A whistleblowing policy tells people how to report serious wrongdoing and promises they will not suffer for it. Whether the promise is believed is decided by what happened to the last person who used it.
A whistleblowing policy sets out how someone reports serious wrongdoing — fraud, safety risks, breaches of law, a cover-up — and what protection they have when they do. It is distinct from a grievance procedure, which handles a complaint about how the person themselves has been treated. Whistleblowing is about harm to others: to customers, to the public, to the company.
Writing the policy is the easy part. The hard part is that nobody uses a channel they do not trust, and trust is not established by the document. It is established by what visibly happened the last time somebody spoke up.
The second route is the part most policies handle badly. If the instruction is to tell your line manager, the policy is useless in precisely the cases it exists for: when the manager is involved. Name an alternative — another director, a non-executive, an external service — and make it reachable without going through anyone in the ordinary chain.
Allowing anonymous reports raises the number of reports and lowers the quality of what can be done with them. An investigator who cannot ask a follow-up question is working with one snapshot, and a serious allegation frequently cannot be substantiated without one. Say this rather than implying that anonymous reports are handled identically.
The stronger position is confidentiality with a named reporter: identity known to a small defined group, protected as far as the law allows, with the limits stated. That supports a real investigation while giving the reporter something more substantial than a promise nobody could keep in a company of fifteen where a specific allegation identifies its author anyway.
Whistleblower protection is legislated in many jurisdictions, and the requirements are specific: which organisations must have a channel, what size threshold applies, how quickly reports must be acknowledged and concluded, what records must be kept, and what counts as prohibited retaliation. The EU directive and various national laws each set their own terms, and penalties for retaliation can be significant.
So this is a document to draft against the rules that apply to you, with advice, rather than adapt from a template. What is written here describes the shape of a policy — it is not a statement of what any particular law requires of your organisation.
Ettex Forms can serve as one of the routes: a form reachable from a link that does not go through anyone's line manager, with submissions landing in a single place seen only by the people you designate. Fields can ask for what an investigator will need first — what happened, when, who is involved, whether the reporter is willing to be contacted.
Two limits worth stating precisely, because in this area they matter. Forms is not an anonymous reporting service: submissions are associated with your workspace and the network request itself carries technical metadata, so if you promise anonymity you should use a service built to provide it. And there is no case management — no deadline tracking, no investigation workflow, no restricted case file. The channel is a form; the process around it is yours.
A policy setting out how to report serious wrongdoing such as fraud, safety risks or breaches of law, and what protection the reporter has.
A grievance concerns how the complainant themselves has been treated. Whistleblowing concerns harm to others — customers, the public, the organisation.
Anonymity raises reporting and limits investigation, since follow-up questions become impossible. Confidentiality with honest limits is often the stronger option.
Because the usual route fails when the concern involves the person it goes to. One route must bypass line management.
Typically employees, and in many regimes contractors, agency workers, suppliers and former staff. Check what applies where you operate.
In many jurisdictions, for organisations above a certain size, with specific rules on acknowledgement, timescales and retaliation. Take advice on what applies to you.
Two routes, one of them around the manager; honesty about what anonymity costs; timescales you can actually meet; and a visible record that the last person who reported something was not punished for it.
A non conformance report captures work that did not meet requirement — what it was, what was decided, who authorised it. Raised late or written vaguely, it becomes paperwork nobody can act on.
A subject access request asks you to hand over the personal data you hold about someone. The deadline is short, the search is wider than people expect, and preparation is what makes it routine.
360 degree feedback collects views from the people around someone rather than only their manager. It produces genuinely new information — and turns into something else entirely the moment it affects a salary.