Whistleblowing policy: making it safe to say something is wrong

A whistleblowing policy sets out how someone reports serious wrongdoing — fraud, safety risks, breaches of law, a cover-up — and what protection they have when they do. It is distinct from a grievance procedure, which handles a complaint about how the person themselves has been treated. Whistleblowing is about harm to others: to customers, to the public, to the company.

Writing the policy is the easy part. The hard part is that nobody uses a channel they do not trust, and trust is not established by the document. It is established by what visibly happened the last time somebody spoke up.

What a whistleblowing policy has to cover

• What it is for: the categories of serious wrongdoing that belong here rather than in a grievance.
• Who may use it — usually staff, and often contractors, agency workers, suppliers and former employees too.
• At least two routes to report, because the default route fails when the concern involves the person who owns it.
• Whether reports can be anonymous, and an honest statement of what anonymity limits about the investigation.
• Confidentiality: who will know the reporter's identity, and the circumstances in which it might have to be disclosed.
• The protection against retaliation, stated plainly, and what to do if it happens anyway.
• What follows a report: acknowledgement, assessment, investigation, outcome, and rough timescales.
• What the reporter will and will not be told at the end.
• External routes — the regulator or authority a person may go to, which some regimes require you to name.

The second route is the part most policies handle badly. If the instruction is to tell your line manager, the policy is useless in precisely the cases it exists for: when the manager is involved. Name an alternative — another director, a non-executive, an external service — and make it reachable without going through anyone in the ordinary chain. Where the concern involves harm to a person at risk, it belongs in the safeguarding policy route rather than in this one.

Anonymity, honestly described

Allowing anonymous reports raises the number of reports and lowers the quality of what can be done with them. An investigator who cannot ask a follow-up question is working with one snapshot, and a serious allegation frequently cannot be substantiated without one. Say this rather than implying that anonymous reports are handled identically.

The stronger position is confidentiality with a named reporter: identity known to a small defined group, protected as far as the law allows, with the limits stated. That supports a real investigation while giving the reporter something more substantial than a promise nobody could keep in a company of fifteen where a specific allegation identifies its author anyway.

Setting it up

1. Define what belongs here and what belongs in a grievance, with examples of each.
2. Name at least two routes, one of which bypasses line management entirely.
3. Decide the anonymity position and describe its limits honestly.
4. Set service standards you can meet: acknowledge within a few days, assess within a fortnight, keep the reporter informed.
5. Name who investigates and what happens when the concern involves them.
6. Log every report from receipt to outcome, and keep that log restricted.
7. Tell people the policy exists more than once a year — an unused channel is often an unknown one.
8. Review after every case, and check whether the reporter experienced anything that looks like retaliation.

The legal layer

Whistleblower protection is legislated in many jurisdictions, and the requirements are specific: which organisations must have a channel, what size threshold applies, how quickly reports must be acknowledged and concluded, what records must be kept, and what counts as prohibited retaliation. The EU directive and various national laws each set their own terms, and penalties for retaliation can be significant.

So this is a document to draft against the rules that apply to you, with advice, rather than adapt from a template. What is written here describes the shape of a policy — it is not a statement of what any particular law requires of your organisation.

The reporting channel

Ettex Forms can serve as one of the routes: a form reachable from a link that does not go through anyone's line manager, with submissions landing in a single place seen only by the people you designate. Fields can ask for what an investigator will need first — what happened, when, who is involved, whether the reporter is willing to be contacted.

Two limits worth stating precisely, because in this area they matter. Forms is not an anonymous reporting service: submissions are associated with your workspace and the network request itself carries technical metadata, so if you promise anonymity you should use a service built to provide it. And there is no case management — no deadline tracking, no investigation workflow, no restricted case file. The channel is a form; the process around it is yours.

It works alongside a conflict of interest policy rather than covering the same ground. Whistleblowing handles wrongdoing someone has witnessed; conflicts are declared in advance by the person who has them, which is a much lower-stakes act and needs a much easier route.

Two routes, one of them around the manager; honesty about what anonymity costs; timescales you can actually meet; and a visible record that the last person who reported something was not punished for it.