Raymond Cheung
Chartered Actuary · CRO · Board Adviser · Singapore
Whistleblowing governance in Singapore listed companies is weaker than the policies suggest. SGX has required a whistleblowing policy since 2022, but an NUS study of 536 issuers found most fall short on independence and protection. Here is what a board should actually own.
Some years ago, as a statutory CRO, I was handed a whistleblowing report that had taken eleven months to reach anyone senior. It had been sent to the right inbox. The inbox belonged to a function that reported to the executive whose team the complaint was about. Nobody had done anything improper with it. It simply sat, because the person responsible for routing it had every reason not to. When it finally reached the audit committee, the issue it described had grown from a control gap into a loss. [CONFIRM with Raymond: replace with a real episode if possible]
That experience shaped how I look at whistleblowing. Most Singapore boards I advise have a policy. Far fewer have whistleblowing governance, meaning a channel the board can trust to bring bad news to it quickly, without being filtered by the people the news is about.
What SGX actually requires
Since 1 January 2022, SGX-listed issuers have had to maintain a whistleblowing policy and disclose it in the annual report. The Listing Rules require an independent function to investigate reports, a commitment to protect the whistleblower's identity and to guard against retaliation, and oversight by the audit committee. Under the Code of Corporate Governance, the audit committee reviews the policy and the arrangements through which staff can raise concerns about possible improprieties.
On paper, that is a sound framework. In practice, the evidence says most issuers have done the minimum. The NUS Business School Centre for Investor Protection reviewed the whistleblowing disclosures of 536 SGX primary-listed issuers in its 2025 report, "Will You Listen?". The average score was 20.6 out of 40. Only 54.7% scored 20 or more, and fewer than 10% reached 30. Nearly a quarter, 23.7%, did not disclose having a designated independent function to investigate reports at all (NUS Business School).
Singapore also has no overarching whistleblower protection statute. For a listed company employee, the company's own arrangements are often the main protection they have. That puts more weight on the board, not less.
“A whistleblowing policy tells staff where to report. Whistleblowing governance decides whether the report survives the trip to the board.”
Where whistleblowing governance breaks down
In my experience the failures are rarely about the wording of the policy. They are about plumbing and incentives. Four patterns come up again and again.
- The channel routes through management. If reports land with HR, legal or internal audit staff who report day to day to the CEO or CFO, the channel is only as independent as the least conflicted person in that chain.
- The audit committee sees counts, not cases. A line saying "three reports received, all closed" tells the committee nothing about what was alleged, who investigated, or whether the outcome was credible.
- Nobody tracks what happens to the whistleblower. Retaliation in a Singapore workplace is rarely dramatic. It looks like a missed promotion, a changed reporting line or a quiet exit twelve months later.
- Silence is read as good news. A business with thousands of staff and almost no reports does not have a clean culture. It usually has a channel nobody trusts.
The last point is the one I push hardest. When I see a low report count, my first question is not "good" but "how do we know people would use it?" Low volume in a large organisation is a risk signal, the same way an unusually clean audit can be.
Family-controlled and founder-led companies, which make up a large part of the SGX board, face a sharper version of this problem. When the people most likely to be named in a report are also the controlling shareholders, staff know it. The channel has to be visibly owned by the independent directors, or it will not be used for the cases that matter most.
What the board should actually own
The audit committee is the natural owner under the Code, but ownership has to mean more than approving the policy every two years. If your board risk committee and audit committee split oversight, decide explicitly which one sees misconduct reports in full. These are the arrangements I recommend.
- A direct line to the audit committee chair. At least one reporting route should bypass management entirely, whether an external hotline provider or the chair's own contact details.
- Case-level reporting. The audit committee should see every report above a defined severity, with the allegation, the investigator, the timeline and the outcome, not just totals.
- Independence of the investigator, decided case by case. When a report touches senior management, the committee, not management, should appoint who investigates.
- Retaliation monitoring. For an agreed period after a report, someone independent should check what happens to the reporter's role, rating and pay.
- A trust test. Ask in staff surveys whether people would feel safe raising a concern, and compare the answer to report volumes by business unit.
None of this needs a large budget. It needs the audit committee chair to treat whistleblowing as an early-warning system for the board, not as a compliance artefact. When I review a board's arrangements, the question I ask the chair is direct: if someone in finance saw something wrong tomorrow, how many days before you would know?
Why this matters more now
Singapore's governance agenda is moving towards outcomes rather than disclosures. SGX RegCo has been more willing to query issuers on the substance behind their statements, as it did with remuneration disclosures. Shareholders read governance failures through the lens of what the board knew and when, which is the lesson of every recent Singapore boardroom dispute that became public. A whistleblowing report that sat unread for months is evidence of exactly the wrong answer.
It is also a useful test in your next board effectiveness evaluation. Ask directors when they last heard about a problem from a whistleblower before management raised it. If nobody can remember, that tells you something about the channel.
My recommendation is to run one exercise before the next annual report cycle: trace three real reports from the past two years end to end, from the moment they were made to the moment the audit committee heard about them. The gaps will show you where your whistleblowing governance actually sits. If you would like an independent view of how your arrangements would hold up, get in touch.
Common Questions
Do SGX-listed companies have to have a whistleblowing policy?
Yes. Since 1 January 2022, the SGX Listing Rules have required issuers to establish a whistleblowing policy and disclose it in the annual report. The rules require an independent function to investigate reports, commitments to protect whistleblowers' identity and against retaliation, and oversight by the audit committee.
Who should oversee whistleblowing in a Singapore listed company?
The audit committee, under both the Listing Rules and the Code of Corporate Governance. In practice, good whistleblowing governance means the audit committee sees case-level reports, decides who investigates matters involving senior management, and has at least one reporting channel that bypasses management entirely.
How well do SGX companies comply with whistleblowing requirements?
Not well, based on disclosures. The NUS Centre for Investor Protection's 2025 study of 536 SGX primary-listed issuers found an average score of 20.6 out of 40, with fewer than 10% scoring 30 or above and 23.7% not disclosing a designated independent investigation function.
Is a low number of whistleblowing reports a good sign for a Singapore board?
Not necessarily. In a large organisation, very few reports usually means staff do not trust the channel rather than that nothing is wrong. Boards should compare report volumes with staff survey results on whether people feel safe speaking up, and investigate business units that are unusually quiet.
Related insights
About the author
Raymond Cheung is a Chartered Actuary, C-suite executive and board adviser with more than 20 years of experience across Asia in risk management, insurance, ESG and corporate governance. He is the CEO of CER Consultancy and an accredited trainer at SMU Academy and the Singapore College of Insurance.