Writing a Whistleblowing Annual Report That Evidences Real Speak-Up Culture

The SYSC 18 annual report is one of the few board papers where the content is prescribed but the credibility is entirely yours to prove. Most reports read as compliance summaries: volumes, categories, closure rates. That satisfies the letter of the rule and almost nothing else. A report that evidences genuine speak-up culture does something harder: it shows the board what people inside the firm actually experience when they raise a concern, and whether leadership can be trusted with what they hear.

Start with what the board actually needs to decide

The Whistleblowers' Champion (a NED under SMCR) is accountable for the integrity, independence and effectiveness of the firm's arrangements. The report exists to let them, and the wider board, form a view on three questions: are people speaking up, is the firm handling what it hears properly, and is anyone suffering detriment for having raised a concern. Structure the report around those questions. Everything else is supporting evidence.

The core structure that works

1. Executive summary with a cultural judgement

Open with the Champion's own assessment of speak-up culture, not a restatement of case numbers. If the Champion cannot form that judgement from the data presented, the report is incomplete.

2. Volume and channel analysis, with trend

Report cases by channel (line manager, compliance, hotline, external, anonymous), by business area, and by concern category. Show three-year trend. The interesting signals are usually in the shifts: a collapse in line manager reports, a rise in anonymous submissions, a business unit that has reported nothing for two years.

3. Case handling metrics

Time from receipt to triage, time to resolution, proportion investigated internally versus externally, proportion substantiated. Benchmark against prior years. Flag outliers with explanation.

4. Outcomes and consequences

This is where most reports go thin. What happened as a result of substantiated concerns? Disciplinary action, process change, control remediation, regulatory notification. Name the categories of action without identifying individuals.

5. Detriment monitoring

SYSC 18 expects firms to protect whistleblowers from detriment. The report should describe how the firm tests for this: exit interview themes, performance rating analysis for known reporters, follow-up contact after case closure. Silence on detriment is a red flag, not a reassurance.

6. Thematic lessons and systemic issues

What did the firm learn across cases? Which control weaknesses or conduct patterns emerged? This section tells the board whether whistleblowing is being used as a lagging indicator of control health, or filed away case by case.

7. Awareness, training and channel effectiveness

Training completion rates are table stakes. More useful: staff survey data on confidence to speak up, awareness of channels, and belief that concerns will be acted on without retaliation. Break this down by business and seniority.

8. Honest acknowledgement of gaps

Where did handling fall short? Where did timelines slip? Where did the firm receive external complaints that should have surfaced internally first? A report with no self-criticism is almost never accurate.

What most firms get wrong

Three recurring failures. First, treating the report as a compliance artefact owned by the second line rather than a governance tool owned by the Champion. Second, presenting data without interpretation, leaving the board to form judgements it is not equipped to form. Third, omitting any mention of concerns that turned out to be well-founded and uncomfortable, which signals to the board that it is being managed rather than informed.

What good looks like

A report a non-executive can read in forty minutes and come away able to ask sharp questions of named executives. It makes a cultural judgement and defends it with evidence. It includes at least one finding that is uncomfortable for the executive to read. The Champion has clearly drafted or materially shaped the narrative, not merely signed it.

Next step

Before the next reporting cycle, ask the Champion to review the last two reports and identify what judgements they would have been unable to form from the evidence presented. That gap is your drafting brief for this year.

Frequently Asked Questions

Who should draft the report?

The second line typically produces the data and first draft, but the Whistleblowers' Champion must shape the narrative and cultural assessment. If the Champion is only reviewing a finished document, the governance model is not working as SYSC 18 intends.

How much case detail is appropriate at board level?

Enough to illustrate themes and outcomes, never enough to identify individuals. Anonymised case studies covering the most significant substantiated concerns are usually right. Raw case logs belong elsewhere.

Should the report go to the regulator?

There is no routine submission requirement, but the FCA can and does ask for it, particularly during supervisory engagement or following a reportable concern. Write it assuming it will be read externally.

How do we evidence culture rather than just process?

Triangulate: case data, staff survey results, exit interview themes, detriment testing, and qualitative input from employee networks or forums. Any single source can be gamed or misread. Convergence across sources is what gives the Champion's judgement weight.

What if the data looks bad?

Present it. A report showing rising anonymous reports or detriment allegations, honestly analysed, is far more credible than a reassuring picture the board later discovers was incomplete. The regulatory and reputational risk sits in concealment, not in the underlying numbers.