"We've got a hotline, so we're covered." The most expensive sentence in workplace governance

In the world of workplace governance, claiming you “have a hotline, so we’re covered” assumes that the existence of a reporting channel equates a safe culture. But as recent regulatory data from both the UK and Australia shows, having a policy is not the same as having a system people trust.

For organisations operating under the UK’s “all reasonable steps” standard or Australia’s “positive duty” framework, the bar has moved and it’s no longer enough to have a policy buried in a drawer or on an intranet page. You must have an infrastructure that people can access – and trust.

The Measuring of Silence: What the Regulators Found

In late 2024, the Australian Securities and Investments Commission (ASIC) published a landmark review of whistleblower programs. The findings were a wake-up call for boards: 22% of companies surveyed received zero whistleblower disclosures in an entire year and 36% had no dedicated reporting webpage. ASIC was clear: zero reports are not a sign of a healthy culture; they are a red flag. And when nearly one in four companies hears nothing, it isn't because there are no problems, it’s because the system is failing to capture them.

The UK tells a similar story. While most firms have a policy, the House of Commons ‘Sexism in the City’ report highlighted that 70% of women in financial services still feel uncomfortable reporting misconduct. The infrastructure is “present,” but it is not “trusted.”

"A speak-up channel that receives no reports isn't proof of a safe workplace; it's evidence that your employees are managing the risk themselves by staying silent."

What Genuinely Safe Infrastructure Requires

To move from an underused hotline to a trusted infrastructure, an organisation must provide six core elements - all of which are foundational to the Veremark platform:

1. Technical (Not Promised) Anonymity

Trust cannot be based on an HR representative’s promise of confidentiality. It must be baked into the code. Genuinely safe systems , like Veremark’s, use end-to-end encryption and zero-identity-linkage technology. If an employee suspects their IP address or metadata could be traced by internal IT, the risk of speaking up remains too high.

2. Two-Way Secure Communication

The “black hole” effect - where a report is submitted and never heard of again - is a primary killer of trust. Our system allows for ongoing, anonymous dialogue. This means investigators can ask follow-up questions and provide the reporter with the feedback they need to feel their disclosure was worthwhile, all without ever exposing their identity.

3. Third-Party Operation

Another documented barrier to reporting is the “HR loyalty conflict”. When a channel is managed entirely in-house, employees often fear the department’s primary loyalty is to protect the organisation’s reputation. Using an independent third-party platform removes this perceived conflict of interest and provides a neutral space for disclosure.

4. A User-Friendly Environment

Reporting misconduct is an act of extreme stress. If the process requires navigating a legalistic, clunky portal, people will give up halfway through. Safe infrastructure must be multi-channel (web and mobile) and designed for disclosure, not just investigation. It should feel like a supportive conversation, not an interrogation.

5. Trauma-Informed Design

For sensitive issues like sexual harassment, the interface matters. A trauma-informed design recognises that disclosure is difficult. Our platform uses neutral, non-judgmental language and allows the user to save their progress and return when they are ready. It prioritises the psychological safety of the user from the first click.

6. Expert-Led Content

A hotline is only as good as the data it captures. Veremark provides survey questions and templates designed by investigators who understand the nuances of sexual harassment. They ensure the right questions are asked sensitively to capture patterns of behaviour, not just isolated incidents.

From "Complaints" to "Prevention"

Most catastrophic workplace failures start as "early-stage signals": a pattern of inappropriate comments, a discomforting team dynamic, or a specific manager’s repeated "jokes." In a low-trust environment, these aren't reported because they aren't "formal" enough. In a high-trust environment, these signals reach leadership early, allowing for intervention before the behaviour escalates into a reputational or legal liability.

A Tale of Two Organisations: Which One Sees Risk?

The difference in infrastructure determines what a board sees:

Company A has an internal hotline managed by HR. The system captures the reporter’s email automatically "for the record." It’s a one-way portal; no follow-up occurs unless a formal investigation is triggered.

The result? They receive 2 reports per year, both high-level formal grievances. By the time they hear about a problem, the damage is done and the legal fees are mounting.

Company B uses Veremark’s independent platform with guaranteed anonymity and two-way secure messaging. The reporter can choose how much information to share and when.

The result? They receive 18 reports annually. These aren't all crises; they are a mix of bystander observations and informal concerns.

Company B is the one actively managing risk; by seeing the smoke before the fire begins they can start to spot any recurring patterns and act.

Company A is simply waiting for the building to burn.

What This Means for Leadership

Under the current regulatory frameworks in the UK and Australia, the absence of a reporting record is no longer a defence. In fact, regulators now view a lack of reports as evidence that your prevention system is not functioning.

The question is whether your current infrastructure is genuinely trusted, or whether it exists on paper. 

Building a connected system - where pre-hire screening establishes the baseline and a robust, independent speak-up channel maintains it - is the only way to answer the questions that matter most: What did you know? And what did you do to make it safe for people to tell you?

Veremark provides the infrastructure that bridges this gap, connecting screening data with expert-led, anonymous reporting channels to ensure your organisation is never flying blind. Talk to us about building the connected system that proves duty of care before, during and after a hire.

‍