A specific misunderstanding trips up small and mid-sized association boards on this topic more than any other point in the whistleblower regime: many assume that falling under a revenue threshold exempts them from the law entirely. It does not. It exempts them from one specific requirement, having a formal written policy, while leaving the actual legal protections fully in force regardless of size.
Two separate obligations, often confused
Part 9.4AAA of the Corporations Act 2001 (Cth) imposes the substantive whistleblower protection regime on every company, including every company limited by guarantee, regardless of size or revenue. This includes strict confidentiality obligations around a whistleblower's identity, and prohibitions on causing or threatening detriment, dismissal, demotion, harassment, or reputational damage, against someone who has made or is believed to have made a protected disclosure. This substantive obligation applies universally to every CLG, with no size exemption at all.
The separate requirement to maintain a formal, documented whistleblower policy is genuinely narrower. ASIC has granted relief specifically to not-for-profit or charitable public companies limited by guarantee with annual consolidated revenue under $1 million, exempting them from the policy requirement. This relief applies to the policy document alone. It does not touch the underlying confidentiality and anti-detriment obligations, which continue to bind the organisation and its officers regardless of size.
Falling below the $1 million threshold means your board does not have to produce a formal written policy. It does not mean the law stops applying to how you actually treat someone who reports genuine wrongdoing.
Who this actually protects, and who must handle it properly
The definition of an eligible whistleblower is deliberately broad: current and former employees, officers, contractors, and suppliers, along with their relatives and dependants, and disclosures can be made anonymously. On the receiving end, an officer of the organisation, which includes every director, is automatically an eligible recipient under the Act, meaning a director who receives a genuine disclosure is immediately bound by the confidentiality and anti-detriment obligations whether or not they were specifically trained for the role. This is a real exposure point for volunteer boards: a director who mishandles a genuine disclosure, by failing to protect the whistleblower's identity or by allowing retaliation to occur, can trigger serious civil and criminal consequences for themselves personally, entirely separate from whether the organisation was required to have a formal policy at all.
A note for incorporated associations
The regime is not limited to companies limited by guarantee. An incorporated association can also be captured if it meets the constitutional definition of a trading or financial corporation, a genuinely fact-specific question turning on the extent of the organisation's trading or financial activities relative to its overall operations. Associations still incorporated under state legislation should not assume the regime is automatically irrelevant to them without actually checking this.
- Confirm whether your organisation is bound by the substantive Part 9.4AAA protections, which applies to essentially every CLG regardless of size, separately from whether the formal policy requirement applies.
- Even where the $1 million threshold exempts your organisation from the formal policy requirement, treat documenting a clear internal process as genuine good governance, consistent with sector guidance, rather than skipping it entirely because it is not technically mandatory.
- Ensure every director understands they are automatically an eligible recipient under the Act, and brief them specifically on the confidentiality and anti-detriment obligations that attach the moment they receive a genuine disclosure.
- If your organisation is an incorporated association rather than a CLG, confirm whether your trading or financial activities could bring you within the regime, rather than assuming the exemption applies by default.
- Connect whistleblower handling directly to the disciplinary and conduct discipline discussed earlier in this quarter, since a whistleblower disclosure often surfaces exactly the kind of conduct issue that discipline is designed to address.
A whistleblower regime that exists only on paper protects nobody, and a board that assumes size alone exempts it from the law is exposed in exactly the moment it matters most, when someone has genuinely trusted the organisation enough to come forward.
Explore the Board Director course
Want the fully branded, board-ready PDF of this article? Download the whole 52-part series — free.
Until next week,
Annie