Updated January 2022
Effective date of this Whistleblower Policy: 16 December 2021
The Whistleblower regime commenced on 1 July 2019. This regime provides that a person (Whistleblower) can make disclosure, anonymously if they choose, regarding any wrongdoing (Disclosable Matter) and can (in certain circumstances) be protected under the Corporations Act against (i) loss of anonymity, (ii) loss of confidentiality, (iii) any detriment.
In addition, on 13 November 2019, ASIC released Regulatory Guide 270 – Whistleblower Policies, setting out comprehensive requirements and guidance on the content of whistleblower policies.
The Company, its officers and other senior people within the Company have obligations under the Corporations Act if they receive a report from a Whistleblower. This policy has been adopted as an important tool for helping the Company to identify wrongdoing that may not otherwise be uncovered unless there is a safe and secure means for disclosing such wrongdoing.
The Board seeks to conduct its business within the law and with integrity and honesty. In particular, the Company seeks to avoid engaging in conduct that, amongst other matters (i) is an offence under the Corporations Act 2001 (Cth); (ii) is an offence against any Commonwealth law; or (iii) represents a danger to the public.
Whistleblowers are encouraged to report any wrongdoing by the Company or its employees. However, we recognise that Whistleblowers may not always feel comfortable about discussing concerns internally — especially if the Whistleblower believe that the Company or its officers or employees are responsible for the wrongdoing.
This policy covers a situation where there is misconduct or an improper state of affairs or circumstances in relation to the Company and can include a matter where the discloser has reasonable grounds to suspect the Company, an officer or employee of the Company, has engaged in Improper Conduct.
A potential discloser can obtain further information with respect to this policy from the Eligible Recipient and, if uncertain, should seek independent legal advice.
The aim of this Policy is to ensure:
• Whistleblowers feel confident that to raise any serious matter;
• Whistleblowers know that if they make a report, then it will be taken seriously and treated as confidential (with certain exclusions);
• Whistleblowers know that if they report Improper Conduct, their identity will be protected (with certain exclusions);
• Whistleblowers know no detrimental action will be taken against them as a result;
• the Company meets its legal and regulatory obligations; and
• the Company aligns its internal policies with the ASX Corporate Governance Principles and Recommendations.
In addition to those matters set out above, the purpose of this Policy is to ensure that:
The Whistleblower is protected (e.g. ongoing employment, status, reputation and well-being). The Whistleblower should not be disadvantaged by Whistleblower activity.
Whistleblowers are encouraged to use the procedure set out below if they:
Once a valid Whistleblower Report is made to the Eligible Recipient (or Next Eligible Recipient) by an Eligible Whistleblower, the Whistleblower is entitled under the Whistleblower Act to identity protection, protection from detrimental acts or omissions, compensation and remedies and may, subject to applicable law, be entitled to civil, criminal and administrative protection.
References in this policy to “discloser” is to an Eligible Whistleblower and references to “disclosure” are to a valid Whistleblower Report except where the context otherwise requires.
Any person who works with the Company, or for the Company (i.e. an Eligible Whistleblower), should use this Procedure.
An Eligible Whistleblower is a person who:
Whistleblowers are encouraged to disclose a Disclosable Matter which leads the Whistleblower to believe that malpractice is occurring, may occur, or has occurred.
In particular, Whistleblowers should disclose the occurrence or likely occurrence of any of the following:
Disclosures (for example, personal work-related grievances that do not relate to detriment or threat of detriment to the discloser) that are not about Disclosable Matters are not covered by the policy because they do not qualify for protection under the Whistleblower Act. Such disclosures may, however, be protected under other legislation.
Personal work-related grievances are those that relate to the discloser’s current or former employment and have, or tend to have, implications for the discloser personally, but do not:
Examples of a grievance that may be a personal work related grievance include:
A work related grievance may, however, still qualify for protection if:
As a preliminary step, an individual should consider if they are an Eligible Whistleblower under this Policy. If not, consider other means to deal with the concerns. One alternative would be to have a discussion with a Person Of Responsibility.
Secondly, consider if the matter sought to be disclosed is a Disclosable Matter under this policy. If it is not, one alternative would be to discuss the matter with a Person Of Responsibility.
A disclosure made to a legal practitioner for the purposes of obtaining legal advice or representation in relation to the operation of the Whistleblower provisions in the Corporations Act is also protected. A Whistleblower may also seek external advice from or make a disclosure to parties outside the organisation such as regulatory bodies, journalists and members or parliament under certain circumstances, including where such disclosure is an Emergency Disclosure or Public Interest Disclosure, and such disclosures to external parties may attract the protection of relevant legislation.
Details of the circumstances of an Emergency Disclosure or Public Interest Disclosure are set out in the definitions section of this policy. It is strongly recommended that these circumstances are reviewed, and independent legal advice is obtained, prior to making an Emergency Disclosure or Public Interest Disclosure.
Disclosures of information relating to disclosable matters can also be made to ASIC, APRA or another Commonwealth body prescribed by regulation that qualify for protection under the Corporations Act.
Where it is uncertain if a disclosure qualifies for protection under this policy, the Company may elect, at its discretion, to treat the disclosure as though the disclosure is protected.
The Eligible Recipient is the Company Secretary.
An individual should make a Whistleblower Report only to the Eligible Recipient. The contact details for the Eligible Recipient are available at the website of the Company and will otherwise be provided when this policy is disseminated to potential disclosers.
However, if the Disclosable Matter involves the Company Secretary, or it is believed that it is inappropriate for disclosure of the Whistleblower Report directly to be made to the Company Secretary for any reason, then concerns should be raised with a Next Eligible Recipient.
When seeking to make a Whistleblower Report, a reporting party must at that same time (i.e. during the same communication) (i) clearly identify that the communication is a Whistleblower Report and (ii) that the reporting party seeks that the communication to be dealt with under this Policy.
If an individual fails to clearly identify the communication as a Protected Communication at the first instance, then it cannot be dealt with under this Policy and will not be treated as a Whistleblower Report.
A written Whistleblower Report may be made anonymously. This discloser can refuse to answer questions that they feel could reveal their identity at any time, including during follow-up conversations.
It is suggested that a discloser who wishes to remain anonymous should maintain ongoing two-way communication so follow-up questions can be asked and feedback can be provided.
To protect the anonymity of the discloser, the following measures may be implemented:
If the initial Whistleblower Report is verbal, the reporting party may be requested to put the concerns in writing if that is essential for the matter to be dealt with.
In making a Whistleblower Report, the report party expressly affirm and promise that it is not being made for a Wrongful Purpose or for Wrongful Purposes.
The recipient of a valid Whistleblower Report shall both (i) seek to resolve the Disclosable Matter (i.e. cause wrongdoing to cease and not recur) and at the same time seek to (ii) protect the confidentiality, anonymity and interests of the Whistleblower under the provisions of this Policy.
The Company will acknowledge a discloser after receiving their disclosure.
As a preliminary step, the Company will assess each disclosure to determine whether it qualified for protection and if a formal, in-depth investigation is required.
To be clear, the purpose of this Policy is to ensure that wrongdoing is stopped (and does not recur) and that the broad interests (e.g. ongoing employment, status, reputation and well-being) of the valid Whistleblower are protected. A legitimate Whistleblower should not be disadvantaged by the valid Whistleblower activity.
The Company will investigate the Disclosable Matter as soon as is reasonably practicable and will endeavour to finalise an investigation as expeditiously as possible.
Typically the Eligible Recipient will need to determine if the matter is a disclosure to which protection will apply and, if so, if the Company needs to investigate the disclosure.
Once it is established that an investigation is warranted, the Company will determine the nature and scope of that investigation, the person(s) (either internal, external or both) who should lead the investigation, the nature of any technical, financial or legal support required to support the investigation and the timeframe for the investigation.
Following the parameters of the investigation being set as described above, the person(s) leading the investigation will determine the appropriate way forward, including the documentation to be obtained and persons to be interviewed. Once all relevant information has been obtained, the person(s) leading the investigation shall provide a report on their findings to the Eligible Recipient (or Next Eligible Recipient, as applicable) for consideration and action by the Board and the Company generally whilst maintaining confidentiality of the Discloser.
Where possible, the Company will endeavour to provide the discloser with a copy of the findings as received from the person(s) leading the investigation and the proposed action to be taken. It is further anticipated that the findings will be communicated to each Person of Responsibility.
Notwithstanding the above, the method of documenting and reporting findings will be dependent upon the nature of the disclosure and there may be circumstances where it is not appropriate for the Company to provide details of the outcome to the discloser.
Investigations shall be objective, fair and independent. The confidentiality of the investigation shall be paramount. To ensure fairly and independence, investigations shall be independent of the discloser (subject to keeping the discloser informed as set out below), individuals who are subject of the disclosure and the department or business unit involved.
All investigations where additional specialist skills or expertise may be necessary shall be undertaken jointly with an external investigation firm.
It is noted however that the process for and time within which a Disclosable Matter may be investigated is dependent upon the circumstances on a case by case basis.
In addition, the Company may not, without the discloser’s consent, disclose information that is likely to lead to the identification of the discloser as part of its investigation process, unless:
The Company will ensure the confidentiality of its disclosure handling and investigation process and will ensure appropriate records and documents are maintained for the investigation.
The investigative process of the Company may be limited. The Company may not be able to adequately undertake an investigation if it is not able to contact the discloser. The Company may investigate a disclosure by requesting the discloser for consent to a limited disclosure. The Company may also investigate a disclosure by conducting a broad review on the subject matter or the work area disclosed.
In addition, the Company could investigate an anonymous disclosure, even if it cannot get in contact with the discloser, if the discloser has provided sufficient information and the Company removes information that is likely to lead to identification of the discloser.
If the discloser has provided contact details (including anonymously), the Company will keep the discloser informed as to how progress is being made. The frequency of updates may vary depending on the nature of the disclosure. The Company will ensure that anonymity of the discloser is not compromised as a result of providing regular updates.
Updates are proposed to be provided to the discloser when the investigation has commenced, is in progress and has been finalised. If possible, the Whistleblower will be informed of the outcome of the investigation and of any action that is proposed to rectify any wrongdoing or malpractice.
The Company intends to conduct its investigations on the substance of all disclosures, without regard to the motives of the discloser (unless such motive is directly relevant to the disclosure).
All investigations of disclosures will be conducted in accordance with this policy. The Company will, where possible, review the investigation in respect of a disclosure to ensure it has been made in accordance with this policy and the processes and procedures have been adhered to.
Any disclosure properly made under this policy will be treated as confidential.
The identity of the discloser or information that is likely to lead to the identification of the disclosure cannot be disclosed. This prohibition applies to all persons, including those which have obtained the details directly or indirectly because the discloser has made a disclosure that qualifies for protection.
The preceding paragraph does not apply if a person discloses the identity of the discloser:
In addition, a person can disclose the information contained in a disclosure with or without the discloser’s consent if:
It is illegal for a person to identify a discloser, or disclose information that is likely to lead to identification of a discloser, outside the above exceptions. The discloser can lodge a complaint with the Eligible Recipient or a Next Eligible Recipient about any actual or believed breach of confidentiality. The discloser may lodge a complaint with a regulator, such as ASIC, APRA or the ATO, for investigation.
It is proposed that the Company will, where considered appropriate, implement the following actions to reduce the risk of the discloser being identified:
To ensure secure record keeping and information sharing process, it is proposed that:
The Eligible Recipient is responsible for discussing and managing the Company’s measures for ensuring confidentiality of the identity of the discloser.
It is noted that, in practice, people may be able to guess the discloser’s identity if:
The discloser or any other person are protected from detriment in respect of a disclosure.
A person cannot engage in conduct that causes detriment to a discloser (or another person), in relation to a disclosure, if:
In addition, a person cannot make a threat to cause detriment to a discloser (or another person) in relation to a disclosure. A threat may be express or implied, or conditional or unconditional. A discloser (or another person) who has been threatened in relation to a disclosure does not have to actually fear that the threat will be carried out.
Detrimental conduct may include, but is not limited to:
The following are examples of actions that are not detrimental conduct. The following examples are not an exhaustive list:
The Company shall ensure that the discloser understands the reason for the Company undertaking the relevant administrative or management action.
A discloser or other person can seek compensation and other remedies through courts if:
Disclosers are encouraged to seek independent legal advice.
A discloser may, subject to applicable law, be protected from any of the following in relation to their disclosure:
These protections do not grant immunity for any misconduct a discloser has engaged in that is revealed in their disclosure.
The following are measures that the Company may adopt to protect disclosers from detriment:
The discloser may wish to seek independent legal advice or contact regulatory bodies, such as ASIC, APRA or the ATO, if they believe they have suffered detriment.
The Company will consider the risks of detriment as part of its risk management framework and will ensure appropriate records are kept in connection with the consideration and action taken in respect of detriment.
The Company is committed to ensuring fairness in connection with any disclosure, both for the discloser and any person named in the disclosure. This section sets out the measures and/or mechanisms the Company may implement for ensuring the fair treatment of individuals mentioned in a disclosure:
An individual the subject of a disclosure will be informed about the investigation prior to the Company making any adverse findings against them. The Company will balance the need to inform the individual the subject of a disclosure with the potential for same to compromise the effectiveness of the investigation of the disclosure.
If a discloser is dissatisfied with the way that the Company is dealing with its Whistleblower Report, then those concerns should be expressed in writing to the Eligible Recipient or a Next Eligible Recipient. The Company undertakes to respond to concerns.
If such concerns arise in respect of an investigation of a Whistleblower Report then the Company may determine to review the investigation to ensure it was conducted in accordance with this Policy and the processes and procedures set out herein.
Some matters are difficult to deal with. If a reporting party is dissatisfied with the way that the Company is dealing with its Whistleblower Report, it many need to make a further Whistleblower Report to External Authorities.
If a discloser believes that confidentiality, anonymity or Whistleblower Protection are not being dealt with properly then they should immediately inform the Eligible Recipient or a Next Eligible Recipient Under this Policy the Company undertakes to take appropriate action.
Some matters are difficult to deal with. In such cases, the Company itself may engage with External Authorities to report or resolve the wrongdoing. If this is necessary, then the Company reserves the right to involve one or more External Authorities with or without the prior consent of the Whistleblower. Where possible, the Company will seek to preserve the anonymity of the Whistleblower, but will make legally required disclosures which may include the identity of the Whistleblower and the Whistleblower Report.
If an External Agency is engaged, then confidentiality and anonymity of the Whistleblower shall be in the hands of the External Agency and their subsequent activities.
The Whistleblower Act is intended to protect authentic Whistleblowers. This Policy will not be used for purposes other than as provided for in the Whistleblower Act. Use of this Policy for Wrongful Purposes is not protected by this Policy or the Whistleblower Act.
Making a Whistleblower Report for Wrongful Purposes or use of this Policy for Wrongful Purposes will constitute misconduct and may result in the Company (i) taking disciplinary action against the reporting party under their employment contract or (ii) reporting the conduct to External Authorities.
Making a Whistleblower Report for Wrongful Purposes or use of this Policy for Wrongful Purposes will not be covered by anonymity or confidentiality provisions of this Policy.
The policy will be held within the Company’s online filing system and will be maintained and updated by the Company Secretary. The Company will endeavour to send this policy to all existing and future internal staff and contractors. The Company will also make this policy (with redactions as necessary) available on its website.
A copy of the policy as available on the website can be provided in soft copy on request to the Company Secretary.
This policy will also form part of the materials received by new employees at induction.
Any updates to this policy shall be disseminated as set out above.
The Company will endeavour to arrange for training in respect of this policy, and in particular training for those persons who have a specific role under this policy (Eligible Recipient and Next Eligible Recipient) and management so that they are aware of their obligations. The Company will further endeavour to arrange for training of all employees, including those based overseas.
If the CEO or Company Secretary become aware of a breach of this Policy, then they should notify the Board without delay.
The Board will review this Policy from time to time. The Policy may be amended by resolution of the Board. This Policy is a public document and may be placed on the Company’s web site in satisfaction of regulatory obligations.
In this Policy:
Board means the Board of Directors of the Company.
CEO means the Chief Executive Officer of the Company.
Company means Cocoon Data Technologies Limited [ACN 632 374 531].
Company Secretary means the company secretary of the Company.
Corporations Act means the Corporations Act 2001.
Director means a director of the Company.
Disclosable Matter means a matter where the discloser has reasonable grounds to suspect that the information concerns serious misconduct or an improper state of affairs or circumstances in relation to the Company and can include a matter where the discloser has reasonable grounds to suspect the Company, an officer or employee of the company, has engaged in conduct that (i) is an offence under the Corporations Act 2001 (Cth) or other applicable legislation; (ii) is an offence against any Commonwealth law punishable for 12 months or more by imprisonment; (iii) represents a danger to the public or the financial system; or (iv) is prescribed by regulation.
Eligible Recipient means person authorised by the Company to receive disclosures under the Policy, being the Company Secretary.
Eligible Whistleblower means a person who can rely on the rights and protections afforded under this Policy and the law if they report misconduct as set out in section 1.4.
Emergency Disclosure is a disclosure of information to a journalist or parliamentarian, where:
(a) The discloser has previously made a disclosure of the information to ASIC, APRA or another Commonwealth body prescribed by regulation;
(b) The discloser has reasonable grounds to believer that the information concerns a substantial or imminent danger to the health and safety of one or more persons or the natural environment;
(c) Before making the emergency disclosure, the discloser has given written notice to the body noted in (a) above that:
(i) Includes sufficient information to identify the previously disclosure; and
(ii) States that the discloser intends to make an emergency disclosure; and
(d) The extent of the information disclosed in the emergency disclosure is no greater than is necessary to inform the journalist or parliamentarian of the substantial and imminent danger.
Employee means any employee of the Company.
External Authorities means authorities such as Australian Securities Exchange (ASX), Australian Securities and Investments Commission (ASIC) or Police (State or Federal).
Improper Conduct means an officer or employee of the company has engaged in conduct that (i) is an offence under the Corporations Act 2001 (Cth); (ii) is an offence against any Commonwealth law punishable for 12 months or more by imprisonment; or (iii) represents a danger to the public.
Next Eligible Recipient means a person other than the Eligible Recipient authorised to receive Whistleblower Reports. This includes a Person Of Responsibility or the auditor of the Company. Details of the auditor of the Company are available in the annual report or financial information of the Company.
Person Of Responsibility means a Director or the CEO.
Policy means this whistleblower policy (including as amended from time to time).
Protected Communication means a communication from an Eligible Whistleblower that clearly identifies to the Eligible Recipient (or the Next Eligible Recipient) both (i) that the communication is a Whistleblower Report and (ii) that the Eligible Whistleblower seeks the communication to be dealt with under this Policy.
Public Interest Disclosure is a disclosure of information to a journalist or a parliamentarian, where:
(a) At least 90 days have passed since the discloser made the disclosure to ASIC, APRA or another Commonwealth body prescribed by regulation;
(b) The discloser does not have reasonable grounds to believe that action is being, or has been taken, in relation to the disclosure;
(c) The discloser has reasonable grounds to believe that making a further disclosure of the information is in the public interest; and
(d) Before making the public interest disclosure, the discloser has given written notice to the body noted at (a) above that:
(i) Includes sufficient information to identify the previously disclosure; and
(ii) States that the discloser intends to make an emergency disclosure; and
Whistleblower means a person reporting a matter under the Policy and invoking protections under the Whistleblower Act.
Whistleblower Act means Treasury Laws Amendment (Enhancing Whistleblower Protections) Act 2019.
Whistleblower Protection means the Whistleblower is protected i.e. their ongoing employment, remuneration rates, promotion opportunities, status, reputation and well-being shall not be disadvantaged by the legitimate Whistleblower activity.
Whistleblower Report means a communication (verbal, written, electronic communication or
Wrongful Purpose(s) means for example, purpose or purposes (i) other than provided for in the Whistleblower Act, (ii) for malicious or mischievous purposes or (iii) to pursue a grudge or vendetta against another employee or the Company.