Whistleblower Protection Policy

Whistleblower Protection Policy

Produces a board-adoptable whistleblower policy with fill-in placeholders and U.S. compliance guardrails for public, private, and nonprofit entities.

Quick Start

Gather before drafting:

1. Org profile — legal name, entity type (public/private/nonprofit), governing state, reporting contacts.
2. Statute applicability — SOX, Dodd-Frank, OSHA, False Claims Act, state statutes.
3. Governance stack — existing code of conduct, handbook, grievance/investigation policies.
4. Administration model — who receives reports, investigates, and oversees outcomes.
5. Channel preferences — email, portal, hotline, written/verbal; tone and length targets.
6. Adoption mechanics — signatory roles, effective-date process, review cadence.

If any input is missing, emit a short clarifying checklist before drafting.

Policy Sections (fixed order)

Required Placeholders

Use exactly these tokens:

• [Organization Name], [State of Formation], [Board Chair], [Executive Director/CEO]
• [Primary Contact], [Alternative Contact], [Hotline URL/Number]
• [Adoption Date], [Effective Date], [Review Cycle]

Citation Discipline

• Reference statutes only when clearly supported by entity type and jurisdiction.
• Tag uncertain scope with [VERIFY] and request jurisdictional confirmation.
• Always verify: SOX §806 applicability, Dodd-Frank retaliation channels, OSHA/state overlap.

Output Format

• Numbered sections with clear headings.
• Prose-first; bullets only where needed (max 5 per section).
• End each section with implementation-ready fill-ins, not drafting notes.
• Close with signature block for Board Chair and CEO/Executive Director.

Pitfalls & Checks

• Never state that internal reporting is a legal prerequisite for external agency filing.
• Branch public-company vs. nonprofit/private language where statute relevance differs.
• Distinguish anti-frivolous-reporting language from negligent or honest mistakes.
• Protect good-faith reporters regardless of substantiation outcome.
• Set explicit confidentiality limits: need-to-know, lawful disclosure, legal process, audit/defense.
• Require annual or semiannual review, training completion, and board reporting metrics.
• End with disclaimer: "This policy is internal guidance and does not replace legal counsel for specific rights."