Whistleblower Policy Template for Indian Companies

A whistleblower policy lets employees, and often vendors and customers, report serious wrongdoing such as fraud, bribery, theft, data leaks, safety violations or falsified records without fear for their job. It names channels that bypass the normal reporting line, allows anonymous reports, and promises that the reporter's identity will be protected and the matter properly investigated.

When to use it: Adopt it once the company handles significant money, customer data or regulated work, and certainly before raising investment or listing. The board or managing director approves it, and an audit committee chair or independent director usually oversees it. Check with your company secretary whether company law requires your company to set up a vigil mechanism.

Whistleblower policy template

Copy the text below and replace everything in square brackets with your company details.

1. Purpose

[Company Name] wants to hear about wrongdoing early. This policy provides safe channels to report genuine concerns about unethical, illegal or unsafe conduct, and protects everyone who reports in good faith.

2. Scope

Employees at every level, directors, trainees, contract staff, vendors and customers may use this policy to report concerns such as:

Fraud, theft, embezzlement or misuse of company funds or assets.
Bribery, kickbacks or other improper payments.
Falsified accounts, attendance, production, quality or compliance records.
Leaks or misuse of customer, employee or confidential business data.
Serious safety, health or environmental violations.
Breaches of law, regulation or the Code of Conduct by any employee or director, or deliberate concealment of any of the above.

Personal grievances about pay, appraisal or working conditions belong under the Grievance Redressal Policy, and complaints of sexual harassment under the POSH Policy.

3. Definitions

Whistleblower: a person who reports a concern under this policy in good faith.
Protected disclosure: a report made in good faith containing information that suggests possible wrongdoing.
Ethics officer: [Name, Designation], who receives and manages reports. Reports concerning the ethics officer, the managing director or any director go to [Audit Committee Chair or Independent Director Name].

4. Policy

Channels: email to [Ethics Email Address], a sealed letter marked confidential to [Postal Address], or [Phone Number or Hotline, if any].
Anonymous reports are accepted. Dates, names, amounts and copies of documents make it possible to investigate without knowing who reported.
The whistleblower's identity is shared only with those who must know it to investigate, and with the whistleblower's consent unless the law requires disclosure.
No whistleblower will be dismissed, demoted, transferred, denied an increment, harassed or otherwise disadvantaged for a report made in good faith, even if the concern is not proved.
A person who knowingly makes a false report in order to harm someone may face disciplinary action.

5. Procedure

The ethics officer acknowledges the report within [Number] working days wherever a contact is available.
A preliminary review decides whether the report falls under this policy and has enough detail to investigate.
An investigator with no link to the matter is appointed. Where the concern involves senior management, [Audit Committee Chair or Independent Director] appoints an external investigator.
The person under investigation is told of the allegation at a suitable stage and given a chance to respond.
No employee may destroy or alter records connected to an open investigation.
Findings and recommended actions go to [Managing Director or Audit Committee]. The whistleblower is told when the matter is closed, as far as this is possible without breaching the confidentiality of others.
Reports and investigation files are kept securely for [Number] years.

6. Responsibilities

Board or audit committee: oversee the mechanism and review its reports.
Ethics officer: receive reports, protect identities, arrange investigations and track actions.
Managers: pass on any report they receive at once, and never try to find out who made an anonymous report.
Employees: cooperate with investigations and keep their details confidential.

7. Exceptions

This policy does not replace any legal duty to report a matter to the authorities, and it does not stop anyone from approaching a regulator or the police directly.

8. Review

Every [6] months the ethics officer reports the number and type of reports, and their outcomes, to [Board or Audit Committee] without naming whistleblowers. The policy is reviewed every [24] months.

What to include

Channels outside the reporting line

Give at least one route that bypasses the managing director and the HR head, such as an independent director or the audit committee chair. Serious concerns sometimes involve senior people.

Anonymity that still works

Accept anonymous reports and tell reporters what detail helps: dates, names, amounts and documents. A vague anonymous note is hard to act on, while a detailed one often is not.

Retaliation spelt out

List the acts that count as retaliation, such as dismissal, demotion, transfer, denial of increment or harassment, so that protection is concrete rather than a general promise.

Good faith, not proof

Protect anyone who reports honestly, even if the concern turns out to be unfounded. Only knowingly false reports made to harm someone should attract action.

Independent investigation

Never let the accused person's own department investigate. For matters involving senior management, use an external investigator appointed by the independent overseer.

Closure message to the reporter

Tell the whistleblower when the matter is closed. People who never hear back conclude that nothing happened and stop reporting.

Common mistakes to avoid

Making the HR head or the finance head the only channel when either may be the subject of a report.
Trying to trace an anonymous reporter through email headers, handwriting or CCTV.
Letting the accused person's department run the investigation.
Allowing the channel to fill up with pay complaints because grievances were never given their own route.
Circulating details of an investigation on email to a large group of managers.

Run it in ZeniaHR

ZeniaHR is not a whistleblowing channel, so keep reports and investigation files with the ethics officer, outside HR records. Publish the policy and the reporting contacts on the Company Wall as a pinned announcement that requires acknowledgement. When an investigation touches attendance or pay, the records hold up: finalized payroll runs are sealed and read-only, approved corrections keep the original punches, and Access Control can give an investigator the ready Auditor role to view and export reports.

Policy settings Employee documents

See it on your own data

A 30-minute demo on a video call. We set up your departments, shifts and leave rules and show attendance, leave and payroll running for your team. Free for your first 50 employees.

Book a free demo See pricing

Frequently asked questions

What is a whistleblower policy in a company?

A whistleblower policy is a written mechanism that lets employees and others report serious wrongdoing, such as fraud, bribery, data misuse or safety violations, through channels outside the normal chain of command. It protects the reporter's identity, forbids retaliation against anyone reporting in good faith, and sets out how reports are investigated and closed.

Can a whistleblower complaint be anonymous?

Yes, most policies accept anonymous reports, and some people will only report that way. The report should carry enough detail to investigate without follow-up questions: what happened, when, who was involved, amounts, and where documents can be found. Offering a way to reply anonymously, such as a separate email address, helps the investigator ask for more.

Who should receive whistleblower reports?

Reports should go to someone independent of day-to-day management, such as an ethics officer with a direct line to the board, an independent director or the audit committee chair. Provide at least one channel that bypasses the managing director and the HR head, because serious concerns sometimes involve them.

What protection does a whistleblower get?

Under a good policy, a whistleblower who reports in good faith cannot be dismissed, demoted, transferred, denied increments or harassed because of the report, even if the concern is not proved, and their identity is kept confidential. Managers who retaliate face disciplinary action. Only a knowingly false report made to harm someone can lead to action against the reporter.