Business and Technology · Regulation and financial crime
Regulation, Compliance and Whistleblowing in Business
Updated 11 October 2026 · Fact-checked
Regulation is the set of rules, from laws, regulators and professional bodies, that a business must follow. Compliance is the act of following them. Whistleblowing is reporting suspected wrongdoing, ideally through an internal route first. To answer exam questions, identify the rule source, the duty, and the correct reporting step.
Understand Regulation, Compliance and Whistleblowing
Every business operates inside rules. Some rules come from legislation, which is law made by a government or parliament. Others come from regulation, which is detailed rules made and enforced by a regulator under that law, or by a professional or industry body. Legislation sets the framework. Regulation fills in the detail and polices it.
Sources of regulation vary by country, so exam questions stay general. Typical sources are: government legislation, regulators (for example financial markets, competition or data protection authorities), stock exchange listing rules, accounting standards, governance codes and professional bodies such as ACCA. Some are legally binding. Others, such as many governance codes, work on a comply-or-explain basis.
Compliance means the organisation meets these requirements. It costs money: staff, systems, training, monitoring and reporting. Failure can lead to fines, loss of licence, legal action and reputational damage. Many organisations set up a compliance function or officer to monitor rules and report to senior management.
Whistleblowing is when an employee or other insider reports suspected illegal, unethical or dangerous conduct in the organisation. Examples include fraud, bribery, safety breaches and misreporting. It matters because wrongdoing is often seen first by staff, but staff fear retaliation.
Good organisations have a whistleblowing policy. It names who to report to, allows confidential or anonymous reporting, promises no retaliation, and sets out how reports are investigated. Many countries give legal protection to whistleblowers, though the scope differs by country. A common pattern is: report internally first, then to a regulator if that fails, and to the public only as a last resort.
Key formulas to remember
- Legislation vs regulation
- Legislation = law set by government; Regulation = detailed rules made and enforced by regulators or bodies
- Regulation often derives its power from legislation but is not always law itself.
- Typical whistleblowing route
- Internal (line manager or designated person) → regulator or external authority → public disclosure as last resort
- A general pattern, not a rule in every country. Protection rules differ by jurisdiction.
- Elements of a good whistleblowing policy
- Clear reporting channel + confidentiality + protection from retaliation + investigation process + feedback
- Use as a checklist when asked to evaluate or design a policy.
- Consequences of non-compliance
- Fines + legal action + licence loss + reputational damage + management time
- Use for questions on why compliance matters.
How to solve Regulation, Compliance and Whistleblowing questions
Use this method for any question on regulation, compliance or whistleblowing.
- 1Read the scenario and identify who is involved: the business, regulator, employee or professional.
- 2Decide whether the rule in question is legislation, regulation, a code or an internal policy.
- 3Check whether it is mandatory or voluntary (for example comply-or-explain).
- 4Identify the duty or risk: what must the business do, and what happens if it does not.
- 5For whistleblowing, ask what is being reported, to whom, and whether the internal route has been tried.
- 6Match to the answer options and remove any that overstate a rule as universal.
- 7Check the wording of the question: 'best', 'first' or 'most likely' changes the answer.
Quickest way: Three-question filter
When to use it: Use for single-answer objective test questions when time is short.
- Who makes the rule? Government means legislation. Regulator or body means regulation.
- Is it binding? Law and regulator rules usually are. Codes may be comply-or-explain.
- For whistleblowing, choose internal first unless the question says the internal route is compromised.
Common mistakes in Regulation, Compliance and Whistleblowing
Treating regulation and legislation as identical.
Both are called 'rules' in everyday speech.
Fix: Remember legislation is law from government; regulation is detailed rules from regulators or bodies.
Assuming all governance codes are legally binding.
Students link 'code' with law.
Fix: Many codes are comply-or-explain. Check whether the question refers to law or a code.
Recommending public disclosure as the first whistleblowing step.
The word 'whistleblowing' suggests going public.
Fix: Choose the internal route first, then regulator, then public as a last resort, unless the scenario rules out internal reporting.
Saying whistleblowing protection is the same in every country.
Students assume one global law.
Fix: Say protection is commonly provided by law but varies by country.
Confusing whistleblowing with breaching confidentiality without cause.
Both involve disclosing information.
Fix: Whistleblowing is a disclosure about suspected wrongdoing made in the public interest, usually through proper channels.
Worked examples
Example 1
An employee finds that a manager is falsifying expense claims. Which action is MOST appropriate first? A) Post the details on social media. B) Report it through the organisation's internal whistleblowing procedure. C) Confront the manager and demand repayment. D) Do nothing because it is not the employee's responsibility.
Show the solution
- Identify the issue: suspected fraud by a manager.
- Apply the normal route: internal first, using the designated channel.
- Check A: public disclosure is a last resort, so reject it.
- Check C: confrontation could alert the manager and risk evidence being destroyed, so reject it.
- Check D: ignoring suspected fraud is unethical and may breach duties, so reject it.
Answer: B
Example 2
Which of the following is an example of regulation rather than legislation? A) An Act passed by parliament. B) Listing rules issued by a stock exchange. C) A constitution of a country. D) A statute on company formation.
Show the solution
- Legislation is law made by government or parliament.
- A, C and D are all produced by the state's law-making process.
- Listing rules are set by a stock exchange, a regulatory body, and apply to companies that choose to be listed.
Answer: B
Exam tips
- Look for the keyword in the question: 'first', 'best' or 'most appropriate' decides between internal and external routes.
- Reject answer options that say a rule applies 'always' or 'in every country'.
- In multiple response questions, select exactly the number stated and check each option for source and bindingness.
- Link scenarios to ethics: ACCA expects you to see whistleblowing as an ethical and governance tool, not only a legal one.
Practice questions from Regulation and financial crime
- An accountant at Marlow Ltd discovers that a director is falsifying expense claims. She reports it to the audit committee chair instead of h…
- A company director decides not to record cash sales of 40,000 made at a market stall, so that profit and tax are lower. What is this?
- An accountancy firm's junior member of staff suspects that a client's large cash receipts are the proceeds of crime. Under typical anti-mone…
- A client proposes a complex series of transactions that has no commercial purpose other than creating a tax saving, and which technically me…
- Which of the following best describes 'phishing' as a form of cybercrime?
Regulation, Compliance and Whistleblowing in other exams
The same ground in other exams, if you are preparing for more than one or want another angle on it.
Regulation, Compliance and Whistleblowing: frequently asked questions
What is the difference between regulation and legislation?
Legislation is law made by a government or parliament. Regulation is detailed rules made and enforced by regulators or professional bodies, often under powers given by legislation. Some regulation, such as a code, may not be law at all.
How does whistleblowing protect employees?
Many countries have laws that protect whistleblowers from dismissal or unfair treatment after a genuine disclosure. Good organisations also add confidentiality and no-retaliation policies. The exact protection depends on the country.
What should a whistleblowing procedure include?
It should name a clear reporting channel, allow confidential reporting, promise protection from retaliation and explain how reports are investigated. It should also give feedback to the person who reported.
Why is compliance important for a business?
Compliance avoids fines, legal action and loss of licences. It also protects the organisation's reputation and builds trust with stakeholders.