HR Policies
legal
Whistleblower Protection Policy
SOX + Dodd-Frank-aligned whistleblower protection. Confidential channels, anti-retaliation, investigation.
Built for:
Public Companies
Healthcare
Financial Services
All
What's inside this template
Purpose
-
[Company] is committed to maintaining the highest standards of business conduct. This policy enables employees, contractors, and other stakeholders to report suspected illegal, unethical, or improper conduct without fear of retaliation.
Reportable Concerns
-
Examples include: violations of law (securities, anti-bribery, healthcare, environmental), fraud, accounting irregularities, harassment or discrimination, retaliation, threats to safety, conflicts of interest, and material policy violations. Concerns about routine HR matters should go through the standard HR channels first.
Reporting Channels
-
Multiple confidential channels are available: (a) the 24/7 ethics hotline operated by an independent third party (anonymous accepted); (b) Legal; (c) the Audit Committee Chair (for accounting / SOX matters); (d) any HR representative or manager.
Confidentiality
-
Reports are kept confidential to the extent possible consistent with conducting a thorough investigation and complying with the law. The identity of the reporter is shared only with those who need to know. Anonymous reports are accepted but harder to investigate.
Anti-Retaliation
-
Retaliation against anyone who reports a concern in good faith — even if the concern proves unfounded — is strictly prohibited and itself a serious violation. Retaliation includes termination, demotion, suspension, harassment, and any other adverse action. Federal law (SOX §806, Dodd-Frank §922) provides additional protections including monetary recovery.
Investigation
-
All credible reports are investigated promptly. Significant matters involving accounting, securities law, or executive misconduct are reported to the Audit Committee. Investigations are typically completed within 60 days; complex matters may take longer with periodic updates to the reporter.
Consequences for Bad-Faith Reports
-
Knowingly false or malicious reports are themselves a Code violation. However, this does NOT include reports that turn out to be unfounded — only reports made in bad faith. Employees should report what they reasonably believe to be a concern; that is always protected.
Common use cases
Public-company compliance
Audit committee oversight
Ethics infrastructure
Frequently asked questions
What if my manager is the one violating policy?
Bypass them. Use the ethics hotline, Legal, or any HR representative. The investigation process protects you from your manager learning who reported.
Can I report to the SEC instead of the company?
Yes — Dodd-Frank §922 protects employees who report securities violations directly to the SEC, including potential monetary awards. We encourage internal reporting first so the company can address concerns, but you have the right to go directly to regulators.
Related templates
Ready to use this template?
Get started with MangoApps and use Whistleblower Protection Policy with your team — pricing built for small business.
