Aunty Grace Whistleblower Policy

This policy outlines Aunty Grace’s approach to supporting and protecting whistleblowers. A whistleblower is an individual who reports actual or suspected serious wrongdoing, misconduct, improper conduct or breaches of the Aged Care Act 2024, either internally or externally.

Aunty Grace is committed to maintaining a culture of integrity, openness and accountability where people feel safe to speak up and raise concerns without fear of reprisal.

The purpose of this policy is to support a culture of openness, integrity and accountability at Aunty Grace by encouraging the reporting of serious misconduct, wrongdoing, improper conduct or breaches of the law, including under the Aged Care Act 2024 (Cth) and the Corporations Act 2001 (Cth).

This policy outlines Aunty Grace’s commitment to:

• encouraging workers, clients, families, advocates and stakeholders to raise concerns safely;

• providing clear internal and external reporting pathways;

• protecting people who make qualifying disclosures from detriment, victimisation or retaliation;

• managing disclosures fairly, confidentially and in accordance with natural justice; and

• using disclosures, where appropriate, to strengthen governance, risk management, service quality and continuous improvement.

This policy applies to all individuals connected with Aunty Grace in the provision of aged care services, including:

• employees, whether permanent, temporary, full-time, part-time or casual;

• managers and supervisors;

• responsible persons and members of the governing body;

• job applicants;

• contractors, sub-contractors, agency staff and associated providers;

• clients, their families, carers, supporters and advocates; and

• any other person associated with Aunty Grace in a relevant capacity.

This policy applies to disclosures made internally or externally, verbally or in writing, anonymously or openly.

Aunty Grace is committed to:

• supporting the objectives of the Aged Care Act 2024 and the principles of transparency, accountability and integrity;

• encouraging workers, clients, families, advocates and stakeholders to report concerns about serious wrongdoing;

• maintaining a speak-up culture where concerns can be raised without fear of reprisal;

• providing clear, safe and accessible pathways for internal and external disclosure, including anonymous disclosure;

• ensuring individuals who report misconduct are protected from victimisation, retaliation, discrimination and other detrimental conduct;

• investigating disclosures fairly, objectively, confidentially and in accordance with natural justice;

• taking appropriate corrective action where concerns are substantiated;

• ensuring people named in a disclosure are treated fairly and given an appropriate opportunity to respond;

• maintaining confidential and secure records of disclosures, investigations and outcomes; and

• reporting relevant matters to senior management, the governing body and external agencies where required.

Aunty Grace will not tolerate any threats, acts or omissions designed to cause detriment to a whistleblower or any other person involved in a disclosure.

If someone makes a qualifying disclosure, they will:

• be protected from negative consequences arising from making the disclosure;

• have their identity and identifying information protected to the fullest extent possible;

• be protected from civil, criminal or administrative liability where applicable under whistleblower protection laws;

• be protected from disciplinary action, dismissal, demotion, harassment, discrimination or retaliation; and

• be supported during and after the disclosure process.

Aunty Grace may need to disclose a whistleblower’s identity or information that may identify them in limited circumstances, including where:

• the person gives consent;

• the person elects to have disclosure managed as a complaint or feedback;

• disclosure is required or authorised by law;

• disclosure is made to the Aged Care Quality and Safety Commission, a regulator, the Department of Health, Disability and Ageing, the police or another authorised body;

• disclosure is made to a legal practitioner for the purpose of obtaining legal advice; or

• disclosure is necessary to prevent a serious threat to the health, safety or wellbeing of a person or people.

Aunty Grace has a legal obligation to guarantee whistleblowers identity protection, including confidentiality, and protection from detrimental acts or omissions, including dismissal from employment, disadvantage at work or reputational damage. If Aunty Grace breaches these protections, it will be liable under the Aged Care Act 2024 and the whistleblower will be entitled to seek compensation and other remedies such as protections from civil, criminal and administrative liability.

Whistleblower protections apply even if a disclosure is ultimately found to be incorrect, provided the disclosure was made on reasonable grounds.

A person does not need to prove that the misconduct occurred in order to receive protection. They must have reasonable grounds to suspect the information concerns reportable conduct.

This policy is not intended to address general workplace grievances that relate only to a person’s individual employment or work arrangements, such as interpersonal conflict, rostering concerns, performance management or ordinary employment matters.

These matters should usually be managed under Aunty Grace’s Grievance Handling Policy or relevant human resources process.

However, a personal work-related grievance may still qualify for protection if it involves reportable conduct, a breach of law, victimisation for raising a concern, or a matter that has significant implications for Aunty Grace, clients, workers or the public.

This process, supported by the Aunty Grace Whistleblower Policy, sets out the operational steps for receiving, assessing, managing, investigating, reporting and reviewing whistleblower disclosures.

How to make a disclosure

Disclosures can be made anonymously and may still be eligible for protection.

Reports can be made verbally or in writing, internally or externally. A person can make a disclosure about someone who has not followed aged care law, or more broadly, about an organisation that has not followed aged care law, including Aunty Grace.

Internal reporting options

A disclosure may be made to:

• a trusted member of the Senior Leadership Team;

• the Head of People and Culture;

• a manager or supervisor;

• a responsible person of Aunty Grace;

• a member of the governing body;

• a person authorised by Aunty Grace to receive whistleblower disclosures; or

• another appropriate internal recipient.

Individuals are also able to report a disclosure to an independent hotline, to provide an additional confidential and anonymous reporting channel. Contact details are below:

Grant Thornton

Aunty Grace has engaged Grant Thornton Australia (Grant Thornton) to provide this independent service. Reports can be made to Grant Thornton by email, telephone or the postal service:

 1. Email: auntygracedisclosures@myvault.net.au

2. Toll free telephone number: 1300 550 281

3. Postal address:

Aunty Grace

C/- Risk Consulting- Whistleblower service

GPO Box 4736

Melbourne VIC 3001

People are encouraged to provide as much information as they can, e.g. the nature of the conduct, who was involved, when, where and how, whether it is continuing, other people who have witnessed or have knowledge of the conduct etc. The Grant Thornton recipient, where reports are made via the toll free number, will guide you through the process, and ask additional questions or request additional information, where required.

External reporting options

A person may make a disclosure externally, including to:

• the Aged Care Quality and Safety Commission;

• the Department of Health, Disability and Ageing;

• the System Governor or an official of the Department;

• an Appointed Commissioner or member of staff of the Commission;

• another registered provider of funded aged care services;

• a responsible person of a registered provider;

• an aged care worker of a registered provider;

• a police officer;

• an independent aged care advocate;

• a legal practitioner for the purpose of obtaining legal advice; or

• another regulator or body authorised to receive whistleblower disclosures

In limited circumstances, a whistleblower may be able to make an emergency or public interest disclosure to a journalist or a member of Parliament, as permitted under applicable whistleblower laws. Because strict legal requirements apply, Aunty Grace encourages individuals to seek independent legal advice before making this type of disclosure.

Aunty Grace will manage disclosures in a fair, objective, confidential and timely manner.

Where a disclosure is received, Aunty Grace will:

• acknowledge the disclosure where it is possible and appropriate to do so;

• assess whether the disclosure may qualify for whistleblower protection;

• assess any immediate risks to the whistleblower, clients, workers or others;

• take steps to protect the identity of the whistleblower and the confidentiality of the matter;

• appoint an appropriate and impartial person to assess, manage or investigate the disclosure;

• consider whether external advice, external investigation or regulatory notification is required;

• collect and review relevant information and evidence;

• provide procedural fairness to people named in the disclosure;

• keep the whistleblower informed of progress where appropriate and possible;

• document the findings, evidence, outcome and actions taken; and

• take corrective action where warranted.

Conflict of interest pathway

Before a disclosure is allocated to an authorised disclosure recipient for review, Aunty Grace will assess whether that recipient has any actual, potential or perceived conflict of interest, and will reassign the matter to another recipient, the governing body, or the independent Grant Thornton service, so that no one reviews or manages a disclosure in which they are implicated or interested.

Where a disclosure is made anonymously, Aunty Grace will investigate the matter as far as reasonably possible. Anonymous disclosures may limit Aunty Grace’s ability to seek further information or provide feedback to the whistleblower.

Where a whistleblower disclosure also meets the criteria for a reportable incident under the Serious Incident Response Scheme (SIRS), Aunty Grace will manage the matter under both frameworks concurrently. SIRS reporting obligations will be met within the applicable timeframes, and the whistleblower's identity and confidentiality will be protected throughout

Aunty Grace will take reasonable steps to support whistleblowers and any other person affected by a disclosure.

Support may include:

• access to counselling or employee assistance supports where available;

• adjustments to work arrangements where necessary and agreed;

• temporary or permanent relocation or reassignment of duties where appropriate and where this does not amount to victimisation;

• protection from victimisation, reprisal or detrimental conduct;

• advice about internal and external reporting options;

• referral to independent advocacy, legal or other support services where appropriate; and

• regular communication during and after the investigation, where appropriate and permissible.

Aunty Grace will not penalise individuals who make a disclosure on reasonable grounds, even if the disclosure is mistaken.

However, knowingly making a false, vexatious or malicious disclosure may result in disciplinary action. Any response will be fair, proportionate and managed in accordance with relevant employment, volunteer, contractor or governance processes.

Aunty Grace will maintain confidential and secure records of whistleblower disclosures and related investigations.

Records may include:

• the disclosure received;

• assessment of whether the disclosure qualifies for protection;

• risk assessments and protective actions;

• investigation plans, evidence and findings;

• communications with the whistleblower and other parties;

• decisions, outcomes and corrective actions; and

• reports to senior management, the governing body or external agencies.

Aunty Grace will:

• store paper and electronic records securely;

• limit access to people directly involved in managing, investigating or overseeing the disclosure;

• protect the anonymity and confidentiality of people involved as far as reasonably possible;

• retain records for at least 7 years, or longer where required by law or organisational requirements; and

• use de-identified information, where appropriate, to inform risk management, governance reporting and continuous improvement.

Aunty Grace will ensure workers and relevant stakeholders are aware of the Whistleblower policy and process and understand how to raise concerns.

Aunty Grace will:

• make the Whistleblower policy available to workers via provision of the policy on commencement of employment and at a regular intervals thereafter through publication of the policy on its website and in newsletters;

• make the Whistleblower policy available to clients, families, supporters, advocates and other stakeholders on request and in a format they can understand via the publication of the policy on its website, in newsletters and handbooks;

• communicate regularly that whistleblower disclosures are welcomed and will be managed without reprisal;

• provide education and training to workers on the Whistleblower policy and process;

• support managers and relevant workers to recognise disclosures that may qualify for protection;

• provide guidance on when and how to escalate disclosures;

• include training for new workers and responsible persons as part of induction; and

• provide refresher training at least annually, or earlier where roles, responsibilities, systems or legislative requirements change.

Training should cover:

• the definition of a whistleblower disclosure;

• how to report misconduct or wrongdoing;

• the difference between whistleblower disclosures and personal work-related grievances;

• how to recognise and respond to disclosures that may qualify for protection;

• confidentiality and privacy obligations;

• protection from detriment and victimisation;

• escalation pathways;

• record-keeping requirements; and

• support for individuals with specific needs or diverse backgrounds to make disclosures.

Aunty Grace will ensure whistleblower arrangements are subject to appropriate governance oversight.

Known or suspected misconduct, wrongdoing or protected disclosures must be reported to senior management and, where appropriate, to the governing body for oversight and monitoring. The governing body will receive a de-identified report on whistleblower disclosures, themes and system performance at least annually (provided by the third party whistlblower service) or more frequently where the nature or urgency of a matter warrants it.

Reporting to the governing body should be managed in a way that protects confidentiality and may include de-identified information about:

• the number and type of disclosures received;

• whether disclosures were substantiated;

• key themes, risks or systemic issues identified;

• actions taken to address identified issues;

• any external notifications made;

• any detriment, victimisation or retaliation concerns; and

• any improvements required to policies, systems, training or practice.

Aunty Grace will review the Whistleblower policy and system at least every two years, and earlier if required by changes to legislation, regulation, guidance, organisational structure or operational practice.

Governing Body

The governing body has ultimate oversight of Aunty Grace’s whistleblower protection arrangements as part of its broader governance, risk, compliance and provider obligation responsibilities.

The governing body is responsible for ensuring:

• Aunty Grace maintains appropriate systems and processes for managing whistleblower disclosures;

• matters contained in the Whistleblower policy are endorsed and clearly communicated;

• disclosures and related risks are monitored at an appropriate governance level;

• whistleblower arrangements support a culture of openness, safety, accountability and continuous improvement; and

• workers, clients, families, supporters, advocates and visitors are encouraged and supported to raise concerns safely.

Management

Management is responsible for:

• ensuring workers and relevant stakeholders are aware of the Whistleblower Policy and process;

• fostering a culture where disclosures are encouraged, reported and managed appropriately;

• ensuring workers understand how to report concerns;

• recognising and escalating disclosures that may qualify for protection;

• ensuring disclosures are managed fairly, confidentially and in a timely way;

• arranging appropriate support for whistleblowers and others involved;

• monitoring compliance with this policy and related processes;

• reviewing records, training completion and reporting trends;

• identifying opportunities for improvement; and

• reporting relevant matters to senior management, the governing body and external agencies where required.

People and Culture / Authorised Disclosure Recipient

People and Culture, or any authorised disclosure recipient, is responsible for:

• receiving and documenting disclosures;

• monitoring anonymous reporting channels, including the digital suggestion box;

• assessing disclosures and escalating them appropriately;

• supporting confidentiality and record-keeping requirements;

• coordinating support for whistleblowers and others involved;

• supporting training and awareness activities; and

• seeking internal or external advice where required.

All workers and associated providers

All workers, including associated providers, volunteers and students (if applicable) are required to:

• comply with the Whistleblower policy and follow the Whistleblower process;

• act within their delegated level of authority;

• raise concerns where they become aware of serious wrongdoing, misconduct or breaches of the law;

• maintain confidentiality where involved in a disclosure or investigation;

• not engage in victimisation, retaliation or detrimental conduct; and

• cooperate with any investigation or review process as required.

Evidence that may demonstrate implementation of the Whistleblower policy includes:

• records of communications to workers and stakeholders about whistleblowing;

• whistleblower disclosure records;

• incident register entries;

• feedback and complaints register entries;

• records of investigations conducted in relation to whistleblower disclosures;

• records of risk assessments and protective actions;

• records of corrective actions and continuous improvement activities;

• worker training records and schedules;

• governing body reports or minutes noting de-identified whistleblower themes or system oversight; and

• annual policy and system review records.

• Aged Care Act 2024 (Cth)

• Corporations Act 2001 (Cth)

• Corporations Regulations 2001

• Privacy Act 1988 (Cth)

• Aged Care Quality Standards

• Outcome 2.2a: Quality, safety and inclusion culture to support aged care workers to deliver quality care

• Outcome 2.3: Accountability, quality system and policies and procedures

• Outcome 2.6a: Complaints and feedback management for aged care workers

• Outcome 2.6b: Complaints and feedback management for individuals

• Aged Care Quality and Safety Commission guidance

• Australian Securities and Investments Commission whistleblower information

• Fair Work Commission whistleblower protections

Last Reviewed: 14 August 2026

Reviewer: Rebecca Phillips (Dept: Quality and Practice)