Whistle-blower Policy: Encouraging Ethical Reporting

A whistle-blower policy gives employees and others a safe, defined route to report serious wrongdoing, such as fraud, bribery, safety violations or data misuse, and promises that they will not suffer for reporting in good faith. In India, every listed company and certain other prescribed classes of companies must set up a “vigil mechanism” under section 177 of the Companies Act, 2013; for everyone else it is a strong governance choice. This guide explains what the law says, what the policy must cover, how anonymity and non-retaliation should work, and gives sample clauses.

What a whistle-blower policy actually does

Most misconduct is noticed first by people close to the work. A whistle-blower policy turns that knowledge into action by answering four questions in advance: what can be reported, to whom, how the reporter will be protected, and what happens next. When those answers are written down, people are more likely to speak up early, while a problem is still small.

It is different from a grievance procedure. A grievance is usually about how the individual is treated (pay, leave, a manager’s behaviour towards them). A whistle-blower concern is about wrongdoing that affects the organisation or others. Keep both routes, and say clearly which issues go where. For the employee’s side of the story, see how whistle-blower policies protect employees.

Is a whistle-blower policy mandatory in India?

For some companies, yes. Section 177(9) of the Companies Act, 2013 requires every listed company, and such class or classes of companies as may be prescribed, to establish a vigil mechanism for directors and employees to report genuine concerns. Section 177(10) adds three requirements:

• the mechanism must provide adequate safeguards against victimisation of people who use it;
• it must provide direct access to the chairperson of the Audit Committee in appropriate or exceptional cases; and
• the company must disclose details of the mechanism on its website, if it has one, and in the Board’s report.

Which unlisted companies fall within the “prescribed” classes is set out in the rules made under the Companies Act. Check the current rules with your company secretary every year, because the rules can be amended and your company’s position can change from year to year. Listed entities should also check their stock exchange listing obligations.

Organisation	Position	What to do
Listed company	Vigil mechanism required under section 177(9)	Policy, Audit Committee oversight, website and Board’s report disclosure
Unlisted company in a prescribed class	Required under the rules	Confirm applicability each year with your company secretary
Other companies, firms, LLPs, startups	Not required by section 177	Adopt a proportionate policy as good governance and investor hygiene

Two other routes must sit alongside the policy. Complaints of sexual harassment at work by women go to the Internal Committee under the POSH Act, 2013, which is separately in force; the Ministry of Women and Child Development’s SHe-Box portal also accepts complaints. Individual grievances in industrial establishments with 20 or more workers go to the Grievance Redressal Committee required by the Industrial Relations Code, 2020. Your whistle-blower policy should point to these routes, not replace them.

If you have staff in the UK, note that workers there have legal protection for “protected disclosures” in the public interest, and confidentiality clauses cannot stop such disclosures; see GOV.UK guidance on whistleblowing.

What the policy should cover

1. Purpose and commitment: a short statement that the organisation wants concerns raised and will protect people who raise them.
2. Who can report: employees, directors, trainees, contract and agency staff, vendors, and former employees.
3. What can be reported: fraud, bribery and corruption, accounting irregularities, breaches of law, safety and environmental risks, misuse of confidential or personal data, conflicts of interest, and serious breaches of the code of conduct.
4. What goes elsewhere: personal grievances (grievance procedure or committee), sexual harassment complaints (Internal Committee), and routine performance disagreements.
5. How to report: at least two channels, for example a dedicated email address monitored by the ethics or compliance officer, and a written or online form that allows anonymous submission. Include the route to the Audit Committee chair.
6. Confidentiality and anonymity: what each means and how it is protected (see below).
7. Protection from retaliation: what counts as retaliation and the consequences for anyone who retaliates.
8. Investigation process and timelines: acknowledgement, triage, investigation, outcome.
9. False or malicious reports: protection for honest mistakes, action only for knowingly false reports.
10. Records, oversight and review: who keeps case files, who reports to the board or Audit Committee, and when the policy is reviewed.

Concerns about divided loyalties are among the most common reports, so link the policy to your conflict of interest policy.

Anonymity and confidentiality are not the same

Confidentiality means the investigator knows who the reporter is but shares their identity only with people who strictly need it. Anonymity means nobody in the organisation knows who made the report.

Accept both. Anonymous reports lower the barrier to speaking up, but they are harder to investigate because nobody can ask follow-up questions. Two practical fixes:

• Give every report a reference number and a way for the reporter to check back anonymously, so investigators can ask questions.
• Encourage reporters to include specific facts: dates, places, documents and who else may have seen the conduct.

Be honest in the policy: confidentiality will be protected as far as possible, but identity may need to be disclosed if the law or a court requires it, and colleagues may sometimes guess the source from the facts.

Non-retaliation: what it must mean in practice

A non-retaliation promise only builds trust if people can see it working. Define retaliation broadly: dismissal, demotion, denied promotion or increment, unfavourable transfer, changed duties, exclusion from meetings, hostile appraisals, threats, and harassment by colleagues.

• Make retaliation a disciplinary offence in its own right, up to and including termination.
• Have HR review any adverse decision affecting a known reporter for a defined period after the report, and record why the decision was made.
• Give reporters a direct route to raise suspected retaliation, outside their reporting line.
• Protect witnesses and people who help an investigation in the same way.

How to investigate a report, step by step

1. Acknowledge receipt within a short, stated period, with the reference number.
2. Triage the concern: is it in scope, how serious is it, is there an immediate risk to people, money or evidence?
3. Check for conflicts. Anyone named in the report, or close to it, must not handle it. Escalate to the Audit Committee chair where senior management is involved.
4. Appoint an investigator with the right independence and skills; use an external investigator for complex or senior cases.
5. Preserve evidence such as emails, files and access logs before anyone is alerted.
6. Interview the reporter, witnesses and the person concerned. Give the person concerned a fair chance to respond before any finding.
7. Decide and act. Record findings, the evidence relied on and the action taken (disciplinary, process fixes, recovery, reporting to authorities where required).
8. Close the loop with the reporter, sharing as much as confidentiality allows.
9. Report trends (numbers, categories, time taken, outcomes, without names) to the board or Audit Committee.

Sample whistle-blower policy clauses

Adapt these to your structure and have them reviewed before adoption.

• Commitment: “We want to hear about any suspected wrongdoing. Anyone who raises a genuine concern in good faith under this policy will be protected, even if the concern turns out to be mistaken.”
• Channels: “Concerns can be raised with the Ethics Officer by email, through the confidential reporting form (which allows anonymous reports), or, in exceptional cases or where senior management is involved, directly with the Chairperson of the Audit Committee.”
• Confidentiality: “The identity of the person raising a concern will be shared only with those who need it to investigate, unless disclosure is required by law.”
• Non-retaliation: “No person will be dismissed, demoted, transferred, denied benefits or otherwise disadvantaged for raising a concern or assisting an investigation. Retaliation is a serious disciplinary offence.”
• Timelines: “Concerns will be acknowledged promptly and the reporter will be told of the outcome, to the extent confidentiality allows, once the investigation is complete.”
• Misuse: “Action may be taken only where a person knowingly makes a false report. An honest concern that is not proven will never lead to action against the reporter.”
• Other routes: “Complaints of sexual harassment are handled by the Internal Committee under the Prevention of Sexual Harassment policy. Personal grievances are handled under the grievance procedure.”

Common mistakes that undermine trust

• A single channel that runs through the reporter’s own manager.
• No anonymous option, or an anonymous option with no way to follow up.
• Investigations led by someone who reports to the person accused.
• Reporters never hearing back, which tells everyone the system does not work.
• Threatening “action for frivolous complaints” so heavily that people are afraid to report honest concerns.
• Mixing POSH complaints into the general process instead of the Internal Committee.

Roll-out checklist

• Confirm whether section 177 applies to your company and record the decision.
• Appoint an Ethics Officer and a deputy, and confirm Audit Committee oversight where required.
• Set up channels and test that anonymous reports actually reach the right person.
• Publish the policy on the intranet, and on the website where disclosure is required.
• Train managers on how to receive a concern and what not to do (investigate on their own, reveal identities, react defensively).
• Add a reference to the policy in your code of conduct and appointment letters.
• Review the policy and case trends every year.

For why visible follow-through matters so much, read why whistle-blower policies are critical for employee trust. To start from a structured draft, the HRTailor.AI HR policy generator produces an editable policy you can adapt with the clauses above.

Last reviewed: 26 October 2026. General information, not legal or tax advice.

Official sources

• Companies Act, 2013, section 177 (India Code)
• SHe-Box portal FAQ (Ministry of Women and Child Development)
• Compliance Handbook for Employers under the Four Labour Codes (Ministry of Labour and Employment)
• GOV.UK: Whistleblowing for employees

Related reading

• How Whistle-blower Policies Protect Employees
• Why Whistle Blower Policies Are Critical for Employee Trust
• 10 Essential HR Policies Every Startup Needs in 2026