One of the most consequential decisions in designing a whistleblowing programme is defining its scope.
If the types of misconduct are too narrow, and the channel excludes concerns that represent genuine organisational risk. Too broad, and it risks becoming a general complaints mechanism that overwhelms the compliance function and dilutes the programme’s credibility. For compliance officers, getting this balance right requires understanding both the legal frameworks that define reportable misconduct and the practical categories of concern that effective programmes should be designed to capture.
What the Law Requires
The starting point for defining scope is legislation. In the UK, the Public Interest Disclosure Act 1998 (PIDA) protects workers who make ‘qualifying disclosures’ about specific categories of wrongdoing: criminal offences, failure to comply with a legal obligation, miscarriages of justice, danger to health and safety, environmental damage, and the deliberate concealment of information relating to any of these. The protection applies regardless of whether the worker uses the organisation’s internal channel or reports to a prescribed person or regulator.
The EU Whistleblowing Directive (2019/1937) takes a broader approach, requiring protection for persons reporting breaches of EU law across a defined list of areas including public procurement, financial services, product safety, transport safety, environmental protection, food and feed safety, public health, consumer protection, data protection and competition law. Critically, many EU member states have extended the scope of their national transpositions beyond these minimum requirements – Denmark, for example, covers ‘serious offences and other serious matters’, while Hungary’s implementing law covers unlawful or suspected unlawful acts or omissions more broadly.
For organisations operating across multiple jurisdictions, the scope of the whistleblowing channel must reflect the widest applicable standard. A channel designed solely around UK PIDA categories may be insufficient if the organisation also has obligations under EU national transpositions with broader scope.
Core Categories of Misconduct
Beyond the legal minimum, effective whistleblowing programmes typically address the following categories of misconduct. These reflect both regulatory requirements and the types of concern that research consistently shows employees want to report.
Financial Misconduct and Fraud
Fraud, bribery, corruption, money laundering, tax evasion and accounting irregularities form the traditional core of whistleblowing programmes. The ACFE’s 2024 Report to the Nations found that 43% of occupational frauds were detected through tips, with employees providing over half (52%) of those tips. Financial misconduct is also the area where the business case for whistleblowing is most easily quantified: the median fraud loss in the study was $145,000, and organisations with anonymous reporting mechanisms experienced losses that were 50% smaller. The Economic Crime and Corporate Transparency Act 2023 (ECCTA) has further strengthened the case for including financial misconduct within scope, as a functioning whistleblowing channel contributes to the ‘reasonable fraud prevention measures’ defence under the failure to prevent fraud offence.
Health and Safety
Reports concerning unsafe working conditions, inadequate risk assessments, failure to maintain equipment, substance abuse affecting workplace safety and breaches of health and safety legislation represent some of the most time-sensitive concerns a whistleblowing channel will receive. These reports can prevent physical harm – making them among the highest-priority matters for triage and investigation. Industries such as construction, manufacturing, logistics and healthcare face particularly acute health and safety reporting needs.
Harassment, Bullying and Discrimination
Workplace civility issues – including sexual harassment, bullying, racial or gender discrimination, and hostile management behaviour – have become an increasingly prominent feature of whistleblowing data. Protect’s 2025 Impact Report recorded bullying, discrimination and harassment as 17% of all cases from the not-for-profit sector, up from 14% the previous year. The FCA’s proposals to incorporate non-financial misconduct into its regulatory framework signal that regulators now view these issues as governance concerns, not simply HR matters.
Including these categories within the whistleblowing channel’s scope is important for two reasons. First, it ensures that employees have a confidential, independent route for raising concerns that they may not feel comfortable reporting to their line manager or HR department – particularly where the alleged perpetrator holds a position of authority. Second, it enables the compliance function to identify systemic patterns of harassment or discrimination that might otherwise remain hidden across separate, disconnected HR case files.
Regulatory and Compliance Breaches
Failures to comply with sector-specific regulations – whether in financial services, healthcare, education, energy or environmental management – should fall within the channel’s scope. These include breaches of licensing conditions, failures to report required information to regulators, non-compliance with data protection obligations and contraventions of industry codes of practice. For regulated firms, a whistleblowing report about a compliance breach may be the earliest indicator that the organisation’s control environment is failing.
Environmental Damage
Both PIDA and the EU Directive specifically include environmental damage within their scope. Reports may concern illegal waste disposal, pollution, breaches of environmental permits or failure to comply with sustainability obligations. As environmental, social and governance (ESG) reporting requirements tighten across the UK and EU, environmental misconduct reported through whistleblowing channels is likely to attract increasing regulatory and stakeholder attention.
Modern Slavery and Supply Chain Misconduct
Safecall’s Whistleblowing Benchmark Report 2024 identified modern slavery as a statistically significant area of concern for the first time, with construction companies highlighted as particular hotspots. As whistleblowing programmes are extended into supply chains – a trend reinforced by legislation such as the Modern Slavery Act 2015 – the types of misconduct that channels must address are expanding beyond the organisation’s direct workforce to encompass its suppliers, contractors and business partners.
Where to Draw the Line
Not every workplace complaint is a whistleblowing matter. Personal grievances, disputes about terms of employment, performance disagreements and interpersonal conflicts generally fall outside the scope of a whistleblowing programme, even though they may be serious concerns that require their own resolution process.
The distinction matters because conflating whistleblowing with general complaints dilutes the programme’s focus, overwhelms the compliance team with matters better handled through HR or grievance procedures, and risks undermining the credibility of the channel in the eyes of both reporters and the board. A clear, published scope – communicated through the whistleblowing policy and reinforced during employee awareness activities – helps ensure that the channel receives the types of report it is designed to handle.
That said, the triage process should be flexible enough to redirect misrouted concerns to the appropriate function rather than simply rejecting them. An employee who reports a personal grievance through the whistleblowing channel has still demonstrated a willingness to raise a concern – and the organisation’s response to that misdirected report will shape whether they use the channel again when they encounter genuine misconduct.
Designing for Breadth Without Losing Focus
The most effective approach is to define scope broadly at the policy level – covering all categories of serious misconduct, regulatory breach and ethical concern – while using the case management system’s categorisation and triage capabilities to ensure that each report is directed to the appropriate handler. This means the channel captures the widest possible range of concerns without requiring the compliance officer to investigate every one personally.
For organisations operating across multiple jurisdictions, the channel should be designed to accommodate the broadest applicable scope from any single jurisdiction, with local categorisation rules applied at the triage stage. This avoids the complexity of operating separate channels with different scope definitions in each country while ensuring compliance with the most demanding national requirements.
Related Resources
- Whistleblowing Technology & Channels Hub – Overview of reporting channels and technology selection.
- How Do Whistleblowing Channels Enable Proactive Compliance Management? – Moving from reactive case handling to risk intelligence.
How Safecall Can Help
Safecall’s whistleblowing service is designed to handle the full spectrum of workplace misconduct. Our multi-channel platform – combining a secure online portal with a 24/7 telephone hotline staffed by former UK police officers with over 25 years’ interview experience each – captures reports across every category, from financial fraud to modern slavery, and delivers them into an integrated case management system with the triage and categorisation capabilities that effective scope management requires. Operating across 150 countries in over 175 languages, with ISO 27001 certification and UK data residency, Safecall supports organisations in meeting the broadest compliance requirements across every jurisdiction in which they operate.
To discuss how Safecall can support your organisation’s whistleblowing programme, contact our team or call +44 (0) 191 516 7720.
Sources and Further Reading
- Public Interest Disclosure Act 1998 – legislation.gov.uk
- EU Directive 2019/1937 on the Protection of Persons Who Report Breaches of Union Law – eur-lex.europa.eu
- Association of Certified Fraud Examiners (ACFE), Occupational Fraud 2024: A Report to the Nations – tip detection rates, fraud losses, reporter demographics – acfe.com
- Economic Crime and Corporate Transparency Act 2023 – legislation.gov.uk
- Protect (UK whistleblowing charity), 2025 Impact Report – misconduct categories and reporting trends – protect-advice.org.uk
- Safecall, Whistleblowing Benchmark Report 2024 – modern slavery as emerging category, sector analysis – safecall.co.uk
- Bird & Bird, The EU Whistleblowing Directive: The Path to Implementation – national transposition variations – twobirds.com