Whistleblower and Anti-Retaliation Policy

Organization: [ORG]
Adopted by the Board of Directors: [DATE]
Last reviewed: [REVIEW_DATE]
Policy owner: [AUDIT_COMMITTEE CHAIR / COMPLIANCE OFFICER]
Primary reporting channel: [HOTLINE_URL_OR_PHONE]
Alternate escalation: [AUDIT_COMMITTEE_CHAIR_EMAIL] / [GENERAL_COUNSEL]

Template notice. Customize with counsel for SOX, state nonprofit law, EU whistleblower directives, sector regulators, and employment rules in jurisdictions where [ORG] operates. Replace bracketed placeholders before adoption.

---

1. Purpose

[ORG] encourages good-faith reporting of concerns about accounting irregularities, fraud, legal or regulatory violations, safety risks, harassment or discrimination that implicates leadership, ethical breaches, and other serious misconduct. This Policy establishes:

1. Accessible reporting channels, including anonymous options where lawful;
2. Independent triage when management may be implicated;
3. Strict anti-retaliation protections;
4. Investigation and remediation standards; and
5. Board / Audit Committee oversight and documentation.

Speaking up is a duty of care contribution, not disloyalty.

---

2. Scope — Who May Report

This Policy covers reports by:

• Employees, officers, and temporary workers of [ORG];
• Directors and committee members;
• Significant contractors and vendors (especially regarding procurement integrity); and
• [DONORS / MEMBERS / CUSTOMERS — OPTIONAL].

Reports may concern conduct by anyone associated with [ORG], including executives and directors.

---

3. What to Report

Examples (non-exhaustive):

• Fraud, embezzlement, bribery, or kickbacks;
• Misstatement of financials, falsified books, or weaknesses in internal controls deliberately ignored;
• Violations of law, regulation, or material contractual covenants;
• Significant safety, environmental, or data-security failures;
• Conflicts of interest concealed from the Board;
• Retaliation against someone who reported or participated in an investigation;
• Other conduct that could materially harm [ORG], its mission, stakeholders, or reputation.

Ordinary HR grievances (performance disputes, interpersonal conflict without legal/ethical dimension) should generally use [HR_CHANNELS], unless they involve executives, systemic issues, or retaliation for protected activity — in which case this Policy applies.

---

4. Reporting Channels

4.1 Primary channel

Reporters should use [HOTLINE_PROVIDER / INTERNAL ETHICS PORTAL] at [HOTLINE_URL_OR_PHONE], available [24/7 / BUSINESS HOURS], in [LANGUAGES]. Anonymous reporting is available where permitted by law.

4.2 Named escalation paths

Managers who receive a report must escalate within [2] business days and must not investigate alone when they lack independence.

4.3 Awareness

[ORG] shall publish channel information in onboarding, the employee handbook, contractor terms where appropriate, posters/intranet, and the Governance folder of the board portal.

---

5. Anti-Retaliation

[ORG] prohibits retaliation against any person who, in good faith, reports a concern or participates in an investigation. Retaliation includes termination, demotion, pay reduction, punitive scheduling, exclusion from opportunities, threats, harassment, and reputational smear motivated by the protected activity.

Process for retaliation claims

1. Treat as a priority investigation, preferably with investigators different from those on the original matter.
2. Consider interim protections (alternate reporting line, no-contact directives).
3. Document findings and remedies (reinstatement, back pay, discipline of retaliators up to termination).
4. Notify the Audit Committee of any retaliation allegation involving officers or directors.

Bad-faith reports known to be false may result in discipline; honest reports that are unsubstantiated remain protected.

---

6. Confidentiality

[ORG] will protect the identity of reporters to the extent practical and lawful, disclosing only on a need-to-know basis for investigation, legal advice, insurance, or legal compulsion. Anonymous reporters should provide enough detail and a means of follow-up (e.g., hotline case number) so investigators can ask clarifying questions.

Confidentiality is not absolute: [ORG] may be required to disclose information to regulators, courts, or law enforcement.

---

7. Intake, Triage, and Investigation

7.1 Acknowledgment

Where identity is known, [ORG] will acknowledge receipt within [5] business days and provide a case reference.

7.2 Triage

[COMPLIANCE OFFICER / DESIGNEE], subject to Audit Committee oversight, classifies severity, conflicts, and whether external investigators or counsel are needed. Matters implicating the CEO, CFO, General Counsel, or directors escalate immediately to the Audit Committee Chair.

7.3 Investigation principles

• Independence and competence of investigators;
• Preservation of documents and systems (legal hold when warranted);
• Fair opportunity for subjects to respond to material allegations;
• Proportionate, documented findings and remediation;
• Closure communication to the reporter to the extent lawful and practical (without compromising privacy of others).

Target timelines: triage within [10] business days; substantive update to Audit Committee on open high-severity matters at each regular meeting; closure goals tailored to complexity (simple matters [30–45] days; complex matters as needed with status reporting).

---

8. Board and Audit Committee Oversight

The Audit Committee (or [DESIGNATED INDEPENDENT COMMITTEE]) shall:

1. Oversee procedures for receipt, retention, and treatment of complaints regarding accounting, internal controls, and auditing matters, and confidential anonymous employee submissions on such matters;
2. Receive periodic summaries of ethics/compliance reports of material risk (counts, categories, aging, retaliation claims, remediation status) without unnecessary PII;
3. Direct independent investigations when management independence is compromised; and
4. Report material issues and program health to the full Board at least [ANNUALLY / QUARTERLY].

Charter cross-reference: see Audit Committee Charter of [ORG].

---

9. Document Retention

Intake logs, investigation files, and Board/Committee reports are retained for at least [RETENTION_YEARS, e.g., 7] years, or longer if litigation, audit, or regulation requires, consistent with the Document Retention Policy. Access is restricted to authorized investigators, counsel, and committee leadership.

---

10. Training and Culture

[ORG] shall provide training on this Policy to employees at hire and at least [ANNUALLY], and orient new directors to Board-level escalation paths. The CEO and Board Chair shall periodically reaffirm, in writing, that good-faith reporting is expected and protected.

---

11. No Limitation on Legal Rights

Nothing in this Policy limits any person’s right to report possible violations of law to a government agency, to participate in investigations, or to receive whistleblower awards where available. This Policy does not require prior notice to [ORG] before contacting regulators where law permits direct reporting.

---

12. Policy Administration

Questions: [COMPLIANCE_CONTACT]. Material amendments require Board approval upon Audit Committee recommendation. Next review: [NEXT_REVIEW_DATE].

---

Appendix — Reporter checklist

• What happened? When? Where? Who was involved?
• How did you learn of it? Are there documents, emails, or systems to preserve?
• Is there ongoing risk of harm or spoliation?
• Have you reported elsewhere? Any fear of retaliation?
• Preferred contact method / anonymity preference