Governance: NHS board and staff responsibilities

The Standards establish defined roles for NHS board members and staff:


Board members have a critical role in setting a tone and culture in their organisation that values the contributions of all staff, including those who identify the need for changes through speaking up.  This leadership role should not be underestimated, and is a critical function of the board when it comes to concerns raised about safe and effective service delivery.

Board members need to show interest and enthusiasm for issues that arise through concerns raised by staff, and in particular, to support the learning and improvements that stem from them.  They also need to ensure that the arrangements in place act to promote trust between staff and the board in raising concerns.

Every NHS board must ensure that there is a clear description of the roles and responsibilities of staff in relation to raising and receiving concerns at each level of the organisation.


The number of concerns raised by staff will be reported to a public meeting of the board on a quarterly basis.  It is the board’s responsibility to ensure this reporting is on time and accurate.  The analysis should highlight issues that may cut across services and those that can inform wider decision-making.  Board members should show interest in what this information is saying about issues in service delivery as well as organisational culture.  This may mean on occasions that board members challenge the information being presented or seek additional supporting evidence of outcomes and improvements.  They should also explore the reasons behind lower than expected numbers of concerns being raised, based on trend analysis and benchmarking data.

Services provided by other organisations

All NHS boards are responsible for ensuring that the services that are contracted out by their organisation (including primary care and on site contracted services) have arrangements in place that encourage staff to raise concerns, including procedures that meet the requirements of the Standards. 

The board also has responsibility for ensuring there are arrangements in place that ensure students and volunteers are made aware of their right to access this procedure.  In addition, systems must be in place to allow for communication and the raising of concerns via the universities and colleges which they work with to deliver student placements and training opportunities.

NHS boards that work in partnership with local authorities, to provide health and social care with the oversight of an integration joint board (IJB), will also be expected to work with the IJB to ensure that all staff in the partnership can raise concerns about NHS services through this procedure.

More detailed information is available about requirements on board members in relation to monitoring contracted services, primary care providers contracted services, health and social care partnerships (HSCPs), institutions involved in providing NHS apprenticeships and internships to students and trainees and voluntary sector providers under Sector information.

Support for the whistleblowing champion

As non-executive directors, whistleblowing champions are part of the board.  The board must show support for the whistleblowing champion, and must listen to and take action as a result of the issues they raise. 

Support for the person raising concerns

The board members’ leadership in relation to raising concerns extends to ensuring that there are support systems in place for members of their staff who raise concerns.  The support available may include:

  • access to a ‘confidential contact’ who is able to provide information and advice in relation to the procedure for raising concerns, as well as support during the process
  • counselling or psychological support services for those suffering from stress due to their involvement in this procedure
  • occupational health provision which would take account of the stresses involved in raising a concern
  • consideration of a range of actions to reduce the impact on the individual, in consultation with them, such as variations in their work or putting in place temporary arrangements to reduce risk.

It is not appropriate to redeploy staff who have raised a concern, even if their concern involves issues relating to other staff or line management.  Alternative options should always be considered.

Each NHS board has a whistleblowing champion who monitors and supports the effective delivery of the organisation’s whistleblowing policy.  This role has been developed by the Scottish Government and complements the work of the Independent National Whistleblowing Officer (INWO). 

The whistleblowing champion is predominantly an assurance role which helps NHS boards comply with their responsibilities in relation to whistleblowing.  The whistleblowing champion provides critical oversight ensures managers are responding to whistleblowing concerns appropriately, in accordance with these Standards.  The whistleblowing champion is also expected to raise any issues of concern with the board as appropriate, either in relation to the implementation of the Standards, patterns in reporting of concerns or in relation to specific cases.

Beyond the services delivered directly by the NHS board, the whistleblowing champion will have responsibility for ensuring that the organisation has appropriate systems in place to ensure that services delivered indirectly, including primary care services, contracted services and those delivered by HSCPs, are meeting the requirements of the Standards.  In particular, they may need to work with colleagues in IJBs to clarify expectations and requirements in relation to raising concerns.

The role of the whistleblowing champion is explained in more detail through guidance provided by the Scottish Government.

Chief executive

Overall responsibility and accountability for the management of whistleblowing concerns lies with the organisation’s chief executive, executive directors and appropriate senior management.

The chief executive provides leadership and direction in ways that guide and enable staff to perform effectively across all services.  This includes ensuring that there is an effective whistleblowing procedure, with a robust investigation process which demonstrates how the organisation learns from the concerns they receive.  The chief executive may take a personal interest in all or some of the concerns, or may delegate responsibility for the whistleblowing procedure to senior staff.  Delegation must be clearly stated and accepted.  Regular management reports assure the chief executive of the quality of performance.

The chief executive must work with board members to decide how oversight of the implementation of these Standards will be achieved, and who will have responsibility for this. 

Executive directors

On the chief executive's behalf, executive directors may be responsible for:

  • managing whistleblowing concerns and the way the organisation learns from them
  • overseeing the implementation of actions required as a result of a concern being raised
  • investigating concerns, and/or
  • deputising for the chief executive on occasion.

In particular, directors have responsibility and accountability for signing off stage 2 decision letters. They may also be responsible for preparing decision letters, though this may be delegated to other senior staff.  Either way, they must be satisfied that the investigation is complete and their response addresses all aspects of the concern raised.  This will reassure the person raising the issue that their concern has been taken seriously.

Wherever possible, it is important for the decision on a concern to be taken by an independent senior member of staff (i.e. a senior member of staff from another directorate, with no overlap with the concern that has been raised).  Directors should retain ownership and accountability for the management and reporting of concerns. 

If the director delegates responsibility for the process, then they must ensure that the person given this responsibility has the skills and resources to document the process, be able to evaluate the quality of the investigation, and ensure that recommendations are implemented.

The director responsible for primary care services has specific responsibilities for concerns raised within and about primary care service provision.  They must ensure that all primary care services contracted by the NHS board are reporting appropriately on concerns raised and resolved by the provider.  In addition, the director may be contacted in relation to concerns about primary care.  These concerns may come to the NHS board in a range of ways:

  • From staff within primary care services, who are reluctant to raise concerns to their employer
  • From staff who have already raised concerns with their employer, but have not had a satisfactory response (stage 2 concerns), or
  • From representatives of students in primary care settings (or the students themselves), who have raised concerns in relation to their placement in a primary care service.

There is more detailed information available about requirements for NHS boards in relation to primary care services as well as requirements for primary care providers and higher education institutions.

HR or workforce director and their team

HR or workforce directors are responsible for ensuring all staff have access to this procedure, as well as the support they need if they raise a concern.  They are also responsible for ensuring that anything raised within HR procedures which could amount to a whistleblowing concern is appropriately signposted to this procedure for full consideration.

HR teams will also be involved in assisting managers and confidential contacts to identify HR issues that are raised within concerns, and to provide appropriate signposting in relation to these HR issues.

The HR/ workforce director is responsible for ensuring that all staff are made aware of the Standards and how to access them, including the channels available to them for raising concerns.  They must also ensure that managers have the training they need to identify concerns that might be appropriate for the Standards, and have the skills to handle stage 1 concerns.

However, the HR/ workforce director does not necessarily have any specific responsibilities in relation to implementing these procedures or investigating any concerns raised by staff, unless this is considered appropriate in a specific case.  For example, they would be responsible for providing expert HR input when there is interaction between HR procedures and an investigation into a concern. 

HR functions should not be involved in investigating whistleblowing concerns, unless the concern directly relates to staff conduct issues.


Investigations must be carried out by an appropriately skilled, senior member of staff from another directorate (where possible), and in particular, with no conflict of interest or perceived conflict of interest with the issue of concern.  The investigator needs to take full account of the sensitivities of the case, and have strong inter-personal skills, including skills in supportive conversations.  They need to be able to separate out the HR from the whistleblowing concerns, and to focus on the issues which are appropriate for this procedure.

Investigators have an important role in drafting recommendations.  They should listen to those who have raised the concern or are involved in the service, to judge what is appropriate and reasonable, and how the service improvements can be taken forward. 

The ‘confidential contact’ or whistleblowing ambassador

All organisations that deliver services for NHS Scotland must ensure that they provide staff with at least one point of contact who is independent of normal management structures (for the purposes of this role) and who has the capacity and capability to be an initial point of contact for staff from across the organisation (or their part of the organisation) who want to raise concerns.  Small organisations such as those in primary care should work with their NHS board to ensure access to a confidential contact for their staff.  The confidential contact must support staff by providing a safe space to discuss the concern, and assist the staff member in raising their concern with an appropriate manager.  This will not always be the person’s line manager, and in some instances it should be someone with a level of independence from the situation.

However, this role goes beyond simply providing advice and support to those raising concerns.  In particular, the confidential contact needs to:

  • work with the whistleblowing champion to ensure that all staff are aware of the arrangements for raising concerns within their organisation
  • promote a culture of trust, which values the raising of concerns as a route to learning and improvement
  • through direct contact with frontline staff, ensure they are aware of and have access to the support services available to them when they raise concerns
  • assist managers in using concerns as opportunities for learning and improvement
  • work with the chief executive and those they have identified to oversee application of the Standards, to ensure the Standards are functioning at all levels of the organisation.

Confidential contacts must have the appropriate skills to carry out a role that requires significant interpersonal skills and the capacity to work with all staff, from senior managers to support staff.  This role is best suited to someone with experience of direct service provision rather than an HR representative.

NHS boards may choose to broaden the reach of their confidential contacts, by recruiting whistleblowing mentors, or similar roles.  These staff members would work with the confidential contact to broaden access to raising concerns, and assist with raising awareness across the organisation.  It is up to each NHS board to develop such roles that meet the needs of their own structure and organisational requirements. 

INWO liaison officer

The NHS board’s INWO liaison officer is the main point of contact between the INWO and the organisation, particularly in relation to any concerns that are raised with the INWO.  They have overall responsibility for providing the INWO with whistleblowing concern information in an orderly, structured way within requested timescales.  They may also provide comments on factual accuracy on behalf of the organisation in response to INWO investigation reports.  They are also expected to confirm and provide evidence that INWO recommendations have been implemented.

Fraud liaison officer

If a concern includes issues of fraud, the board’s fraud liaison officer should be contacted for advice.  If appropriate, they will be able to pass information onto NHS Counter Fraud Services, for consideration and potential investigation.  They will also be able to provide updates on the status of any investigation – whether it is ongoing, closed, or has been passed to the procurator fiscal.  The fraud liaison officer will be responsible for sharing any updates with the appropriate case contact.

Fraud liaison officers must also be aware of these Standards, and if someone raises a concern about fraud directly with them, they must enquire whether they want to use the Standards.  If so, they must make sure that appropriate steps are taken so that the concern is progressed appropriately.  This may be by the fraud liaison officer, or by an appropriate manager, or the confidential contact.


Any manager in the organisation may receive a whistleblowing concern.  Therefore all managers must be aware of the whistleblowing procedure  and how to handle and record concerns that are raised with them.  Managers must be trained and empowered to make decisions on concerns at stage 1 of this procedure.  While all managers are encouraged to try to resolve concerns early and as close to the point of service delivery as possible, they should also be aware of who to refer a concern to if they are not able to personally handle it.  They should also be aware of any barriers their staff may encounter in raising concerns, and work to reduce these barriers.

All staff

Anyone who delivers an NHS service should feel able and empowered to raise concerns about harm or wrong-doing.  They should be trained so they are aware of the channels available to them for raising concerns, and what access to the Standards means.

Union representatives

Union representatives can provide helpful insights into the functioning of systems for raising concerns.  They should be involved in implementation and monitoring of these systems where possible.

NHS boards need to ensure that their staff have the knowledge and skills to implement the Standards.  In particular, those with specific responsibilities detailed in the Standards must have appropriate training to ensure they can fulfil their roles and are fully informed of the requirements of their role.  This includes:

  • whistleblowing champions
  • confidential contacts/ whistleblowing ambassadors, and any other representatives for raising concerns
  • executive directors involved in signing off investigations, and
  • investigators.

All staff will need to be informed of how to raise concerns, the channels they can use, the support available if they do raise concerns, and the benefits for the organisation in them doing so.  Those who may receive concerns will also need training in supportive conversations/ interview skills. 

'Senior staff’ are those whose position in the organisation means that there are limited or no staff members with clear seniority over them.  Whistleblowing concerns raised about senior staff can be difficult to handle, as there may be a conflict of interest for the staff managing or investigating the concern.  When concerns are raised against senior staff, it is particularly important that the investigation is conducted by an individual who is not only independent of the situation, but empowered to make decisions on any findings of the investigation. 

The organisation must ensure there are strong governance arrangements in place that set out clear procedures for handling such concerns.  This should include consideration of who oversees the case; how other staff are treated through the process; who should investigate; and what support is in place to assist with the investigative process.  For example, each NHS board must clearly set out how it intends to consider a concern raised about the chief executive or a board member. 

Services provided on behalf of the NHS

NHS boards must ensure that all the services they use to deliver their services, including primary care providers or contractors, have procedures in place which are in line with these Standards.  It is for each NHS board to ensure that external service providers are meeting the requirements of the Standards, and they must have mechanisms in place to provide this assurance.  

These requirements include recording and reporting on all concerns.  This means that service providers must record concerns raised with them (or their confidential contact), monitor these concerns, and report them to the NHS board.  The board is required to ensure that systems are in place to facilitate this reporting, and that they receive quarterly reports about concerns raised and performance against the Standards.  

In addition to quarterly reporting of concerns raised within the board (and in relation to services delivered via an HSCP), there must also be systems in place to gather reports of concerns from primary care and contractors on a quarterly basis.

Higher education providers

Higher education institutions (HEIs) work closely with the NHS in a wide range of settings.  This includes staff (who can be contracted to work for an HEI, but nevertheless carry out work for the NHS) and students.  Anyone working or learning in NHS services must be able to access a procedure for raising concerns which is in line with these Standards.  NHS boards must ensure that staff under contract with an HEI have equal access to any systems and arrangements for raising concerns as those under contract with the NHS. 

NHS boards must ensure that systems are in place to enable this access, particularly for students.  This means that arrangements for placements must include information for the student and their course representative on how to raise a concern, including access to the confidential contact. 

NHS boards also need to ensure that concerns raised by staff or students of HEIs about the board’s services and considered through the Standards are included in any reporting of concerns to the board and externally.

Further information on arrangements for students covers these requirements in more detail.


Integration joint boards (IJBs)

Most NHS boards have arrangements with their local authority colleagues to provide health and social care services in an integrated way.  The levels of integration vary between areas and services.  However, NHS boards are expected to work with their local authority colleagues to ensure that arrangements are made by the IJB to enable all those working in NHS services to raise concerns about these services, whether they are employed by the local authority or directly by the NHS. 

The requirement is for each IJB to develop an agreement that would allow for staff working across the partnership to raise concerns (in line with the Standards) across all the services they deliver, to ensure fair access to this procedure.  The only procedural difference would relate to the final stage of the process: concerns relating to social work and care services should be signposted to the Care Inspectorate, whereas those relating to health services should be signposted to the INWO for review.

NHS boards also need to ensure that concerns raised by staff in integrated services are included in any reporting of concerns to the board and externally.

Voluntary sector providers

Voluntary organisations work alongside and within the NHS in a range of settings, from providing transport to direct care and support for patients.  Both staff and volunteers of these organisations may identify issues of concern about the board’s services.  It is for NHS boards to ensure that there is clear information for these organisations on how they can raise concerns, in line with these Standards.  Their staff and volunteers must have access to the NHS board’s confidential contact, or other representative for raising concerns. 

Managers in areas that regularly work alongside voluntary organisations must be aware of the need to facilitate access to this procedure, and any other local arrangements that are in place to ensure access. 

NHS boards also need to ensure that concerns raised by volunteers or volunteer coordinators about the board’s services and considered through the Standards are included in any reporting to the board and externally.

Further information on arrangements for volunteers covers these requirements in more detail.

Regulatory investigations

NHS boards are expected to work with organisations that regulate their services or staff, to ensure that investigations are as effective and efficient as possible, even when a concern has been raised with both the NHS and the regulator. 

If a concern is raised with more than one organisation, it is always important to make sure that it is clear which elements of the concern are being pursued by which organisation, and what outcomes are being sought by the person raising the concern.  In some instances, it may be appropriate to have parallel investigations, as the NHS’s interests may be different from those of the other regulator.

Regulators must be informed if an investigation identifies issues around a professional’s fitness to practise.  However, both regulators and NHS providers must be aware of the potential for staff to raise concerns as an act of retribution.  The Standards should be used for specific consideration of issues relating to risks to safe practice and patient safety, and must be kept separate from disciplinary issues. 

Checklist for NHS boards: What your organisation needs to do now

The Scottish Parliament has now passed the legislation, and the National Whistleblowing Standards are available on the INWO’s website.  These Standards will need to be ready for use in all NHS services in July 2020.  To prepare for implementation your organisation needs to:

  1. Ensure the board are aware of these changes and the requirements on the organisation
  2. Establish who will have responsibility for overseeing the procedure
  3. Recruit confidential contacts and any other ambassadors, as appropriate
  4. Establish protocols for initiating investigations, including who would investigate concerns and how
  5. Engage with staff side representatives so that any internal protocols are in line with their expectations
  6. Engage communications departments in developing information and awareness raising materials
  7. Engage with IT providers to develop systems for recording and reporting of concerns 
  8. Engage with learning and development teams to plan for awareness raising and management training
  9. Engage with primary care and other contract managers to ensure they are aware of the requirements, develop effective reporting arrangements and include these requirements into contractual agreements
  10. Establish internal protocols for specific types of concerns, such as concerns about board and executive team members or fraud investigations




Next: Governance - From recording to learning lessons >>


Updated: January 23, 2024