By the time a problem reaches the headlines or the regulator, someone inside the building usually knew. They watched the corner being cut, the number being massaged, the customer being misled, and they said nothing, or they said something quietly and watched it go nowhere. Whistleblowing is the last, loudest version of speaking up. A speak-up culture is the quieter system that makes the loud version rarely necessary.

The quick version

  • Whistleblowing is when someone discloses wrongdoing they have seen at work, usually after internal channels failed, to someone who can act on it. Speak-up culture is the everyday willingness to raise a concern early, before it becomes a disclosure.
  • The barrier is not ignorance; it is fear. People weigh the personal cost of speaking against the odds anything changes, and in surveys, nearly half of those who do report wrongdoing say they then faced retaliation.
  • The law (in the UK, the EU and elsewhere) protects qualifying disclosures, but compliance is a floor, not a culture. A protected channel that nobody trusts collects silence, not concerns.
  • The leader's job is to change the maths, make raising a concern feel safe, taken seriously, and consequence-free for the messenger, so that problems surface as small as possible.

The idea in depth: speaking up is a calculation, not a virtue

It is tempting to treat silence as a character flaw, people should just speak up. The research treats it as a rational decision instead. The foundational model comes from Janet Near and Marcia Miceli, whose 1985 paper "Organizational Dissidence: The Case of Whistle-Blowing" in the Journal of Business Ethics gave the field its working definition: the disclosure by organisation members of "illegal, immoral, or illegitimate practices under the control of their employers, to persons or organizations that may be able to effect action." Their key move was to frame whistleblowing as a process of decisions, the would-be whistleblower weighs the seriousness of the wrong, their own responsibility, and crucially the likely reaction of those in power. Silence is often the output of that calculation, not the absence of one.

Which points at the actual lever: stop moralising and start lowering the cost. It is not a poster telling people to be brave; it is everything that shifts the odds, a visible track record of concerns being acted on, an owner who is not the person being complained about, and protection that is real rather than promised. You are not appealing to virtue; you are repricing a risk.

The reason this matters is captured by Amy Edmondson's work on psychological safety, the shared belief that a team is safe for interpersonal risk-taking, which she first defined in a 1999 study of hospital teams and developed in The Fearless Organization (2019). Speaking up about a problem is exactly such a risk: you might look incompetent, negative, or disloyal. Where safety is low, the rational individual swallows the concern; the organisation only learns about the failure once it is expensive. Whistleblowing, in this light, is what a speak-up culture looks like after it has already broken down.

flowchart TD
  A(["I've seen something wrong"]) --> B{"Do I believe
raising it is safe
and worthwhile?"}
  B -->|"Yes"| C(["Raise it early,
internally, informally"])
  B -->|"No, fear > hope"| D(["Stay silent"])
  C --> E{"Was it heard
and acted on?"}
  E -->|"Yes"| F(["Problem fixed small.
Trust banked"])
  E -->|"No"| G(["Escalate, or give up"])
  G --> H(["Formal whistleblowing
(or external leak)"])
  D --> I(["Problem grows
until it surfaces by crisis"])
Every concern runs this gauntlet. A speak-up culture widens the green path; whistleblowing law guards the red one. Leaders Loop

What the law actually does, and where it stops

Most jurisdictions now give whistleblowers a legal shield, and leaders should know its shape. In the UK, the Public Interest Disclosure Act 1998 (PIDA), which amends the Employment Rights Act 1996, protects a worker who makes a "protected disclosure", broadly, information they reasonably believe shows wrongdoing such as a criminal offence, a breach of legal obligation, a danger to health and safety, or environmental damage, and which they reasonably believe is in the public interest. Notably, the protection applies from day one of employment, with no qualifying service period (per Acas and Protect). Across the EU, the Whistleblowing Directive (2019/1937) goes further on the system side: it requires private-sector organisations with 50 or more employees to set up internal reporting channels, and protects not only the reporter but supporters and even journalists from dismissal and discrimination.

Treat the legal channel as the floor, then assume it is not enough on its own. The Directive can make you install a hotline; it cannot make anyone phone it. Use the law to get a confidential channel with a named owner outside the normal management line, then spend your real effort on whether people believe using it is safe. Compliance buys you a mechanism; culture decides whether the mechanism ever hears the truth. (This is a general summary, not legal advice, whistleblowing law differs by country and changes, so check your jurisdiction with a qualified professional.)

A hotline collects calls. A culture collects concerns, and most concerns never dial a number.

Why "we have a hotline" is the wrong scoreboard

The most revealing numbers in this field are about reaction, not reporting. The Ethics & Compliance Initiative's 2023 Global Business Ethics Survey, drawing on more than 70,000 employees across 42 countries, found that 65% of employees observed misconduct in the prior year, and encouragingly 72% of those who saw it reported it. But 46% of employees who reported said they then experienced retaliation, a figure that did not improve from the 2020 survey. That is the load-bearing statistic: not how many people speak, but how many get burned for it. When almost half of reporters face payback, silence is not apathy, it is pattern recognition.

All of which is an argument for changing the scoreboard. Counting hotline calls rewards volume and tells you nothing about trust; a quiet line might mean a clean company or a frightened one, and you cannot tell which. Track instead the things that signal whether speaking up pays: what proportion of concerns get a substantive response and a closing-the-loop conversation, how long that takes, and, the one most organisations never measure, what happens to the careers of people who raised concerns twelve months later. If your reporters are quietly leaving, you have your answer.

An honest limitation. These models and surveys describe tendencies, not guarantees. Self-reported retaliation figures rely on the reporter's perception of cause, which is hard to verify; psychological-safety research is strong on team-level learning but thinner on predicting individual acts of disclosure; and Near and Miceli's process model is a lens for asking "what would make speaking up rational here?" rather than a formula that outputs a decision. Use them to interrogate your own environment honestly, not to claim certainty about why a specific person stayed quiet.

A worked example

Take a mid-sized logistics firm, call it Meridian. (Illustrative throughout; this is a teaching example, not a real company.) A warehouse supervisor, Priya, notices that night-shift loading times are being logged as compliant when they routinely breach the safe-handling limit. She has seen the company's glossy "Speak Up" poster. She has also seen what happened to a colleague who flagged a rota problem last year and was quietly moved to a worse shift.

Run Priya through the Near–Miceli calculation: the wrong is serious, she feels responsible, but her read on the likely reaction is bad, so she stays silent, and the breach grows until an injury forces it into the open. Now rerun it under a real speak-up culture. Her team lead has, in the past quarter, acted visibly on two smaller concerns and said so openly in a team meeting (modelling that raising things is normal and welcomed, Edmondson's first move). There is a concern owner in safety, not in Priya's reporting line. When she raises it, she gets a response within days, a fix, and, critically, no shift change. The cost of speaking has been repriced from "career risk" to "routine."

flowchart LR
  A(["Priya sees a
safety breach"]) --> B{"What's her read on
the likely reaction?"}
  B -->|"Bad, saw a colleague punished"| C(["Stays silent → injury
forces it into the open"])
  B -->|"Good, concerns acted on before"| D(["Raises it early to a
safety owner, not her boss"])
  D --> E(["Fixed in days,
no payback → trust banked"])
Same person, same breach, the only variable changed is the expected reaction. Leaders Loop

Nothing in the better version required a new policy document. It required a leader who had already proven, in low-stakes moments, that the channel works, so that when a high-stakes moment arrived, the calculation came out differently. That is the whole game: a speak-up culture is built in the small concerns you handle well long before the big one lands.

Frequently asked questions

What's the difference between whistleblowing and just complaining?

Whistleblowing concerns wrongdoing that affects others or the public interest, illegality, danger, fraud, serious misconduct, not a personal grievance about your own treatment, which usually runs through a separate HR or grievance process. The legal protections (like the UK's PIDA) attach to disclosures "in the public interest," so the distinction matters both ethically and legally. In everyday speak-up culture the line blurs, which is fine: the goal is that any concern gets heard early, then routed to the right process.

Should reporting be anonymous?

Allow it, but don't rely on it. Anonymous channels lower the barrier for the most frightened reporters and can surface concerns that would otherwise stay buried, but they make investigation harder and can signal that the organisation expects retaliation. The stronger aim is confidential, named reporting that people trust enough to use, anonymity is a safety valve for when that trust has not yet been earned, not a substitute for earning it.

Won't a speak-up culture just invite endless complaints and false reports?

This is the common fear, and the evidence is reassuring: in the ECI survey most observed misconduct is real and reported in good faith, and malicious false reports are a small minority. A culture that handles concerns visibly and fairly tends to reduce noise over time, because people see that the channel is for genuine issues and is taken seriously. The bigger risk by far is the opposite, concerns suppressed until they become crises.

What do I actually do if someone raises a serious concern?

Thank them, take it seriously on its face, and protect them, the three things most likely to be skipped under pressure. Acknowledge quickly, route it to an owner independent of the people involved, keep the reporter informed of progress (even if you cannot share detail), and actively watch for any retaliation, including the subtle kind like exclusion or a worse assignment. How you treat this reporter is the advertisement everyone else reads before deciding whether to speak next time.

Is a hotline enough to comply with the law?

It may satisfy the mechanical requirement, for example, the EU Directive's demand that larger organisations provide internal reporting channels, but compliance and effectiveness are different questions. A channel nobody trusts meets the letter of the rule and fails its purpose. Treat the legal channel as the minimum scaffolding, then invest in the culture that determines whether it is ever used honestly. Check your specific obligations with a qualified professional.

Related in the Toolkit

Speak-up culture is one expression of a deeper question, what the organisation considers right, and who is accountable for it. It sits alongside the frameworks you use to reason about conduct (business ethics & ethical frameworks) and the body ultimately answerable for it (board roles & committees).

Where to go next