Whistleblower Policy

Whistleblower Policy

When to use this

Use this skill when:

• A company is establishing or revising a whistleblower / "speak-up" policy as part of its corporate governance framework
• An entity must comply with mandatory whistleblower reporting requirements (EU Whistleblower Directive, US Sarbanes-Oxley, Dodd-Frank, UK PIDA, DIFC / ADGM governance standards)
• A board or audit committee requires a policy documenting the anonymous reporting channel and anti-retaliation protections
• An M&A legal team identifies that the target lacks a compliant whistleblower policy during due diligence
• A company is responding to a regulatory inquiry about its internal controls and needs to demonstrate an operative speak-up system

The policy must be genuinely operational — not boilerplate. A policy that exists on paper but is not trained, communicated, or enforced provides minimal legal protection and may itself become evidence in a regulatory proceeding.

Required inputs

Optional inputs

• Third-party hotline provider — many companies use external anonymous hotline (e.g., EthicsPoint, NAVEX, SpeakUp); specify in the policy
• Audit committee / board oversight role — whether the audit committee receives all reports or only those involving senior management
• Existing internal investigation procedure — policy should cross-reference the investigation procedure
• Multilingual requirements — policy must be accessible in all languages of the company's workforce
• Confidentiality procedure for legal hold — hotline records may be subject to legal hold; address in data retention section

Document structure

1. Purpose and commitment — company's commitment to ethical conduct and open reporting; purpose of the policy (create a safe reporting environment; detect and remediate wrongdoing; comply with applicable law)

2. Scope — who is covered — all employees (permanent, temporary, part-time); contractors, consultants, and agents; former employees (for matters they reported during employment); members of the company's board; third-party suppliers and joint venture partners (if applicable); specific inclusion of workers in all jurisdictions

3. What can be reported (reportable concerns) — non-exhaustive list:

   • Fraud, corruption, bribery, kickbacks
   • Financial irregularities, accounting fraud, securities fraud
   • Health and safety violations
   • Environmental breaches
   • Data protection and privacy violations
   • Harassment, discrimination, or bullying
   • Conflicts of interest not disclosed
   • Violations of company policy or applicable law
   • Retaliation against a prior reporter
   • Government contract or procurement violations
   • Sanctions and export control violations (for MENA entities operating internationally)

4. How to report — reporting channels

   • Internal channels: direct manager (if not implicated), HR, legal department, compliance officer
   • Anonymous hotline: 24/7 third-party operated; caller ID not recorded; accessible in [relevant languages]
   • Board / audit committee channel: for concerns involving senior management, CFO, or CEO
   • External reporting: company encourages internal reporting first but acknowledges employees' legal right to report to external regulators (DFSA, SCA, FCA, SEC, relevant labor authority, etc.) — anti-retaliation protections apply regardless of which channel is used
   • Specify contact details for each channel

5. Confidentiality — reporter's identity protected to the maximum extent possible consistent with conducting a fair investigation; when disclosure is unavoidable (e.g., criminal proceedings), reporter is informed in advance; information about the report shared only on a need-to-know basis; records stored securely; data protection law compliance

6. Anti-retaliation protections — company strictly prohibits retaliation against any person who reports in good faith; prohibited retaliation includes: dismissal, demotion, salary reduction, harassment, threats, blacklisting, negative performance reviews, refusal of promotion; definition of "good faith" (reporter genuinely believed concern was valid; knowingly false reports are not protected); remedies for retaliated-against reporters (reinstatement, compensation, legal action); managers personally liable for authorized retaliation

7. Investigation procedure — reference to separate [[prompt-pack-workplace-investigation-plan]]; key commitments in this policy: initial triage within [5 business days]; acknowledgment to reporter (where not anonymous); investigation by qualified, impartial investigator; conclusion within [60–90 days] unless extension documented; feedback to reporter on outcome (in general terms, preserving third-party confidentiality)

8. Disclosure and false reports — reporter duty to report accurately to the best of their knowledge; deliberately false or malicious reports may constitute misconduct subject to disciplinary action; this provision must be narrowly drafted to not chill legitimate reporting

9. Record-keeping and data protection — hotline records retained for [5–7 years] or as required by local law; access restricted to investigation team; records subject to company data protection policy; data subject rights of the reported individual are addressed in the investigation procedure

10. Governance — policy owned by [General Counsel / Chief Compliance Officer]; annual review cycle; board / audit committee receives annual summary of reports, outcomes, and trends (anonymized); amendment process; version control

11. Communication and training — policy distributed to all covered persons; new-hire training required; annual refresher; managers trained on anti-retaliation obligations; accessible on company intranet in all relevant languages

12. Governing law — policy is governed by applicable law in each jurisdiction of operation; where there is conflict between this policy and local law, the more protective standard applies

Jurisdictional notes

MENA cultural note: In Gulf cultures, a "speak-up" culture may be less developed than in Western organizations. The policy should be supplemented with training that emphasizes the company's genuine commitment to non-retaliation and that addresses the cultural stigma around "reporting on colleagues." Manager training is particularly important.

Language requirement: In UAE and KSA, employee-facing policies should be in Arabic (or bilingual with Arabic). A policy only in English that employees cannot read provides minimal protection in labor proceedings.

Drafting standards

• Anti-retaliation clause must have teeth — specify concrete remedies (reinstatement, compensation), not just a vague policy statement
• Anonymous channel is not optional — employees will not report if they fear identification; even where confidentiality cannot be guaranteed (e.g., small team), state the commitment clearly
• Do not conflate with grievance procedure — whistleblower reports concern wrongdoing by others; personal grievances are handled separately; confusing the two dilutes both
• Feedback obligation — the EU Directive requires feedback within 3 months; even outside EU, committing to feedback (in general terms) increases trust in the system
• False reporting carve-out must be narrow — broad language threatening discipline for "unsubstantiated" reports will chill legitimate disclosures

Common mistakes

• Policy exists but is not communicated — a policy that employees don't know about offers no protection
• No anonymous channel — anonymous channels are the standard for effective reporting; identified-only systems generate under-reporting
• Anti-retaliation clause too vague — "the company does not retaliate" without specifics is unenforceable
• No feedback mechanism — reporters who hear nothing assume their report was ignored; required by EU Directive and best practice elsewhere
• Conflating with HR grievance procedure — whistleblower reports should go to compliance / legal, not HR, to avoid conflicts of interest
• Single language — non-English-speaking employees may not understand or use an English-only policy

Related skills

• [[prompt-pack-workplace-investigation-plan]]
• [[prompt-pack-workplace-investigation-report]]
• [[prompt-pack-anti-bribery-compliance-policy]]
• [[kb-corporate-governance-mena]]
• [[heuristic-always-state-jurisdiction-first]]