Defamation can equally apply to an organisation as to an individual. So it is possible to defame a club/business, in exactly the same way as it is possible to defame an individual.
Let's assume you are correct, and: a) the smears/rumours are untrue... and b) they are damaging to the club/business.
Well then, a) + b) = the legal test for defamation, if both a) and b) can be proven
If your friend (and by default your friend's good name) is closely associated, as you say, with the club/business, it is also entirely possible that your friend has been personally defamed. So either your friend, or your friend's club/business, could take action.
I can't see how the umbrella group can be held to be responsible for sorting this out. They did not perpetrate the defamation. The only way they could be dragged into it is if the umbrella organisation trades under a certain brand name, for example, and your friend's club/busines is a franchisee of that brand. Well then the umbrella organisation could take action on the basis that the overall brand is being damaged.
What I would suggest is that your friend's club/business sends a solicitor's letter to the alleged perpetrator of the defamation asking them to desist from making defamatory comments, and outlining the nature of the defamatory comments made, and also outlining who it is believed made those comments, and if possible, to whom they were made. The umbrella organisation should also be made aware of this.
@MOB. I disagree that a defamation action is only for 'rock stars and politicians'. But sometimes, particularly if you just want the defamation to stop and you aren't seeking financial compensation, you don't need legal action. You just need the threat of legal action.