External Stakeholder Whistleblower Protection Policy
1. Purpose
Sullivan & Stanley (“S&S”) is committed to the highest standards of openness, integrity, and accountability. This policy enables clients, associates, suppliers, contractors, business partners, and members of the public (“external stakeholders”) to report serious concerns about S&S's conduct, and sets out the protections in place for anyone who does so in good faith.
This policy operates alongside S&S's internal Whistleblowing Policy, which covers employees, workers, and contractors. Together, the two policies ensure that anyone with a genuine concern about wrongdoing connected to S&S - whether inside or outside the organisation - can raise it safely.
This policy, together with the dedicated reporting channel set out in Section 5, is published on Sullivan & Stanley's website, giving clients, associates, suppliers, contractors, business partners, and members of the public a clear and accessible means to report concerns about Sullivan & Stanley's conduct at any time.
2. Scope
This policy applies to external stakeholders who wish to raise a concern about S&S's conduct, including clients, associates, suppliers, contractors, and business partners. It is intended for serious concerns that fall outside the scope of routine complaints, which should be raised under S&S's External Stakeholder Grievance & Complaints Policy instead.
3. What Can Be Reported
This policy covers concerns relating to unlawful conduct or serious wrongdoing connected to S&S's business, including:
Breach of a legal or regulatory obligation
Fraud, bribery, or corruption
Health and safety risks to the public, clients, or workers
Environmental harm
Serious breaches of S&S's Code of Conduct or published policies
Concealment of, or attempts to conceal, any of the above
4. What Is Not Covered by This Policy
This policy is intended for concerns that are in the public interest, such as suspected illegal activity, fraud, safeguarding issues, health and safety risks, or other serious wrongdoing connected to S&S’s business. Routine commercial, contractual, or service-quality complaints — for example, disagreement over pricing, deliverables, or contract terms — should normally be raised under S&S’s External Stakeholder Grievance & Complaints Policy instead, unless they also involve wider wrongdoing affecting others.
5. How to Report a Concern
A concern can be raised through the following channel:
Concerns can be raised by name or anonymously. Reporting anonymously is fully supported under this policy; however, S&S's ability to investigate and provide feedback may be more limited where a reporter's identity and contact details are not known.
Where a concern relates to a Director of S&S, it should be addressed to addressed to the Chairman, rather than through the standard channel above.
6. Protection from Retaliation
S&S will not tolerate retaliation of any kind against an external stakeholder who raises a concern in good faith under this policy, regardless of whether the concern is ultimately upheld. Retaliation includes, but is not limited to, termination or non-renewal of a contract, refusal of future business, exclusion from tender processes, or any other form of detriment connected to the disclosure.
Legal protection under this policy is available to anyone raising a genuine concern in good faith. It does not extend to those making false or malicious allegations, or those seeking personal gain from a disclosure.
7. Consequences of Retaliation
Any S&S employee, worker, or contractor found to have retaliated against an external stakeholder for raising a concern in good faith will be subject to disciplinary action under S&S's internal Disciplinary Policy, up to and including dismissal.
Where the individual responsible for retaliation is not a direct employee of S&S - for example, an associate, supplier, or third party acting on S&S's behalf - this may result in termination of their contract or engagement, and S&S reserves the right to decline future business with them.
This applies regardless of the seniority or position of the individual responsible.
8. Confidentiality and Anonymity
All concerns will be treated confidentially so far as reasonably possible. S&S will make every effort not to reveal a reporter's identity without their consent, save where required by law or where it becomes necessary for a reporter to be identified as part of a formal investigation or legal process.
Access to information about a reported concern will be limited to those directly involved in assessing or investigating it.
9. Record Keeping
S&S will maintain confidential records of all concerns raised by external stakeholders under this policy, any investigations carried out, and any actions taken. Records will be retained in accordance with S&S’s Data Protection Policy and applicable legal requirements.
10. Data Protection
Any personal information collected from an external stakeholder as part of a whistleblowing disclosure will be processed in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and S&S’s Data Protection Policy.
11. What Happens After You Raise a Concern
S&S will acknowledge receipt of a concern where possible and carry out an initial assessment to determine whether it falls within the scope of this policy. Where it does, the matter will be investigated by a suitable person who is independent of the matter being investigated, which may involve internal or independent investigation depending on its nature and seriousness. Where possible, the reporter will be kept informed of progress and the outcome; however, due to confidentiality and data protection obligations, S&S may not be able to share full details of the investigation or any disciplinary action taken. Where a concern is not accepted for investigation, a written rationale will be provided where the reporter's identity and contact details are known.
Where an investigation substantiates a concern involving a third party - such as a supplier, contractor, or client - S&S may terminate the relevant contract or engagement, report the matter to the relevant regulatory authority, and/or decline future business with that party. An investigation may otherwise result in no further action being taken, recommendations for improvements, or referral to an external authority or regulator.
12. Responsibilities
The Directors are responsible for ensuring this policy is implemented, reviewed annually, and made available to external stakeholders. Managers and staff handling concerns raised under this policy are responsible for ensuring they are handled promptly, fairly, and confidentially. External stakeholders using this policy are expected to raise concerns honestly and in good faith.
13. Policy Availability and Review
This policy is published on S&S's website and may also be referenced in client, supplier, and partner contracts and onboarding materials. It will be reviewed annually, or sooner in response to significant legal, regulatory, or organisational change.