Whistleblower Policy Template: Free PDF and Sample Clauses

An engineer notices that the revenue figure in an investor update does not match the billing system. The only person she could tell is the CEO who approved the number. Nothing written says where else she can go, or what happens to her if she speaks up.

That gap is what a whistleblower policy template exists to close, and it is the question a customer's security questionnaire or a SOC 2 auditor will eventually ask: "Do you have a whistleblower policy?"

A whistleblower policy is a written commitment that anyone who works for or with a company can report suspected fraud, legal violations, or security misconduct through a defined channel, that someone independent of the matter will investigate, and that the reporter will not be punished for raising a concern in good faith. A good whistleblower policy template also says which laws bind you today and what evidence you can show.

Quick answer A whistleblower policy needs eight sections: purpose and scope, protected reports, reporting channels, confidentiality and anonymity, anti-retaliation, investigation, roles and independence, and records and review. For a private startup, no statute requires one. The SOC 2 audit and your enterprise buyers are the real drivers. Our recommended defaults: two reporting routes, acknowledgment within five business days, and a case log from day one.

By the end of this guide you will have a free, ungated template with real sample clauses, a clear picture of which laws apply at your stage, and the evidence list auditors actually sample.

Here's what I'll cover:

What a whistleblower policy is, and how it differs from your code of conduct
Which laws apply to a private startup, an EU team, a pre-IPO company, and a company handling health data
What every whistleblower policy template must include
How to set up reporting channels, including the anonymous reporting hotline question
An anti-retaliation clause and an investigation procedure you can run
The confidentiality-agreement mistakes that undercut your policy
What SOC 2, ISO 27001, SOX, HIPAA, and the EU directive expect
The audit evidence to keep, and a free PDF with sample clauses

What Is a Whistleblower Policy Template, and What Does It Not Cover?

A whistleblower policy template is a ready-to-adapt document that tells people how to raise a concern about wrongdoing, who receives it, how it is investigated, and what protects the person who raised it. It is a policy, not a hotline vendor and not an investigation. The policy is the promise. The channel and the case log are how you keep it.

That distinction matters in an audit. The policy says reports go to two named owners. The test report, the access list, and the case log show it working.

Whistleblower Policy Template vs Code of Conduct, HR Security Policy, and HIPAA Violation Reporting

Three existing documents sit close to this one. ComplyJet's code of conduct policy guide sets behavior standards. The HR security policy guide covers screening, onboarding, and discipline. The HIPAA violation report guide explains how to report a covered entity to HHS.

This article is the internal reporting-channel and protection policy that sits beside them.

Document	The question it answers	Who usually owns it
Code of conduct	What behavior is expected and what is not allowed?	HR or the founder
HR security policy	How do we screen, onboard, train, and discipline people?	HR
HIPAA violation reporting	How does someone report a covered entity to the regulator?	The reporter, with counsel
Whistleblower policy	Where do I take a concern, and what protects me when I do?	Compliance lead plus a board or outside contact

Note The conduct policy says what is not allowed. This policy says where to take it and what protects you when you do. Adopt them together and let each point to the other.

Whistleblower Policy for Startups: Which Laws Apply Before You Adopt a Template

Does a private startup need a company whistleblower policy at all? Usually no statute says so. The pressure comes from elsewhere, and the legal picture changes at four points in a company's life.

Your situation	What actually applies	What it means for the policy
Private startup, US-only team	No federal statute requires a written policy. SOC 2 auditors and customers still ask for one	Adopt it for the audit and the questionnaire
50 or more employees in the EU	EU Directive 2019/1937: an internal reporting channel, acknowledgment within seven days, feedback within three months	Build the channel and the clocks into the policy. National laws differ
Preparing an IPO	SOX Sections 301 and 806 become live once you are a listed company	Plan the audit committee procedure now
Handling protected health information	HIPAA protects workforce whistleblower disclosures and bars retaliation	Reference it in the protected-reports section
Any employer	SEC Rule 21F-17 and the DTSA notice rule limit what your agreements may say	Check your NDAs, covered below

Quick take For most private startups, the real drivers are the SOC 2 audit and the enterprise questionnaire, not a statute. That is a good reason to write the policy, not a reason to skip it. Buyers use it as a signal that someone besides the founder can hear bad news.

Vanta's help center calls a whistleblower policy "essential for compliance with SOC 2 requirements" but names no criterion. We map it to the right criterion below, so you know what you are actually being tested on.

SOC 2

Preparing for SOC 2?

Auditors sample your policies, your channels, and your records. See how ComplyJet takes a startup from first policy to SOC 2 audit.

Explore SOC 2

What a Whistleblower Policy Template Must Include

Eight sections cover everything an auditor, a buyer, or an employee will look for. Brackets in the PDF mark the values you set.

#	Section	What it settles
1	Purpose and scope	Why the policy exists and who it covers
2	Protected reports	What counts as a reportable concern
3	Reporting channels	Where to report, with at least two routes
4	Confidentiality and anonymity	What is protected, and what cannot be promised
5	Anti-retaliation	What retaliation is, and what happens to retaliators
6	Investigation	Who investigates, how fast, and how it closes
7	Roles and independence	Who owns the policy and who steps aside on a conflict
8	Records and review	What you keep, for how long, and when you revisit

Whistleblower Policy for Employees: Who Is Covered and What Counts as a Protected Report

A policy that protects only employees leaves gaps. Name employees, contractors, interns, board members, vendors, and former employees. Each can see wrongdoing that a full-time employee never will.

Reportable matters should be listed, not implied: fraud, financial misstatement, security misconduct, misuse of customer data, bribery, and violations of law. Harassment and discrimination can be included with a pointer to the HR process.

The standard is a reasonable, good-faith belief, not proof. People who turn out to be wrong are still protected. People who knowingly lie are not.

Three-column diagram: who can report (employees, contractors, vendors, board members), what can be reported (fraud, security misconduct, data misuse, legal violations), and where it goes (primary owner or second route).

Pro tip Write the reasonable-belief standard in plain words in the policy itself: "You do not need proof. You need a good-faith concern." People who hesitate to report are usually afraid of being wrong, and that sentence answers the fear directly.

Reporting Channels in a Whistleblower Policy Template: The Anonymous Reporting Hotline Question

The most important design choice in the whole policy is where reports go. If the answer is "to HR," ask what happens when HR is the subject.

A commenter on Hacker News, writing in May 2023, described sending a concern through a company hotline and email address. It went to the very hiring manager and director involved. The commenter's verdict: "None of these hotlines or whistleblower mailboxes work as intended." That is the failure your channel design has to prevent.

Confidentiality vs Anonymity

These are different promises, and the policy should make only the one you can keep.

Confidential: the receiver knows who you are and protects it.
Anonymous: the receiver never learns who you are.

Anonymity is easy to promise and hard to deliver. Another Hacker News commenter, in June 2024, put the risk bluntly: when one person reports a rare problem, "Everyone knows it is reported by person A." In a 20-person company, the details of a report can identify the reporter even when the channel hides the name.

Choosing a Channel

Channel	Cost	Anonymity	Evidence quality	When it fits
Shared inbox (for example ethics@)	Free	Weak: the sender's address is visible	Good: an email trail	A starting point, never the only route
Web form routed to two named people	Free to low	Moderate: depends on the form tool	Good: structured fields	Most startups under 50 people
Third-party hotline vendor	Paid, usually subscription	Strong: an outside party takes the report	Good: case records	Larger teams, EU staff, or distrust of internal routes

Every company needs two routes, so a report about the primary owner has somewhere else to go. The second route can be a board member, an advisor, or outside counsel.

Watch out An email address that exposes the sender's identity is not anonymous. If your policy says reports can be anonymous, test the channel yourself and check what the receiver actually sees.

Flow diagram: a report enters through the intake owner or a second route; reports about the intake owner go to the board member or outside counsel; all routes feed one case log.

Whistleblower Anti-Retaliation Policy Template Clause: What to Write

A whistleblower anti-retaliation policy is only credible if retaliation is defined. List what counts: termination, demotion, pay changes, schedule or access changes, exclusion from meetings, and a sudden poor review. Subtle changes count.

The fear is not imaginary. A November 2023 survey of 280 UK software engineers, run by the software consultancy Engprax and polled by Survation, found that 75% of those who had reported wrongdoing faced retaliation the last time they did. It is a small, company-run survey, so treat the number as a signal rather than a benchmark.

Documentation matters for the company too. Under SOX Section 806, an employee only has to show the protected report was a contributing factor in the adverse action. The Supreme Court held unanimously in Murray v. UBS Securities (February 2024) that the employee does not have to prove retaliatory intent. The employer must then show by clear and convincing evidence that it would have made the same decision anyway.

That is a high bar to meet without records. A paper trail for every employment decision involving a reporter is your protection.

What the Clause Should Cover

Manager duties: managers who receive a report pass it on within one business day and do not investigate it themselves
No identification attempts: nobody tries to work out who made an anonymous report
Discipline: retaliation is itself a violation, up to termination
A route for retaliation concerns: the same channels accept a report that retaliation is happening

Sample whistleblower anti-retaliation policy clause [Company] prohibits retaliation against anyone who reports a concern in good faith or who takes part in an investigation. Retaliation includes dismissal, demotion, reduced pay or hours, changes to access or responsibilities, exclusion, threats, and harassment. Anyone who retaliates is subject to discipline up to and including termination. A person who believes they have faced retaliation may report it through any channel in this policy.

Customer Story

"It made SOC 2 and ISO 27001 readiness clear and manageable with automated workflows, evidence collection, and expert support."

David Orr, COO, Romina Day

Read customer stories

Whistleblower Investigation Procedure for Your Policy Template: Intake to Closure

A reporter who hears nothing assumes nothing is happening. A whistleblower investigation procedure fixes that with a fixed sequence and clocks.

Acknowledge the report, and say what happens next.
Log it with a case ID.
Check for conflicts. Does the report name the intake owner, a manager, or a founder?
Triage by severity: fraud and legal exposure first.
Assign an investigator who is independent of the matter.
Interview and collect evidence, keeping the reporter's identity need-to-know.
Decide whether the concern is substantiated.
Remediate the issue and any harm to the reporter.
Close the case with a written summary.
Give feedback to the reporter, as far as confidentiality allows.

Five-stage investigation timeline: acknowledge, log, triage, investigate, close, with the conflict check and reporter feedback marked.

Every case gets a row in a log. This is what an auditor will ask to see.

Field	What it records
Case ID	A unique number, never the reporter's name
Date received and channel	When and how the report arrived
Category and severity	Fraud, security, harassment, and so on, with a priority
Owner and conflict check	Who investigates, and confirmation they are independent
Status and outcome	Open, substantiated, not substantiated, or referred
Retention date	When the record may be destroyed

When a report names a founder or the intake owner, it skips them entirely and goes to the second route. The policy should say that in so many words.

Time targets For a private company, acknowledge within five business days. The EU directive sets seven days to acknowledge and three months to give feedback, so use those clocks if you have EU staff. Security reports can run through your incident management policy and incident response plan in parallel.

Try this yourself File a test report this quarter through every channel in your policy. Time how long each step takes, note what the receiver can see, and keep the record. It is the cheapest evidence you can collect, and it shows whether the process works.

Confidentiality Agreements That Undercut Your Whistleblower Policy Template

A flawless policy can be undone by one sentence in an employment agreement. Two federal rules apply to every US employer, public or private.

SEC Rule 21F-17: Do Not Gag Reports to Regulators

Rule 21F-17(a) says no person may take any action to impede an individual from communicating directly with SEC staff about a possible securities law violation, including enforcing or threatening to enforce a confidentiality agreement.

The SEC has enforced it. In April 2015, the agency fined KBR $130,000 because its internal-investigation forms warned witnesses that discussing matters outside the company without "prior approval of KBR's legal department" could lead to discipline.

So NDAs, separation agreements, and employment agreements all need a carve-out. The employee may report possible violations to a government agency, and does not need company permission to do so.

DTSA Immunity Notice: The Sentence Your Employment Agreement Needs

The Defend Trade Secrets Act adds a separate duty. Under 18 U.S.C. 1833(b)(3), an employer must give notice of whistleblower immunity for trade-secret disclosures in any agreement that governs confidential information. A cross-reference to a policy that sets out the reporting procedure satisfies the rule.

The penalty for skipping it is real. The employer cannot be awarded exemplary damages or attorney fees in a trade-secret action against that employee.

Sample clause: Confidentiality carve-out Nothing in this agreement or any [Company] policy prevents you from reporting possible violations of law to a government agency, including the Securities and Exchange Commission, or from cooperating in an investigation, and you do not need [Company]'s permission or notice to do so. Under 18 U.S.C. 1833(b), you will not be held liable under any trade secret law for disclosing a trade secret in confidence to a government official or an attorney solely to report or investigate a suspected violation of law, or in a sealed court filing. See the [Company] Whistleblower Policy for how to raise concerns internally.

Note This section is general information, not legal advice. Have employment or securities counsel review your agreements and the final policy before you publish it.

Whistleblower Policy Template Requirements by Framework: SOC 2, ISO 27001, SOX, and HIPAA

No framework has a control called "whistleblower policy" for private startups. Each touches it from a different angle.

Framework	Where it lives	What it says	How it is tested
SOC 2	CC2.2, with CC1.1 and CC2.3 nearby	Separate communication lines such as whistle-blower hotlines, as a fail-safe	Channel exists, is reachable, and employees know it
ISO 27001:2022	Annex A 6.8, 5.24 to 5.26, 6.4, 5.34	Event reporting, incident handling, discipline, privacy of personal data	Policy, records, Statement of Applicability
SOX	Sections 301 and 806	Audit committee complaint procedures, anti-retaliation	Public companies: procedures and retaliation controls
HIPAA	45 CFR 164.502(j) and 164.530(g)	Workforce whistleblower disclosures, no retaliation	Policies, training, complaint handling

Whistleblower Policy SOC 2: CC2.2 Independent Communication Lines for Your Template

The SOC 2 criterion that carries this is CC2.2, internal communication of information, including objectives and responsibilities for internal control. A point of focus mapped to it, "Provides Separate Communication Lines," says separate communication channels such as whistle-blower hotlines should be in place as fail-safe mechanisms. CC1.1 (integrity and ethical values) and CC2.3 (external communication) sit nearby.

Points of focus are guidance, not separate requirements. A hotline is not mandatory. A reachable, known channel that works is.

In a Type II audit, the reviewer checks that the channel exists, can be reached, and that people were told about it. Our SOC 2 compliance checklist shows where this evidence fits in the wider program.

Whistleblower Policy ISO 27001: Event Reporting and Disciplinary Controls for Your Template

For a whistleblower policy ISO 27001 auditors will read, four Annex A controls apply. Control 6.8 covers information security event reporting: staff need a simple, accessible way to report events promptly. Controls 5.24 to 5.26 cover incident management. Control 6.4 covers the disciplinary process, and 5.34 covers privacy and protection of personal data, which matters when a report contains it.

ISO 37002:2021 is separate guidance for whistleblowing management systems, built on trust, impartiality, and protection. It is a useful reference, not an ISO 27001 requirement. Our ISO 27001 checklist covers the rest of the controls.

Whistleblower Policy SOX: Audit Committee Complaint Procedures and IPO Readiness

SOX does not bind a private startup today, so a whistleblower policy SOX reviewers would accept is a pre-IPO upgrade rather than a current duty. It becomes live the day you list.

Section 301, implemented through SEC Rule 10A-3(b)(3), requires the audit committee of a listed company to set up audit committee complaint procedures: a way to receive, retain, and handle complaints about accounting, internal controls, and auditing matters, including confidential, anonymous submission by employees.

Section 806 (18 U.S.C. 1514A) bars retaliation against employees of public companies who report reasonably believed securities fraud. The filing window with OSHA is 180 days.

For a startup, the practical step is to write your policy so that a board member or independent advisor already holds the second route. Then the IPO upgrade is a change of owner, not a rewrite. Our guides to what SOX compliance is and SOC 2 vs SOX cover the rest.

HIPAA and the EU Directive: Workforce Disclosures and Whistleblower Policy EU Directive Duties

HIPAA protects a workforce member who discloses protected health information in good faith to a health oversight agency or to an attorney, under 45 CFR 164.502(j)(1). Covered entities also may not retaliate against people who file complaints, under 164.530(g).

The EU Whistleblower Directive (2019/1937) is the one most US startups miss. If you employ 50 or more people in the EU, the directive's rules on internal channels apply, including acknowledgment within seven days and feedback within three months. The compliance date for companies with 50 to 249 workers was 17 December 2023, and national laws differ in detail, so check the countries where your staff sit.

Why move fast internally? Under the SEC's whistleblower program, a reporter can receive 10% to 30% of sanctions above $1 million, which gives people a reason to go outside the company if the inside route fails.

Whistleblower Policy Template: A Free Example You Can Download

Here is what a whistleblower policy example looks like as clauses you can adapt. Brackets mark the values to set for your own company.

Whistleblower Policy Example: Sample Clauses You Can Adapt

Sample clause: Purpose [Company] is committed to honest, lawful conduct. This policy gives anyone who works for or with [Company] a safe way to raise concerns about suspected wrongdoing, and it commits [Company] to investigate those concerns fairly and to protect the people who raise them.

Sample clause: Who can report This policy applies to employees, contractors, interns, board members, advisors, vendors, and former personnel. You do not need proof of wrongdoing. A good-faith, reasonable belief is enough, and you will be protected even if the concern turns out to be mistaken.

Sample clause: How to report You may report to [Compliance Lead] at [address or form link], or to [Board Member or Outside Counsel] at [address] if the concern involves [Compliance Lead] or senior leadership. You may report in writing or by asking for a conversation.

Sample clause: Confidentiality and anonymity Your identity will be shared only with those who need it to investigate. You may report anonymously through [form link]. Anonymous reports are reviewed with the same care, but we may be less able to investigate or give you feedback, and the facts of a report can sometimes reveal who made it.

Sample clause: Investigation and independence [Company] will acknowledge your report within [5 business days], assign an investigator who is independent of the matter, and give you feedback on the outcome within [90 days] where confidentiality allows. A person named in a report takes no part in handling it.

Free Template

Download the Free Whistleblower Policy Template (PDF)

All eight sections, a stage-by-stage requirements table, reporting channel options, an anti-retaliation clause, an investigation procedure with a case log, and framework notes for SOC 2, ISO 27001, SOX, and HIPAA.

Download PDF

Whistleblower Policy Sample Wording for the Employee Handbook

Handbooks and onboarding decks need a short, plain-language whistleblower policy for employees that people will actually read. Treat the wording below as a whistleblower policy sample you can paste in and adapt.

Sample wording: Employee handbook If you see something that looks wrong, such as fraud, a security problem, misuse of customer data, or a legal violation, tell us. You can speak to [Compliance Lead], or go to [Board Member] if it involves leadership. You can ask us to keep your name private, and you will not be punished for raising a concern in good faith. Read the full Whistleblower Policy at [link].

Rolling Out Your Whistleblower Policy Template and Proving It Works

A policy nobody has read is not a control. Rollout is a short sequence:

Approve the policy with a version number and a date.
Name the owners: the intake owner and the second route.
Set up the channels and test each one.
Distribute the policy and collect signed acknowledgments.
Train managers on what to do when someone brings them a concern.
Run a test report and keep the record.
Review annually, or after any case that exposed a gap.

Whistleblower Policy Template Evidence: What Auditors Sample

Evidence	What it proves
Approved policy with version and date	The policy exists and is current
Acknowledgment records	People were told
Channel screenshot or test report	The channel works and can be reached
Case log export	Reports are tracked, even if the log is empty
Closed-case summary with retention date	Cases reach an outcome and are kept on schedule
Manager training record	Managers know to pass reports on

Quick tip An empty case log is normal for a small company, but the auditor will ask how you know the channel works. A dated test report answers that question in one page.

Answering Customer Questionnaires About Your Company Whistleblower Policy

Buyers ask short questions: "Do you have a whistleblower policy? Is there an anonymous channel? Is retaliation prohibited?" Answer in a few lines and attach the policy.

Sample answer: Customer questionnaire Yes. [Company] maintains a Whistleblower Policy, approved [date] and reviewed annually. Personnel and contractors can report concerns through [two routes], including an anonymous form. Retaliation is prohibited and subject to discipline. Reports are logged and investigated by someone independent of the matter. The policy is available on request.

Measure what you promise with a few numbers that mean something: time to acknowledge, the share of cases closed within your target, and retaliation complaints received.

Whistleblower Policy Template Mistakes to Avoid

These are easy to get wrong, and each one shows up in audits and in real cases:

Reports routed to the person reported on. A single inbox owned by the founder fails the moment the concern is about the founder.
An email hotline that exposes identity. The policy promises anonymity, and the sender's address says otherwise.
Approved but never distributed. No acknowledgments, no training, no proof anyone has heard of it.
Gag clauses in NDAs. One sentence can breach SEC Rule 21F-17 and the DTSA notice rule.
No case log. A concern that is not logged cannot be shown, tracked, or closed.
Confusing the policy with the code of conduct. One sets behavior standards, the other protects people who report breaches of them.

As one commenter on Hacker News put it in November 2024, workplace HR ethics and whistleblower policies "are set up to protect the organization, not the person making the complaint." Your policy earns trust by proving the opposite.

How ComplyJet Helps With Your Whistleblower Policy Evidence

A whistleblower policy is quick to write and tedious to prove. The rules fit on three pages. The proof is a year of consistent behavior.

ComplyJet's policy management drafts policies with AI from a library of templates mapped to SOC 2, ISO 27001, HIPAA, and GDPR, lets you edit them before publishing, distributes them to your team, and tracks acknowledgments with a timestamp and a version history. Our security awareness training assigns courses when a new hire is added through your HR integration and keeps per-person completion records.

Your policy names the channels you choose, and they live in your own tools. ComplyJet holds the policy, the acknowledgments, and the training evidence beside everything else an auditor asks for.

Compliance Automation

Turn your whistleblower policy into audit-ready evidence

See how ComplyJet distributes policies, tracks acknowledgments, and records security training for SOC 2, ISO 27001, HIPAA, and GDPR.

Book a Demo

FAQs

What Should a Whistleblower Policy Template Include?

Eight sections: purpose and scope, protected reports, reporting channels, confidentiality and anonymity, anti-retaliation, investigation, roles and independence, and records and review. Add two reporting routes and a case log so the policy covers what happens when a report concerns the person who would normally receive it.

Is a Whistleblower Policy Required for SOC 2?

A whistleblower policy SOC 2 auditors will accept is not a named requirement: SOC 2 does not list a whistleblower policy as a required document. CC2.2 asks for internal communication of responsibilities, and a point of focus mapped to it describes separate communication lines such as whistle-blower hotlines as a fail-safe. In practice, auditors expect a reachable channel and evidence that people know it exists, and a written policy is the usual way to show both.

Does a Private Company or Startup Need a Whistleblower Policy?

No federal US statute requires a private company to have a written whistleblower policy, so a whistleblower policy for startups is driven by buyers and auditors. SOX Section 301 applies to listed companies, and the whistleblower policy EU directive rules apply to employers with 50 or more employees in the EU. Even so, SOC 2 auditors and enterprise customers commonly ask for one, so most startups adopt it anyway.

Do You Need an Anonymous Reporting Hotline?

Usually not. SOC 2 does not require an anonymous channel, and a confidential route to a named person with a second route for conflicts is acceptable. Public companies must allow confidential, anonymous submission about accounting matters, and larger or EU-based teams often choose a third-party hotline. Do not promise anonymity your channel cannot deliver.

Who Should Receive Whistleblower Reports?

At least two people who are independent of each other, such as a compliance lead and a board member or outside counsel. A report that names one of them goes to the other. Avoid routing reports only to the founder or to the manager of the person reporting.

How Long Should You Keep Whistleblower Records?

No single rule applies. Set a retention date in the policy and record it in each case file, with counsel's input, since limitation periods vary. For context, a SOX Section 806 retaliation complaint must be filed within 180 days, so keep records at least long enough to defend a claim brought in that window.

Can a Confidentiality Agreement Stop an Employee From Reporting to a Regulator?

No. SEC Rule 21F-17 prohibits enforcing or threatening to enforce a confidentiality agreement to impede someone from communicating with SEC staff. Add a carve-out to NDAs, separation agreements, and employment agreements, and include the DTSA immunity notice or a cross-reference to this policy.

Is There a Free Whistleblower Policy Template?

Yes. The PDF above is free and ungated: eight sections, sample clauses, a stage-by-stage requirements table, channel options, an investigation procedure with a case log, and framework notes. Adapt the bracketed values to your company and have counsel review the final version.