Whistleblowers: A Novel Approach

Daphne Romney QC and Schona Jolly QC consider the recent High Court judgment in Rihan v Ernst & Young Global Ltd & others [2020] EWHC 901 (QB), which provides an interesting new angle for employment, international and commercial lawyers whose clients are not entitled to the statutory whistleblowing protection embedded within the Employment Rights Act 1996. Whilst the reach of the new duty of care is likely to be limited to very specific situations, it imposes a new duty of care on employers to protect against economic loss, in the form of loss of future employment opportunity, by providing an ethically safe work environment, free from professional misconduct (or indeed criminal conduct) in a professional setting.

Background Facts

Mr Rihan was employed by accountants Ernst & Young (‘EY’), working mainly in Dubai from 2008 until 2014. The claimant worked in the field of climate change and sustainability services (‘CCASS’). In 2013, Mr Rihan was the internal audit partner responsible for the audit of a Dubai company called Kaloti.He discovered that Kaloti was engaged in irregularities involving the import of gold bullion, which had been smuggled out of Morocco coated in silver, in breach of Moroccan export rules. It was then declared as gold in Dubai. These facts gave rise to a reasonable suspicion that Kaloti was involved in money laundering, a proposition that EY accepted at trial.[1] Various international instruments recognise that gold is a ‘conflict mineral’, meaning that there is a likelihood that it may be traded, especially when the trade is in cash, for the purpose of financing terrorist activity or organised crime. Mr Rihan disclosed these matters to the Dubai Metals and Commodities Centre (‘DMCC’), a regulatory body set up by the Dubai Government. However, the result of this disclosure was that the DMCC ‘pressurised [EY] to reduce to vanishing point the visibility of the Morocco gold and cash transactions issues, thereby misleading readers of relevant reporting documents into thinking that Kaloti’s business practices were essentially sound when, manifestly, they were not’.[2] He also alleged that EY failed to act upon his concerns or to report the matter to the appropriate authorities in London. When Mr Rihan appealed to EY managers in the Middle East and in Europe, he received no support; on the contrary, pressure was put on him to water down his report, and when he refused to sign the relevant assurance forms for Kaloti, he was replaced by another EY auditor who willingly signed them off on the transactions, ‘sanitising the findings and improperly lending [EY’s] name to a flagrantly misleading assurance reporting process’.[3] The managers led him to believe that he would be relocated, although Kerr J found that they had no such intention; he said one manager ‘wanted the claimant to believe that, contrary to his true intention, he intended to help the claimant to relocate, to keep the claimant loyal to the EY organisation and to deter him from making any unwanted disclosure about the Dubai audits.[4] Mr Rihan was warned about ‘the consequences of disagreeing’ and was told he had ‘dropped the ball’ and had not ‘done his job and his duty[5]’. He was worried about the repercussions of remaining in Dubai, both for himself and his family, but when he returned to the UK for meetings, and subsequently went off sick, he was then pressurised into returning to Dubai. Further, he was threatened with dismissal unless he agreed to meet EY representatives. He resigned and took his story to the media, where his story was widely publicised, including in a BBC Panorama programme.

Mr Rihan brought High Court claims against various EY UK-based entities, (none of which had been his employer) for past and future loss of earnings. He alleged that EY had breached duties of care owed to him in respect of the conduct of the Kaloti audit and in respect of his legitimate concerns for his and his family’s safety and had not protected him as a whistleblower. During the trial, EY portrayed Mr Rihan as a publicity-hungry liar and opportunist who had been forced to leave Dubai for reasons wholly unconnected with the Kaloti audit. Kerr J observed that EY’s case was that Mr Rihan was ‘paranoid and a conspiracy theorist who sought to manufacture a non-existent obligation to report his findings to the LBMA for his own, unexplained, reasons’. [6]EY further claimed that there was no obligation to report Kaloti’s conduct to any regulatory organisation, and that there was therefore no breach and no conspiracy against Mr Rihan.[7]

The legal claims

Whistleblowing claims are normally brought in the employment tribunal under the Employment Rights Act 1996, but this option was not available to Mr Rihan for (i) jurisdictional reasons and (ii) because none of the relevant entities had been his employer.  An action in contract for breach of the implied term of trust and confidence would have usually have been limited only to recovery of pay and benefits for his notice period unless he could show that, following Malik and Mahmud v BCCI[8], the business was run dishonestly and corruptly, but again none of the defendants was his employer. Instead, he sought to argue his case in a number of different ways which would protect his status as a whistleblower in the context of a civil claim.

First, he alleged that EY had negligently breached two duties of care –

  1. The duty to keep him safe against possible retribution in Dubai;
  2. The duty appropriately to address his concerns about the conduct of the audit.

Both of these were expressed as a duty not to cause him financial loss. Kerr J cited Lord Bridge in Caparo Industries plc v. Dickman[9]

 “It is never sufficient to ask simply whether A owes B a duty of care. It is always necessary to determine the scope of the duty by reference to the kind of damage from which A must take care to save B harmless.”

Kerr J concluded that EY did not owe Mr Rihan a ‘safety duty’ because it would be

 ‘…an illegitimate extension of the law to make the leap from the standard employer’s duty to safeguard its employees against personal injury to a broad duty to safeguard them against pure economic loss incurred as a result of the claimant’s need to cease working to avoid a threat to his physical safety’.[10]

The proper remedy for an employee told to work in unsafe conditions was to resign and claim constructive dismissal – it was ‘too far-fetched’ to say an employee could then claim lifelong loss if he decided to disobey to instruction to return to an unsafe workplace and part company with the employer.[11] This should be an employment claim and not a negligence claim[12], and this claim therefore failed. However, had there been such a duty, Kerr J concluded that EY would have breached it.

On the ‘audit duty, Mr Rihan submitted that the defendants assumed a responsibility to conduct the audit in an ethical manner by intervening and directing the manner in which it was carried out; that they assumed a responsibility to the claimant to protect him from the financial loss he suffered; that application of the threefold Caparo test led to the conclusion that the law should impose the audit duty on the defendants; and that this would be a permissible incremental development of the law by analogy with decided cases.

Kerr J concluded (as he had in respect of the ‘safety duty’)that the contention did not fit the ‘assumption of responsibility’ analysis in cases where a person provides services or advice to another in circumstances where there is no contract but the provider knows or should know that the other will rely on the professional care, skill and judgment. EY was not providing such services to Mr Rihan.

Kerr J then considered whether although such a duty was novel, it was only ‘a short further step’ from the decided cases, falling within Lord Mance’s test of incremental steps in Robinson v. Chief Constable of West Yorkshire.[13] In a novel type of case, ‘where established principles do not provide the answer’, consideration is given to whether an incremental development in the law, by analogy with decided cases, is appropriate (ibid., at [26]-[27]); and:

‘The drawing of an analogy depends on identifying the legally significant features of the situations with which the earlier authorities were concerned. The courts also have to exercise judgement when deciding whether a duty of care should be recognised in a novel type of case. It is the exercise of judgement in those circumstances that involves consideration of what is ‘fair, just and reasonable’….’

In an interesting nine-point analysis, Kerr J considered the range of authorities relating to the development of a novel duty of care. Having considered Mahmud v BCCI, Scally v Southern Health Board,[14] and Spring v Guardian Assurance,[15] Kerr J concluded that that it was readily foreseeable that Mr Rihan would suffer financial loss if the audit were conducted in what he considered to be an unethical manner, so that he would be bound to resign, and leave his comfortable and prosperous’ tax-free life in Dubai.[16] It was not necessary for the EY managers collectively to have foreseen the quantum of the financial loss. One manager had warned Mr Rihan about the consequences of his position and must have had his future unemployment in mind. Moreover, Kerr J held that it is generally known to professional persons such as accountants that to become a whistleblower often involves a major risk of financial loss through subsequent “unemployability”. The required degree of proximity was made out, on the principles of Donoghue v. Stevenson,[17] but only in connection to Mr Rihan’s involvement in the Kaloti matters. Kerr J dismissed as irrelevant the defendants’ arguments that proximity was not present because the different EY entities were not part of a unified corporate structure or because there were different cost centres and for accounting purposes, they charged each other for services rendered to one another.[18]

A novel duty of care

The nub of this novel duty of care is summed up by Kerr J in the following way:

‘In my judgment it is, conceptually, not a huge leap from imposing a duty of care to protect against physical injury and consequent financial loss by providing a physically safe work environment, to imposing a duty of care to protect against economic loss, in the form of loss of future employment opportunity, by providing an ethically safe work environment, free from professional misconduct (or indeed criminal conduct though that is not this case) in a professional setting. [19]

Such a duty closely mirrors the content of the portmanteau trust and confidence term in the context of regular employment, at issue in Mahmud’s case. Breach of the term is repudiatory, entitling the claimant to resign and claim constructive dismissal. The treatment of which the claimant complains in this case is akin to what in ordinary employment would be a complaint of constructive dismissal. However, he had no remedy against any of the defendants for constructive dismissal; he was not employed by any of them.’[20]

Kerr J elaborated that the duty is bound up in the professional, ethical and moral framework within which the defendants acted. The ‘audit duty’ was described as a duty owed by the defendants to Mr Rihan to take reasonable steps to prevent him from suffering loss of earnings by reason of the defendants’ failure to perform the Kaloti audit in an ethical and professional manner. That would require acting ‘in accordance with established norms of conduct which are found in documents such as the IFAC Code, the defendants’ own code of conduct and the Transparency Report. The defendants would only be required to do what they are in any event bound to do as a matter of professional ethics, ‘which accord with generally accepted views of morality in the context of reporting exercises such as this one.’ In underlining the framework within which this duty sits, Kerr J underlined that accountants and other professionals should not be pressurised by their employers (or quasi-employers) to act unethically[21].

Accordingly, the employer was under a duty to provide an acceptable work environment. By a party of reasoning with the classic duty of care on employers to take reasonable steps to provide a safe place of work and a safe system of work, Kerr J held that there was no reason why ‘the moral and professional integrity of the employee (or quasi-employee) should not be protected by a duty to take reasonable steps to provide an ethically acceptable work environment, free of criminal conduct (see Mahmud’s case) and free of professionally unethical conduct.’ The law should protect an employee from having their career ruined by being ‘tainted with unemployability’.[22]


In considering the issue of damages, Kerr J rejected EY’s ‘untenable’ submission that because disclosure would have been a criminal offence under UAE law, it similarly would have fallen foul of the ERA; that statute applied only to an offence under UK law. Had the claim been brought under the ERA, it would have been a strong claim. It was reasonable to made public disclosure to the media given EY’s conduct, and reasonable to have viewed this as the last resort. The chain of causation necessary to establish a claim in damages was not broken by the disclosure.

As for damages, Mr Rihan was awarded $2,437,764 for loss of past earnings, together with and $8,418,561 for loss of future earnings, and £117,950for past and future losses of medical insurance and insurance cover.

A word of caution

The facts in this case were very particular. The case does not set out to provide a parallel stream of protection alongside the statutory framework.

Kerr J emphasised that where a person ordinarily works outside Great Britain and therefore cannot avail himself of the statutory regime, a duty of care in tort is the only “gap filling” option. The court explicitly held that ‘the duty is likely to be ruled out as inconsistent with the statutory regime, but only where that statutory scheme itself provides that a person may invoke its protection.’ As such, he would not have considered it reasonable to find a duty of care if Mr Rihan could have availed himself of the statutory protection. The applicability of this duty, therefore, is likely to exist only in very narrow circumstances.

Nevertheless, this judgement provides whistleblowers who work outside the jurisdiction with  tangible, rather than theoretical protection, such that the common law will step in, under very particular circumstances, to remedy the loss sustained by a whistleblowing employee whose career and future earnings are damaged by the actions of an unscrupulous and ethically dubious employer. It is a salutary warning to transnational employers that effective whistleblowing protection may exist, through potentially significant financial compensation, even where the Employment Rights Act 1996 is ousted.

[1] §4

[2] §5

[3] §9

[4] § 264

[5] § 323

[6] § 18

[7] § 650

[8] [1998] AC 20

[9] [1980] 2 AC 605, per Lord Bridge at 627D:

[10] §475

[11] §481

[12] §§479-482 for the general discussion on claims relating to safety in the workplace.

[13] [2018] 2 WLR 595

[14] [1992] 1 AC 294

[15] [1995] 2 AC 294

[16] §589

[17] [1932] AC 562, 580-581

[18] §597

[19] §616

[20] §617

[21] §601-4

[22] §622