There, the key is protection for internal disclosure. You have to have the right to go public when there's a conflict of interest or obstruction of justice within the institution, but the knee-jerk reaction for almost all employees—more than 90%, and almost every study shows this—is to choose to go to their boss first, to operate within the environment that has been their professional world or life. They very rarely break ranks except out of extreme frustration or after beating their head against the wall repeatedly.
If there's retaliation at those early stages, the word gets around quickly and everybody knows: don't open your mouth. You have to make sure, then, that it's at least safe to operate within institutional channels and then give people the right to go outside if necessary.