concern, they may not always get the outcome they want or expect. However, they should always expect to be taken seriously and have confidence that the matter will be handled fairly and properly, in accordance with documented procedures.

Keeping contact and providing feedback

2.35 As part of the investigation plan, a reasonable level and frequency of contact should be agreed with the person who raised the concern. This will give them assurance that appropriate action is being taken in relation to the issue they raised. However, a person may want minimal contact once they have raised a concern and this should be respected.

Formal investigations

2.36 It is important that investigations are undertaken by people with the necessary expertise and experience. If an organisation does not have such staff, they should consider engaging external resources.

2.37 Internal auditors may be able to advise on this but may not be the best people to undertake the work if they do not have investigative qualifications. Where internal auditors carry out investigations under arrangements for raising concerns, and may also be involved in providing assurance on the effectiveness of those arrangements, any potential or perceived conflict of interest needs to be actively managed.

2.38 All bodies should have documented procedures in place to be followed when conducting an investigation. These may be adapted from the fraud response plan or set out in a standard operating procedure.

Key considerations for any investigative process should include:

• employing investigators with the necessary skills;
• ensuring no conflict of interest between the investigator and the issue being investigated;
• having clear terms of reference;
• setting a clear scope for the investigation and drawing up a detailed investigation plan;
• clarifying what evidence needs to be gathered and how it will be gathered (document search, interviews etc.);
• deciding how best to engage with the person raising concerns and manage their expectations; and
• ensuring that all investigative work is clearly documented.

A good investigation has a number of factors

In his review of the reporting culture in the NHS, ‘Freedom to Speak Up’, Sir Robert Francis identified a number of factors essential to a good investigation process:

• The investigation should be done as quickly as possible to an agreed timetable. This should be set at the start and any changes should be notified to the person raising the concern.
• There must be a degree of independence, proportionate to the gravity and complexity of the issue being investigated. The investigator may be someone from a different part of the organisation who is independent of the issue being investigated. However, there may be circumstances where external independence would be desirable.
• The investigation must be conducted by appropriately qualified and trained investigators, who are given the requisite time to conduct and write up their investigation.
• The investigation must seek to establish the facts by obtaining accounts from all involved and examining relevant records.
• The investigation should result in feedback to the person who raised the concern.
• The investigation must be separate from any disciplinary process involving anyone associated with the concern, where possible.
• The outcome of the investigation should be considered at a level of seniority appropriate to the gravity of the issues raised, along with a programme of proposed action where relevant.
• Learning from the investigation should be shared across the organisation and beyond, where appropriate.
• Someone should keep in touch with the person who raised the concern at all times, to keep them abreast of progress and monitor their wellbeing.

Key principle 5: Public bodies should monitor, review and learn from raising concerns

Organisations must record, monitor and report caseload

2.39 Concerns raised by workers and members of the public are an important source of information for any organisation. It is important that key aspects of the concerns and the process for handling them are captured, so that the value of arrangements can be determined and lessons learned, where appropriate. Government departments should have procedures in place for receiving information about concerns raised in all arm’s length bodies for which they are responsible. This can help identify concerns of a systemic nature.

Record

2.40 In addition to individual case files, organisations should maintain a central record of all concerns raised, in a readily accessible format such as a database. Any system for recording concerns should be proportionate, secure, and accessible by the minimum number of people necessary.

2.41 The types of information recorded may include:

• the date the concern was raised;
• the category of the concern and/or the risk highlighted;
• Whether the individual is internal or external to the organisation;
• with whom the concern was initially raised;
• whether confidentiality was requested;
• the approach adopted;
• who is investigating the concern;
• key milestone dates from the agreed investigation timetable;
• the outcome, in terms of whether the concern was founded or unfounded;
• whether feedback was given to the person raising the concern;
• whether the person was satisfied with the outcome and if not, why not; and
• the date the case was closed.

Monitor

2.42 Monitoring concerns raised has two important aspects: firstly, to ensure the handling of the concern is progressed in line with the agreed timetable and secondly, to facilitate data capture for management information purposes.

2.43 The central record of concerns should be periodically reviewed by a responsible officer and used to request updates on cases or generate reminders for action, as appropriate.

2.44 Analysis of the information captured will allow organisations to identify trends or business risks which may need to be addressed.

It will also provide useful management information on the operation of procedures for raising concerns, such as:

• the number and types of concerns raised;
• how concerns were dealt with;
• the length of time taken to resolve concerns; and
• the individuals satisfaction with the procedures.

Report

2.45 In his review of arrangements in the NHS, ‘Freedom to Speak up’, Sir Robert Francis highlighted that in a number of high profile cases, senior management and the Board had not been aware of the scale and types of problems that existed in their organisation.

2.46 It is therefore essential that an analysis of concerns raised in any organisation, and the action taken in response to those concerns, is reported regularly to senior management, the Audit and Risk Assurance Committee and the Board. This will help inform those charged with governance that arrangements in place for workers to raise concerns are operating satisfactorily or will highlight improvements that may be required. It will also provide them with assurance that appropriate steps have been taken, and lessons learned have been disseminated.

2.47 An organisation’s annual report and accounts should include a section on concerns raised and improvements made in the organisation as a result. This will help demonstrate to staff that the organisation is open and transparent and that raising concerns yields results.

Key principle 6: Public bodies should ensure there is appropriate oversight of raising concerns

2.48 Arrangements for raising concerns must be effective, and must be seen to be effective, otherwise workers will be reluctant to speak up and organisations will not have the opportunity to address issues before they have potentially serious consequences. It is not enough for organisations to have a policy and procedures in place. Bodies need positive assurance that arrangements for raising concerns are working effectively.

2.49 Arrangements for raising concerns should be regularly reviewed, both to ensure their effectiveness and to confirm that workers have confidence in the arrangements, including by performing periodic pulse surveys to measure staff awareness.

Audit and Risk Assurance Committees have a key role in oversight

2.50 Audit and Risk Assurance Committees have a key role in ensuring effective arrangements for raising concerns are in place. The Committee is part of the control environment of the organisation and should provide a challenge function when it receives management information about concerns raised.

2.51 Audit and Risk Assurance Committees should:

• Discuss raising concerns as a regular agenda item;
• Engage with the organisation’s Designated Officer or equivalent,
• Be satisfied that organisations have the appropriate capacity and capability to investigate and manage concerns; and
• Seek assurance that raising concerns are treated in line with the policy.

The Audit and Risk Assurance Committee Handbook provides some key questions which the Audit and Risk Committee should ask:

• How do we know that there are appropriate and effective practices in place for raising concerns?
• How do we know that these provide suitable channels for staff and others to raise their concerns?
• How do we know that the policies appropriately cover the issues of confidentiality and anonymity?
• How do we know that those raising concerns are offered appropriate support and provided with suitable and timely feedback?
• How do we know that concerns raised are dealt with properly and reported to senior management?

2.52 Supplementary questions to help answer the key questions may include:

• Is there evidence that the board regularly considers procedures for raising concerns as part of its review of the system of internal controls?
• Is there a comprehensive record of the number and types of concerns raised, follow-up action taken and the outcomes of investigations?
• Are there issues or incidents which have otherwise come to the board’s attention which they would have expected to have been raised earlier under the organisation’s procedures for raising concerns?
• Are there adequate procedures for retaining evidence in relation to each concern?
• Have confidentiality issues been handled effectively? Have there been any failures to maintain confidentiality?
• Is there evidence of timely and constructive feedback to the person raising the concern?
• Is there evidence of satisfactory feedback from individuals who have used the arrangements?
• Have any events come to the committee’s or the board’s attention that might indicate that a worker has been victimised or unfairly treated as a result of raising their concerns?
• Has there been a review of staff awareness, trust and confidence in the arrangements?
• Where appropriate, has internal audit performed any work that provides additional assurance on the effectiveness of the procedures for raising concerns?

Benchmarking arrangements

2.53 Benchmarking an organisation’s arrangements for raising concerns against wider good practice and against similar organisations can highlight further improvements to be made.

2.54 The charity Protect, which provides advice and guidance to employers and workers about raising concerns, has developed a benchmarking tool to help organisations assess the effectiveness of their current arrangements. It has produced a set of standards under three key headings:

• Governance:
  – Accountability
  – Written policy and procedures
  – Review and reporting
• Engagement:
  – Communications
  – Training
• Operations:
  – Support and protection
  – Recording and investigations
  – Resolution and feedback.

2.55 Information on acquiring access to the benchmarking tool can be obtained by contacting Protect at: business@protect-advice.org.uk

All Public Sector Organisations:

• Establish and maintain clear procedures for raising concerns
• Promote awareness of these procedures among staff and stakeholders
• Ensure concerns are handled fairly, confidentially, and without retaliation 

Speak Up Champions (NICS)

• Senior members of staff
• Responsible for raising general awareness about the importance of raising concerns
• Encourage culture of curiosity and challenge
• Promote improvements made as a result of concerns

Designated Officers

• Act as the point of contact for concerns within each organisation and appropriately triage those concerns
• Record, assess, and manage concerns in line with policy
• Appoint a Nominated Review Officer
• Report to senior management, Audit and Risk Assurance Committee and participate in cross-departmental forums

Raising Concerns Team

• Advise Nominated Review Officer about their role and requirements
• Maintain records in respect of issues raised as concerns
• Compile records

Line Managers

• Support staff in raising concerns and guide them through the process
• Escalate concerns appropriately and ensure they are not dismissed or ignored

Audit and Risk Assurance Committees

• Seek assurance of the effectiveness of concern-handling process
• Receive regular updates on concerns being received
• Assess significance of any trends

Designated Officers' Forum (NICS)

• Share best practices and lessons learned across departments
• Submit an annual summary of concerns raised to the NICS Board

Source: NIAO based on NI Departments’ Raising a Concern: Policy Framework; Departmental raising concerns guidance; NIAO Good Practice Guide.

Appendix 1: Good practice self assessment checklist