Whistleblower policy: how to report, who investigates and how to protect

A finance executive notices that the same vendor is being paid twice a quarter, each time against a slightly different invoice number. She mentions it to her team lead, who tells her it is probably a timing matter. Three months later she is still unsure whether to push. A whistleblower policy exists for exactly this moment. It tells her where to take the concern, who will read it, and what protects her afterwards.

This guide is the twenty-ninth in the series on the 30 policies a growing company needs. Policy HR-POL-029 is the one that most depends on trust, so it is worth writing carefully and testing before you issue it.

The purpose is simple. Give employees, and ideally contractors and former staff, a safe way to report suspected wrongdoing. Scope should say who may report and what the policy covers. Most companies list the following reportable concerns.

• Financial fraud, false entries and accounting irregularities.
• Corruption, bribery and kickbacks.
• Misuse of company assets, money or data.
• Serious violations of law or regulation.
• Danger to health or safety that has been ignored.

Keep the list illustrative rather than closed, and say what the policy is not for. A complaint about a rota or a rude colleague belongs in the disciplinary and grievance policy. Sexual harassment complaints follow the separate POSH policy. Fraud controls themselves sit in the anti-bribery and anti-fraud policy.

Five decisions shape the policy. Settle them in this order, because each one limits the next.

1. 1

   Name the receiving authority

   Choose one senior person who is independent of day to day management, such as a non-executive director, the audit committee chair or an external reviewer. Name a deputy for when the first person is absent or conflicted.

2. 2

   Decide on anonymity

   Anonymous reports reach more concerns but are harder to investigate, because you cannot ask follow-up questions. Many companies accept them and ask the reporter to use a reference number for later contact.

3. 3

   Fix the oversight

   Say who watches the process. In a company with a board, summary figures go to the board or audit committee. In a smaller one, the founders may need an outside adviser to play that part.

4. 4

   Set the investigation procedure

   Decide who investigates, how evidence is preserved, and when an external investigator is brought in.

5. 5

   Define escalation

   Spell out the route when the concern involves a director, the receiving authority or the investigator themselves.

Offer more than one channel. A dedicated mailbox read only by the receiving authority, a phone line or voicemail, a web form hosted outside the company mail system, and a sealed letter all work. The point is that no single person controls every route.

Concerns involving senior management are where policies fail. If every report is read first by the HR head, and the HR head reports to the managing director, the reporter has no safe door. Write the bypass in plain words: a concern about a director goes straight to the named independent authority, and HR is told only if that authority decides so.

Say what retaliation looks like: dismissal, a sudden poor rating, a transfer, exclusion from meetings, a withheld increment, or open hostility. Promise that the company will treat any of these as a disciplinary matter. Then back the promise with a mechanism. A named person checks in with the reporter at set intervals and reviews any later action affecting them, such as a rating or a revision, before it is final.

Protection is not immunity. A reporter who has also broken a rule is still answerable for their own conduct, though cooperation is taken into account. State this honestly so nobody is misled.

When a concern arrives, the receiving authority logs it, sends an acknowledgement and makes an initial assessment. Is this inside the policy? Is there enough to look at? Does anyone involved have to be kept away from the file? The investigation itself should be independent of the people concerned, fair, and documented.

• Preserve evidence at once: lock mailboxes, take copies of ledgers, record device and access logs.
• Restrict the case file to the named handlers and keep an access log.
• Tell the accused person the allegation and allow a response before any finding.
• Do not treat the accused as guilty while the matter is open.
• Record findings, reasons and the evidence relied on.

Confidentiality safeguards matter on both sides. Protect the reporter's identity as far as the law and the investigation allow, and protect the accused from rumour. Whistleblower cases need restricted access and confidential case handling, not an ordinary request queue where many people can open the ticket.

If the concern is substantiated, the company decides on the response: correction of the control, recovery, disciplinary action, or referral to a regulator or the police. That decision should be taken by someone other than the investigator. If a report was knowingly false and made in bad faith, handle it through the normal fair process in the disciplinary policy, and separate it clearly from a report that was honest but mistaken. Punishing honest mistakes will end reporting quickly.

1. Purpose and scope: this policy lets [who may report] raise concerns about [list of concerns].
2. Definitions: concern, reporter, receiving authority, retaliation, case file.
3. How to report: write to [independent mailbox] or call [number].
4. Receiving authority: [role], deputy [role], contact [details].
5. Concerns about senior management go directly to [independent role].
6. Anonymous reports: accepted, with a reference number for follow-up.
7. Protection: no retaliation; reviewed by [role] at [interval].
8. Assessment: acknowledgement within [number] working days.
9. Investigation: independent, evidence preserved, accused heard.
10. Outcome: findings reported to [board or committee].
11. Records: case register, restricted access, retention for [period].
12. Acknowledgement: read, understood, accepted; date; policy version.
13. Review: every [period] or after any serious case.

Keep a whistleblower case register with a reference number, date received, channel, category, handler, outcome and closure date. It holds no names in the open columns. Keep the investigation report, the evidence log and the reporter follow-up note in the restricted case file. Staff sign an acknowledgement that they have read, understood and accepted the policy, recording the date and the version. Review it yearly, after each serious case, and whenever the leadership changes.

GullyHR drafts and reviews policies of this kind as part of its HR policies and governance work. If you are unsure where to start, the requirements form takes a few minutes.