Assess the risk. Your first step, says Guy Dehn, director of charity Public Concern at Work, is to identify the risks the organisation faces in terms of wrongdoing and to assess the obstacles to people speaking out.
Broadcast the message. Explain to employees that they are encouraged to report malpractice and will not be penalised for doing so. Use a formal written whistleblowing policy to make clear what behaviours or practices are unacceptable - you may need to formulate standards and ethical policies.
Tell them who to tell. Create a three-tier hierarchy of disclosure. Whistleblowers should approach their own manager first; if no action is taken, they should inform a more senior manager. The third tier should be a board director or audit committee member who is concerned directly with the accountability of the organisation. An independent body, such as the HSE or the FSA, should be proposed as a last resort.
It's not about grievances. If an employee's concern involves self-interest, handle it through a separate complaints procedure.
Protect the whistleblower. Most whistleblowers don't remain anonymous, but they may well expect their evidence to be treated in confidence. More to the point, the fundamental principle of the Public Interest Disclosure Act is that the whistleblower mustn't be victimised for coming forward.
Says Chris Clode, national co-ordinator of support group Freedom to Care: 'It's not just about them being sacked - there are plenty of other kinds of treatment that can end up leading to an employment tribunal. Some colleagues may resent their action, in which case you may have to consider moving the whistleblower to a different role.'
Take it seriously. It's vital that you show a whistleblower that you take their claims seriously and are taking proper action. If they think you've done nothing, they might feel entitled to take it to a higher level or outside the organisation. Says Clode. 'If you do nothing, other whistleblowers will be discouraged from coming forward.'
Guard against malice. Look out for 'disclosures' cooked up for malicious reasons. Investigate the claims thoroughly and make sure you give the other side a fair hearing.
Don't go public if you don't need to. There's no inconsistency between encouraging your employees to report malpractice and asserting your contractual rights to keep people from passing sensitive information to the media.
Do say: 'If something wrong is happening in this organisation we need to know, so we can put it right.'
Don't say: 'We've got a special form for people wanting to snitch on their colleagues: it's called a P45.'