Whistleblower & stakeholder channels

What this page is (and is not)

This page explains common legal and governance reference points for speak-up channels, then maps them to Prepared Board’s stakeholder inbox (suggestions, complaints, ethics). It is educational product documentation.

Prepared Board is not a whistleblower hotline provider. It does not claim compliance with SOX §301 / Exchange Act Rule 10A-3, the Dodd-Frank SEC whistleblower anti-retaliation provisions, EU Directive 2019/1937, or IRS Form 990 Part VI line 13. It helps the board keep a process record of how reports are received and handled. Have counsel review channel design, privilege, and retention before you rely on any of this in a regulated setting.

SOX §301 and Rule 10A-3 — audit committee complaint procedures

For listed U.S. issuers, Sarbanes-Oxley §301 (Exchange Act §10A(m)), implemented by Rule 10A-3(b)(3), requires each audit committee to establish procedures for the receipt, retention, and treatment of complaints regarding accounting, internal accounting controls, or auditing matters, and for confidential, anonymous employee submissions about questionable accounting or auditing matters.

The SEC does not prescribe a single required procedure. Many issuers use a professional hotline. Prepared’s ethics lane can sit beside that hotline: independent directors / audit committee chair as recipients, never management (CEO), with conflict screening and anonymous case keys. Using Prepared does not by itself satisfy Rule 10A-3.

Dodd-Frank SEC whistleblower anti-retaliation

Exchange Act §21F (Dodd-Frank) creates SEC whistleblower incentives and anti-retaliation protections for individuals who report possible securities-law violations to the Commission as the statute and rules require. Digital Realty Trust, Inc. v. Somers held that the §21F private anti-retaliation cause of action covers those who report to the SEC.

Prepared records a board-declared non-retaliation note on ethics intake. Recording that note is not a legal non-retaliation guarantee. Protections depend on applicable law. Have counsel review.

EU Directive 2019/1937 — seven days and three months

EU Directive 2019/1937 requires Member States to ensure internal channels acknowledge receipt within seven days and provide feedback within a reasonable timeframe not exceeding three months from acknowledgment (or from expiry of the seven-day period if no acknowledgment was sent), with protection against retaliation.

Prepared’s default acknowledgment window (7 days) and feedback window (90 days / ~3 months) are product defaults inspired by those timelines. They are not a determination that your board complies with any Member State’s implementing law. National rules vary; ask counsel.

IRS Form 990 Part VI line 13

Form 990 Part VI line 13 asks whether a tax-exempt organization had a written whistleblower policy by year-end. IRS instructions describe such a policy as encouraging reporting of credible illegal practices or policy violations, protecting reporters from retaliation, and identifying to whom reports may be made.

Prepared’s separate whistleblower-policy acknowledgment tracker helps boards record that directors received a board-declared speak-up policy. The stakeholder inbox is the intake channel. Neither fills out Form 990 for you, and neither determines whether your written policy is adequate.

Caremark oversight

Caremark and later cases (Stone, Marchand, Boeing) describe oversight liability as typically requiring a sustained failure to implement or monitor board-level information and reporting systems for mission-critical risks — including compliance reporting.

A stakeholder inbox is one possible component of such a system. Having software does not prove good-faith oversight; ignoring red flags that reach the board can still be a problem. Counts and timeliness on board-proof show process hygiene without dumping case contents into diligence packs.

What Prepared ships

Public intake at /speak/[boardToken] (optional embed) with three lanes: suggestions, complaints, ethics. No account required. Optional name/contact. PDF attachments with strict size limits.

Anonymous reporters receive a one-time high-entropy case key (SHA-256 at rest) for /speak/case status and two-way messages. IP and user-agent are not logged on /speak/* routes.

Chair configures recipients per lane; ethics only to independent directors and/or the audit committee chair — never CEO / management. Recipients must accept before a lane goes live. Conflict screening excludes named people (including the chair) from routing and access; intake blocks if nobody eligible remains.

In-app case log at /app/inbox with status, owner, notes, acknowledgment and feedback due dates, Board Go nags when overdue, legal-hold integration with the records policy, and a strict ACL. Board-proof and diligence show counts and timeliness only.

So what for you as a director

• Decide with counsel whether ethics reports go to independents, the audit chair, an external hotline, or all of the above — then configure recipients and require acceptance before going live.
• Use conflict screening when a report names an officer or director; do not let the named person open the case.
• Treat 7-day acknowledgment and 3-month feedback as operating defaults unless counsel sets different clocks for your jurisdiction.
• Keep a professional hotline if you have one; link it from the public page. Prepared is the board case log beside that channel.
• Never claim SOX / Dodd-Frank / EU / Form 990 compliance from software alone.

Verified citations on this page

• SOX §301 / Exchange Act Rule 10A-3(b)(3) — 15 U.S.C. § 78j-1(m); 17 C.F.R. § 240.10A-3(b)(3). For listed U.S. issuers, Sarbanes-Oxley §301 (Exchange Act §10A(m)), implemented by Rule 10A-3(b)(3), requires each audit committee to establish procedures for the receipt, retention, and treatment of complaints regarding accounting, internal accounting controls, or auditing matters, and for the confidential, anonymous submission by employees of concerns regarding questionable accounting or auditing matters. The SEC does not prescribe a single required procedure. Source
• Dodd-Frank SEC whistleblower anti-retaliation (Exchange Act §21F) — 15 U.S.C. § 78u-6; Digital Realty Trust, Inc. v. Somers, 138 S. Ct. 767 (2018). Exchange Act §21F (added by Dodd-Frank) creates SEC whistleblower incentives and anti-retaliation protections for individuals who report possible securities-law violations to the Commission in the manner the statute and rules require. Digital Realty Trust, Inc. v. Somers held that the §21F anti-retaliation cause of action covers those who report to the SEC; program rules were later conformed. This is federal securities context — not a private-company Delaware fiduciary statute. Source
• EU Directive 2019/1937 (whistleblowing) — 7-day / 3-month timelines — Directive (EU) 2019/1937, Arts. 9 and 21. EU Directive 2019/1937 requires Member States to ensure internal reporting channels acknowledge receipt to the reporting person within seven days and provide feedback within a reasonable timeframe not exceeding three months from acknowledgment (or from expiry of the seven-day period if no acknowledgment was sent). It also requires protection against retaliation. National implementing law varies; Prepared's default 7-day acknowledgment and 3-month feedback windows are product defaults inspired by these timelines — not a compliance determination. Source
• IRS Form 990 Part VI line 13 — whistleblower policy — IRS Form 990 Part VI, line 13 / Instructions (Lines 13 and 14). Form 990 Part VI line 13 asks whether the organization had a written whistleblower policy by year-end. IRS instructions describe such a policy as encouraging staff and volunteers to report credible illegal practices or policy violations, protecting reporters from retaliation, and identifying to whom reports may be made. Answering the Form 990 question is the organization's responsibility — Prepared does not file Form 990 and does not determine whether a policy is adequate. Source
• In re Caremark International Inc. Derivative Litigation — 698 A.2d 959 (Del. Ch. 1996). Chancellor Allen described oversight liability as typically requiring a sustained or systematic failure to exercise oversight — such as an utter failure to attempt to assure a reasonable information and reporting system exists. Source
• Stone v. Ritter — 911 A.2d 362 (Del. 2006). The Delaware Supreme Court adopted Caremark’s oversight framework and located bad-faith oversight failures within the duty of loyalty. Source
• Marchand v. Barnhill — 212 A.3d 805 (Del. 2019). The Delaware Supreme Court held that directors must make a good-faith effort to implement and monitor board-level reporting systems for mission-critical compliance risks (there, food safety at Blue Bell). Source
• Sarbanes-Oxley Act of 2002 — Pub. L. No. 107-204, 116 Stat. 745 (2002). For U.S. public companies, Sarbanes-Oxley strengthened audit-committee independence and financial-reporting accountability (including CEO/CFO certification regimes under the federal securities laws). It is federal disclosure / governance context — not a private-company Delaware fiduciary statute. Source