Beyond Compliance: Why NZ Organisations Need Independent Whistleblowing Channels

New Zealand has a reporting problem. Not a fraud problem or a harassment problem or a misconduct problem—those exist everywhere. The problem is that when people see wrongdoing, they either can’t report it safely via independent whistleblowing channels or aren’t heard when they do. Three major cases in recent months prove it.

The Fire Service: Ten Years to Be Heard

Sarah Hullah spent ten years fighting to have her sexual harassment complaint taken seriously. A full decade. In May 2025, Fire and Emergency New Zealand finally apologised unreservedly for failing to properly investigate her complaints over that entire period.

Her case emerged just as the Public Service Commission released sobering new statistics: 12 percent of public servants experienced harassment or bullying in the last year alone. Of those who experienced misconduct, 37 percent decided not to report it at all.

More than one in three people who experienced workplace harm stayed silent.

Hullah’s response to her experience was clear: New Zealand needs an independent body for whistleblowers in both the public and private sectors. Because she learned the hard way that internal processes alone don’t work when there’s nowhere safe to turn.

Watercare: Seventeen Months of Systematic Fraud

While harassment complaints were being ignored in one part of the public sector, fraud was thriving in another.

Auckland engineer Shyamal Shah didn’t steal money impulsively. Over seventeen months, he systematically created forty fake invoices under the name “Gardener Construction” or “Ben Gardener,” each one directing payments to his own bank account. The total damage: $1,039,146.

Watercare’s general manager of risk, quality and assurance described the fraud as “sophisticated with complex backstories,” including fake email chains designed to make everything look legitimate. Shah’s work colleagues described being “hurt, betrayed and humiliated” when they discovered the truth, with many worried their own jobs might be at risk during the investigation.

Forty fake invoices. Seventeen months. And the fraud only came to light during Shah’s planned last week at Watercare before moving to Australia.

Forty invoices means forty opportunities for someone to notice something wasn’t quite right. Forty chances for a colleague to raise a concern. But without a safe, anonymous way to report suspicions, those opportunities were lost.

The Private Sector: Years of Unchecked Theft

The public sector doesn’t have a monopoly on reporting failures. Private sector organisations face identical vulnerabilities.

An accountant was recently jailed for stealing more than $400,000 from his employer over multiple years. Another accountant defrauded clients of over $1 million across six years. A third stole $4 million from a family trust.

The pattern repeats: trusted positions, extended timeframes, devastating losses. And in every case, the fraud continued for years before detection.

Why This Keeps Happening

These aren’t isolated incidents. They’re symptoms of systems where people either can’t report safely or aren’t heard when they try.

Every one of these cases had warning signs. Suspicious invoices. Unusual behaviour. Complaints that went nowhere. But those early warnings were either never raised or never acted upon.

Research shows that 43 percent of occupational frauds are detected through tip-offs from employees. Not through audits. Not through management reviews. Through people who see something wrong and speak up.

But here’s the fundamental problem: people only speak up when they trust the system will protect them and take them seriously. Without independent whistleblowing channels, truth-tellers face an uphill battle.

When a volunteer firefighter has to fight for a decade to be heard, that trust is broken. When sophisticated fraud runs for seventeen months undetected, that trust is absent. When accountants can steal for years without anyone noticing or reporting, that trust simply doesn’t exist.

The Failure of Traditional Systems

Internal reporting processes often fail because they’re not truly independent. Employees worry about:

• Retaliation from managers or colleagues
• Being identified even when anonymity is promised
• Their concerns being dismissed or ignored
• The investigation being mishandled
• Their career being damaged

These fears aren’t unfounded. Sarah Hullah’s decade-long struggle proves that speaking up through internal channels can mean years of fighting to be taken seriously. The 37 percent of public servants who chose not to report harassment made a calculated decision: the risk wasn’t worth it.

And in fraud cases, by the time traditional audits detect the problem, millions of dollars are already gone and workplace trust is shattered.

Across the Tasman: The Same Problem, Higher Stakes

The reporting problem isn’t unique to New Zealand. Across the Tasman, Australian organisations are learning expensive lessons about what happens when reporting systems fail—and regulators are responding with significant enforcement action.

The $7.5 Million Warning

In August 2025, TerraCom Limited became the first Australian company successfully prosecuted under the Corporations Act whistleblower protections, paying $7.5 million in penalties plus $1 million in costs.

The case involved allegations of coal quality manipulation. When the whistleblower spoke up, TerraCom issued public statements and an open letter to shareholders portraying him as making “unfounded accusations for personal gain.” The company claimed an independent investigation had cleared them. In reality, the PwC report at least partially supported the whistleblower’s allegations.

ASIC Deputy Chair Sarah Court was blunt: “Where corporations engage in conduct that harms whistleblowers, even unintentionally, they risk disincentivising others from coming forward.”

This was Australia’s first successful enforcement under the current whistleblower regime. It signals a clear shift: regulators are watching, and the penalties are substantial.

Personal Liability: The New Reality

From November 2025, Australia’s new Aged Care Act takes the stakes even higher. Directors and senior executives will face personal liability for failures in care, with penalties including up to two years imprisonment for whistleblower victimisation.

The Act establishes a “Responsible Person Duty” requiring directors and executives to demonstrate active, documented efforts to identify and mitigate risks. It’s no longer enough to claim ignorance—you must show evidence of due diligence.

Independent Whistleblowing Channels

New Zealand organisations need what Sarah Hullah has been calling for, and what Australian regulators are now enforcing: truly independent whistleblowing channels that sit outside the organisation’s hierarchy.

This means:

• Independent whistleblowing channels where employees can raise concerns without fear of identification
• 24/7 accessibility so people can report when they’re ready, not just during business hours
• Independent case management that treats every report seriously and follows proper investigation protocols
• Regular communication keeping reporters informed throughout the process
• Professional expertise in handling sensitive complaints and complex investigations

The Public Service Commission’s new standards are a step forward, requiring agencies to communicate regularly with complainants and provide legal support in some circumstances. But guidelines alone won’t create the trust needed for people to speak up.

Organisations need systems that demonstrably work—systems that protect reporters, detect issues early, and resolve problems before they escalate.

Beyond the direct financial costs, consider the damage to:

• Workplace culture and employee trust
• Organisational reputation
• Employee wellbeing and mental health
• Staff retention and productivity
• Leadership credibility

Organisations lose approximately five percent of revenue to fraud annually. Harassment and bullying damage employee wellbeing, productivity, and retention. And in both cases, the reputational damage from public scandals can last for years.

But organisations with proper whistleblowing systems and fraud awareness training are 56 percent more likely to receive tips from employees. Those early warnings create the opportunity to address problems before they become headlines.

The Way Forward

New Zealand needs independent whistleblowing channels in both public and private sectors.

Not as a compliance exercise. Not as a box to tick. As a fundamental protection for employees and organisations alike.

Because the next major fraud case or harassment scandal won’t announce itself. It will hide in plain sight, just like these ones did, waiting for someone brave enough to speak up and someone ready to listen.

The regulatory environment is changing. In Australia, ASIC has shown it will prosecute whistleblower breaches, and the penalties are substantial. New Zealand’s Public Service Commission has introduced new standards.

The trend is clear: the cost of inadequate reporting systems is increasing, and it’s landing on executives and directors personally.

The Bottom Line

Three New Zealand cases. One Australian prosecution. Multiple ongoing investigations. The pattern is visible across both sides of the Tasman.

The question isn’t whether your organisation needs independent reporting channels. The question is: how long will you wait to implement them?

Every day without secure reporting is another day where fraud can continue undetected, harassment goes unreported, and small problems become major crises.

Report It Now™ has provided independent whistleblowing channels since 2007. Our EthicsPro® system delivers exactly what these cases prove organisations need: 24/7 confidential reporting, truly anonymous channels, professional case management, and the independent oversight that builds trust and catches issues early.

The solution exists. The evidence is overwhelming. The regulatory pressure is mounting.

Ready to protect your organisation before it becomes the next case study? Contact us today.