25 September 2025

Te korahi o ngā paerewa Scope of the standards

These standards outline expectations on public sector organisations to support effective reporting and managing of wrongdoing concerns. Reporting information is key to identifying and managing wrongdoing. Staff need to feel confident that wrongdoing concerns will be taken seriously.

There are 3 key elements to these standards:

  1. Getting the foundations right from the start: organisational commitment to leadership, raising awareness, and supporting staff and managers through regular communication and training.
  2. Making sure processes are robust: taking concerns seriously when they are raised by ensuring systems are in place for monitoring, reporting, investigation, and effectively communicating with those involved in a report or disclosure.
  3. Keeping people safe: ensure they can feel safe in making reports, trust that organisations will act upon them, and ensure that organisations provide tailored and dedicated support and protections to staff to keep them safe from reprisal.

These standards cover all wrongdoing. Some forms of wrongdoing will be ‘serious wrongdoing’ under the Protected Disclosures (Protection of Whistleblowers) Act 2022 and reports may therefore need to be treated as protected disclosures. The Act sets out additional requirements for any organisation dealing with protected disclosures, including timely processes and careful safeguarding of the discloser’s identity.

Under the Act public sector organisations must have appropriate internal procedures which:

  • set out a process for the organisation to follow as the receiver of a protected disclosure
  • identify who in the organisation a protected disclosure may be made to
  • describe the protections available under the Act and how the organisation will provide practical assistance and advice to disclosers
  • are published widely and republished at regular intervals.

For more information, see the links below.

Protected Disclosures (Protection of Whistleblowers) Act 2022

Office of the Ombudsman

Speaking Up model standards (PDF, 268KB)

Getting the foundations right from the start

Organisation commitment, leadership and culture

Research tells us that organisational culture, tone from the top, level of awareness, processes, support and protection are critical in determining whether people will raise concerns about wrongdoing.

Organisations need to enable people to raise concerns in any circumstances and through whichever channel they feel most comfortable with, even where they may be uncertain or lack evidence to support their concerns.

People must be able to raise their concerns regardless of whether they are sure it meets the standard of a protected disclosure.

  • Informal: I can ask a question or speak privately to someone I trust in the organisation. I can raise a question in an open forum, such as at a team meeting or staff talk.
  • Through the line: I can discuss an issue or make a formal complaint to a manager or supervisor.
  • Directly to the chief executive: I can raise any concerns about possible wrongdoing directly with the chief executive.
  • Protected disclosure: I can talk to a designated impartial person within the organisation who is independent of the possible wrongdoing. I can also talk to a range of external authorities about a protected disclosure.
  • External escalation: I can also raise concerns about possible wrongdoing with an external agency (such as the Ombudsman, Auditor-General, or monitoring agency) if other avenues have been exhausted and I am still concerned, or if following internal procedure is not safe. 

Model standards

  • Organisations need a clear statement from senior leadership of their commitment and expectations to enable reporting of wrongdoing. This should clearly state what can be reported.
  • There will be procedures in all organisations for receiving and managing concerns of wrongdoing through at least the channels set out below.
  • The processes in place mean that any concern raised is considered for its potential as a protected disclosure.

Training and awareness

It is important that people have access to good training and information that is regularly reviewed and updated so that they know what to do, or where to look, if they have a concern about wrongdoing in the public sector.

Policies and procedures for raising concerns or making a complaint are supported by having designated people and mechanisms for staff to discuss their concerns or report wrongdoing in the way that they feel most comfortable.

Model standards

  • There are internal policies and processes readily available for people to access, including reference to these model standards and Your Complaints, Your Rights.
  • Training on reporting is covered at inductions as well as at regular intervals after this, particularly following any changes to policies or procedures.
  • Training for managers includes receiving and dealing with conflicts, complaints, protected disclosures, and identifying ‘red flags’.
  • There is a designated person or team that people can talk to about any concerns of wrongdoing.
  • There are provisions in place to ensure that any manager or supervisor can appropriately respond to a concern or report of wrongdoing that is raised with them.
  • All concerns reported to organisations are assessed and acted on in a timely way.

Making sure processes are robust

Roles, responsibilities and accountability 

Processes need to be robust, well understood by all staff, and fit together as a whole. Integrating processes for receiving and managing reports will support timely and appropriate resolution.

Impartiality

Impartiality is of the highest priority in considering and investigating concerns about wrongdoing.

Confidentiality

Staff have a responsibility to speak up where they see possible wrongdoing. In all cases, organisations must protect the confidentiality of people who raise concerns as far as is reasonably possible and take steps to safeguard their welfare during and after the reporting process.

Taking concerns seriously

Organisations have a responsibility to take all concerns raised seriously and to provide mechanisms for people to raise concerns in whichever way they are most comfortable. Reports of wrongdoing are best managed as soon as possible after they are reported. This means ensuring that people who report concerns are aware of their rights and obligations and includes the availability of, and processes for contacting, external authorities.

Expectations

People who disclose suspicions of wrongdoing should act in good faith and use their best judgement. They should alert organisations if they feel they have been retaliated against.

Reports assessed as being a protected disclosure

For concerns raised about serious wrongdoing, organisations are obliged to process disclosures in accordance with the Protected Disclosures (Protection of Whistleblowers) Act 2022 including treating disclosures confidentially. Where it becomes necessary to disclose a person’s identity in situations as defined in the Act, the person must be consulted (where practicable in some cases) and organisations should provide appropriate support to the person.

Processes, channels and entry points

There should be multiple channels through which people can raise concerns of wrongdoing – this includes from the most informal, through to ensuring that staff can contact the chief executive directly. [1]

  • Informal: Do teams have regular meetings to discuss their concerns? Are there opportunities at staff days or forums for people to speak without their managers?
  • Through the line: Do your managers make time for staff to raise concerns? Do you have a designated person in your organisation as an alternative to a line manager?
  • Directly to the Chief Executive: Do you have a dedicated place or channel for staff to raise concerns directly with the chief executive in a confidential and secure way?
  • Protected disclosure: Do you have a designated person and processes where staff can lodge a protected disclosure? Can staff find information on appropriate authorities they can contact and how?
  • External escalation: Do you have clear information available to staff about external avenues to raise or escalate their concerns?

Model standards

  • There is appropriate separation of duties and well defined roles that underpin organisations’ processes.
  • There is a statement of commitment and processes to protect the confidentiality of people who raise concerns.
  • Where it may not be possible to retain confidentiality, organisations communicate with the person who raised the concern and provide appropriate support.
  • There are clear and documented responsibilities and actions for management and senior staff receiving and dealing proportionately with disclosures or allegations of wrongdoing.
  • There are processes and channels to enable people to raise concerns of wrongdoing without prejudice or risk of reprisal.
  • Any risk to people involved in a complaint or disclosure is assessed from the time the concern is first raised.
  • There is tailored dedicated support available in each case.
  • Organisations treat all wrongdoing concerns seriously, in confidence, with protections as far as is reasonably possible.

Making a report  

It is important that people understand how their concerns will be treated and what to expect once they have raised them, regardless of the channel used.

People reporting a concern should be kept informed regularly, at reasonable intervals agreed between parties, and generally at least once a month. This will include providing updates when no progress has been made. Keeping people informed regularly supports greater trust in the process.

People must be able to make reports anonymously and raise concerns at the level they are comfortable with.

Trust in the process

For policies on reporting wrongdoing to be successful, people must be able to trust in organisational processes. Policies detail the steps to be taken and what will happen on receipt of information.

The Protected Disclosures (Protection of Whistleblowers) Act 2022 sets out guidance for the receiver of a protected disclosure. The Ombudsman has also issued guidance on this.

Guidance for receivers | Ombudsman New Zealand

People making a report may choose to take their concerns to external organisations or regulatory bodies.

Model standards

  • There are clear processes for addressing concerns according to each channel.
  • Organisations communicate clearly and regularly with people to ensure that they understand what will happen once their concerns have been assessed.
  • There are procedures to enable people to make anonymous reports, regardless of the nature or level of report.
  • Policies include assessing any risk of reprisal, repercussion, or adverse impacts to anyone from the first report or disclosure, especially to the person making the report.
  • Appropriate external contacts are available to people as points of escalation and support as appropriate.
  • When a report is made about serious criminal activity, organisations will immediately report the matter to the Police or the Serious Fraud Office.

Assessing and investigating reports

Investigation and resolution 

An investigation may not be required in every situation and concerns raised should be resolved at lowest appropriate level. Once an organisation decides that an investigation is warranted, good communication is essential. Having the right people to look into concerns of wrongdoing is critical to upholding the trust and confidence that people place in the public sector’s systems and organisations.

In the interests of natural justice, organisations should provide time for people affected or implicated in a report to respond to any allegations. Organisations may need to manage communication to multiple parties throughout the process of investigating reports of wrongdoing. Organisations must ensure a fair and impartial process that results in fair and reasonable outcomes. It may not be appropriate to share the outcome or resolution in every case.

Additional guidance on responding to concerns and supporting safe organisational cultures that encourage speaking up can be found in the Positive and safe workplaces model standards.

Model standards: Positive and safe workplaces

Model standards

  • Clear timeframes and terms of reference, if appropriate, are developed and shared as soon as practicable.
  • People who do the investigations are skilled, experienced, and independent from the matter reported.
  • Any person/people implicated in a report of wrongdoing will be provided with information about the investigation and the opportunity to respond to evidence or findings at an appropriate time, in accordance with all relevant legal considerations.
  • The person who raised the issue is regularly updated and communicated with throughout the investigation through a dedicated support person and management are informed as appropriate.
  • Organisations also communicate effectively with others outside the organisation who may need to be informed or provide support.
  • Organisations specify who will make any decisions on investigation findings, how decisions are reached, and ensure that the resolutions and actions are fair and reasonable.

Monitoring and documentation

Organisations’ ability to understand the nature of complaints, reports, and disclosures relies on their ability to track and monitor any risks or trends and to learn from them. This requires a centralised approach to manage and oversee concerns raised and responses to them, particularly where different aspects are being dealt with by different people. Centralised tracking and monitoring requires that managers, supervisors or other designated people to whom disclosures are made are able to log and provide auditable details.

Model standards

  • All reports of potential wrongdoing are centrally recorded and organisations have designated persons who are responsible for all tracking, monitoring, and reporting all cases of potential wrongdoing to senior leadership.
  • Reports and disclosures are included in agency risk management programmes and reporting, including any internal or external risk and assurance committees.
  • There are training programmes and systems in place to enable centralised tracking, monitoring, auditing practices and continuous improvement.

Keeping people safe

Types of support

Supporting and protecting people if they are concerned about possible wrongdoing is a vital part of the system. People must be able to raise any concerns, no matter how big or small, without fear of punishment or reprisal. They must be able to access dedicated and tailored support in addition to Employee Assistance Programmes (EAP), local welfare or support services, unions and service organisations. Union delegates may become aware of union members reporting wrongdoing concerns and provide appropriate support.

For complaints of serious misconduct, such as sexual harassment, funded independent legal advice may be provided to complainants in limited circumstances. This could include where there is a significant imbalance, between complainant and respondent, in seniority, resources, influence or power; or when the complaint is particularly complex or serious in nature.

Model standards

  • There is a range of standard and tailored support available to people and mechanisms in place for communicating what support is available, and how it can be accessed at any time (including funded legal support where appropriate).
  • Training as a support person is provided to union delegates where possible. Clear timeframes and terms of reference, if appropriate, are developed and shared as soon as practicable.

Plan for support

In order to provide the right support early, the risk of detrimental impact should be assessed from the time a concern is first raised. People who report concerns of wrongdoing are informed of their rights and obligations from the start of a concern being raised and are communicated with constantly throughout the process. This should include providing them with Your Complaint, Your Rights which supplements these model standards and sets out what a complainant can expect when making a complaint of bullying, harassment, or discrimination to their workplace.

Model standards

  • There are active risk assessment strategies in place, enabled by a designated support person who is able to respond and take action where risks are identified.
  • Designated support is provided from time a concern is first raised, is managed and monitored constantly, and is available for as long as required.
  • There is a designated person to communicate with the person who raised the concern. This includes a debriefing following a resolution being reached to ensure that they understand what the outcomes are and why.

Remediation – individuals and agencies

Protecting people from reprisal and repercussion is vital to ensuring trust in the system. If a person does experience repercussions then organisations need to be able to respond appropriately.

Model standards

  • Organisations take immediate action to keep the person safe and work with them to provide any remediation that may be appropriate, including transfer to a new role, or other physical protection.
  • The experience of the person who raised the concern is monitored throughout and after the process.
  • There are processes that support making acknowledgements, sharing lessons learned, and making apologies when appropriate.
  • Where a person has been disadvantaged in any way, there are procedures in place to appropriately remedy and apologise.

Cross-agency work

It is important that the public sector can work in a modern, flexible and adaptive way, including through the flexible transfer of skills and people between agencies (for example, through secondments or informal arrangements to support short-term projects).

When a person participates in cross-agency work, their employer needs to ensure that the ordinary channels for raising a concern about wrongdoing remain open to that person. Supporting and protecting a person who has raised a concern remains the responsibility of the home agency.

Agency procedures for managing wrongdoing concerns need to recognise that a concern may be raised about someone who is not employed by the agency. In that situation, multiple agencies may have obligations to the people involved.

As far as is reasonably practicable, the affected agencies should consult, co-operate with, and co-ordinate their activities in responding to the concern. Confidentiality constraints need to be discussed at the outset with the person raising the concern. This will affect the options for resolution that are available. If more than one agency does become involved, then the agencies need to reach an agreement as to who will be responsible for what. Good communication and documentation are essential throughout.

It is important that the people who do the investigation are independent from the matter reported. In some instances, it may be appropriate to engage an investigator who is independent of the agencies involved.


[1] Organisational policies also need to identify how people can raise wrongdoing concerns that relate to the chief executive. The appropriate channel for raising such a concern will differ depending on the nature of the agency. Raising the concern with a statutory deputy, a board chair, a monitoring agency or the Public Service Commissioner are all possible options. Where the concern relates to serious wrongdoing, the discloser can approach an appropriate authority under the Protected Disclosures (Protection of Whistleblowers) Act.