It depends on which level they're at. Generally speaking, we always advise our members to raise it to their immediate supervisor, and most often that wouldn't be the CFO. It could be people at various levels. That said, I've been president since 2016. When a member tells me they've seen wrongdoing, I will tell them to raise it, document it and then let it go.
I'm embarrassed that I have to say that to my own members. What I'd rather say is that we're going to fight it and we're going to help them. However, because they're not protected, we have to tell them they need to do the right thing, and the right thing is to raise it to the employer at any level. I say raise it, document it and then let it go, because I can't tell you one case I've ever heard of that had a favourable outcome for a whistle-blower.