Whistleblower Pakistan

Standard Operating Procedure: Whistleblower Pakistan

1. Document Control & Revision History

---

2. Executive Summary & Scope

2.1 Clinical Statement of Operational Boundaries

This Standard Operating Procedure (SOP) defines the institutionalized framework for receiving, logging, triage, investigation, and remediation of disclosures submitted via the 'Whistleblower Pakistan' intake mechanism. The operational boundary encompasses all legal entities, joint ventures, and operational footprints within the Islamic Republic of Pakistan.

2.2 Regulatory Standards & Jurisdictional Compliance

The procedures detailed herein are engineered to align with, enforce, and maintain strict adherence to:

• The Prevention of Electronic Crimes Act (PECA), 2014/2016 (Pakistan).
• The National Accountability Ordinance (NAO), 1999 (where applicable to public-private interfaces).
• ISO 37002:2021 (Whistleblowing management systems — Guidelines).
• Applicable corporate governance codes mandated by the Securities and Exchange Commission of Pakistan (SECP).

All data handling must preserve chain-of-custody, guarantee whistleblower anonymity where legally protected, and eliminate the risk of retaliatory administrative or civil exposure.

---

3. Prerequisites & Tool Requirements

Execution of this SOP requires dedicated operational infrastructure, software access, and strict certification prerequisites:

• Software & Systems Access:
  • Tor-enabled air-gapped intake portal or Zero-Knowledge Encryption (ZKE) whistleblowing software (e.g., GlobaLeaks or customized secure drop).
  • Enterprise Governance, Risk, and Compliance (GRC) platform with restricted Role-Based Access Control (RBAC).
  • FIPS 140-2 Level 3 compliant encrypted storage drives for evidence archiving.
• Physical & Network Security:
  • Dedicated, isolated investigation terminal disconnected from the general corporate Local Area Network (LAN).
  • Hardware Security Modules (HSMs) for cryptographic key management.
• Personnel Certifications:
  • Certified Fraud Examiner (CFE) credential or equivalent forensic investigation certification.
  • Mandatory clearance on institutional Information Security and Privacy Protection modules.
  • Background vetting compliant with local Pakistani security clearance standards.

---

4. Roles & Responsibilities (RACI Matrix Table)

---

5. Step-by-Step Operational Procedure

Phase 1: Intake & Secure Cryptographic Logging

• Receive incoming disclosure via the encrypted digital drop, secure telephony, or physical drop-box.
• Verify that no metadata tracking pixels, IP addresses, or identifying markers are logged onto standard corporate servers.
• Assign a unique, pseudonymous Case Reference Number (CRN) using a pseudo-random generator.
• Input the encrypted case file into the GRC platform, restricting access exclusively to the WIO and EIL.
• Dispatch an automated, encrypted acknowledgment receipt to the whistleblower via the secure communication channel within 24 business hours.

Phase 2: Preliminary Triage & Risk Assessment

• Conduct an initial assessment of the disclosure within 48 hours of intake to determine credibility, specificity, and jurisdiction.
• Categorize the nature of the allegation (e.g., Financial Fraud, Bribery/Corruption under the NAB Ordinance, Workplace Harassment, Data Breach under PECA).
• Evaluate immediate risks to organizational assets, physical safety of personnel, or ongoing regulatory investigations.
• Draft a Triage Memorandum outlining the recommendation to either dismiss (due to lack of substantive evidence) or escalate to a Full Formal Investigation.
• Submit the Triage Memorandum to the Head of Internal Audit (HIA) for formal sign-off.

Phase 3: Investigation Execution & Evidence Preservation

• Convene the investigative team (EIL and assigned forensic specialists) upon HIA approval.
• Establish a secure physical and digital Evidence Locker, recording all artifacts with SHA-256 cryptographic hashes.
• Conduct witness interviews and digital forensic collection in strict accordance with Pakistani evidentiary standards (Qanoon-e-Shahadat Order, 1984).
• Maintain an unalterable Investigation Log detailing every action, review, and access event.
• Draft the comprehensive Investigation Report, detailing findings, supporting evidence, and systemic vulnerabilities identified.

Phase 4: Remediation, Closure & Feedback Loop

• Submit the final Investigation Report to the Chief Compliance Officer (CCO) and Board Audit Committee (BAC).
• Formulate a Corrective and Preventive Action (CAPA) plan for any validated operational or compliance failures.
• Execute disciplinary, legal, or administrative remediation as directed by executive leadership and Legal Counsel.
• Transmit a secure, status-update message to the whistleblower via the pseudonymous channel confirming that the matter has been addressed, maintaining strict confidentiality regarding specific personnel actions.
• Archive the case file in encrypted cold storage, setting automated retention expiration timelines in compliance with statutory requirements.

---

6. Quality Assurance & Verification Criteria

To ensure institutional rigor, all closed cases must undergo periodic quality audits measured against the following parameters:

• Audit Checklist:
  • Intake logs stripped of all Personally Identifiable Information (PII) unless explicitly authorized by the submitter.
  • Chain of custody forms completed and signed off for 100% of digital and physical evidence items.
  • CAPA plan generated and assigned to a specific operational owner within 10 business days of report finalization.
• Tolerance Thresholds:
  • Intake Acknowledgment SLA: $\le 24$ hours (Zero tolerance for breach).
  • Triage Assessment SLA: $\le 48$ hours.
  • Evidence Hash Mismatch: 0 tolerance; any cryptographic hash discrepancy triggers an immediate security lockdown of the case file.
• Acceptance Benchmarks:
  • 100% compliance with internal data privacy rules and PECA data protection guidelines.
  • Zero documented instances of whistleblower retaliation attributable to operational leaks from the compliance channel.

---

7. Practical Troubleshooting Scenarios

Scenario A: Whistleblower Alleges Retaliation by Local Senior Management

• Trigger: A submitter reports via the secure portal that their direct supervisor in the Lahore regional office has reallocated their duties and threatened termination following an informal query.
• Immediate Corrective Action Protocol:
  1. WIO flags the case as high priority and immediately notifies the CCO and Legal Counsel.
  2. Issue an administrative protective order directing local management to halt all personnel actions concerning the whistleblower pending review.
  3. Relocate the whistleblower functionally or geographically (with their consent) to a neutral operational unit or grant paid administrative leave with guaranteed salary protection.
  4. Initiate an expedited independent investigation into the retaliation claim under the direct oversight of the HIA.

Scenario B: Cryptographic Channel Disruption or Access Lockout

• Trigger: The whistleblower loses their generated private access key/CRN and attempts to contact the institution via insecure corporate email to check on their case status.
• Immediate Corrective Action Protocol:
  1. Instruct the individual not to transmit any further details over unsecured communication channels.
  2. Advise the user to re-establish contact via the Tor intake portal using the secure recovery mechanism (if pre-configured) or initiate a new secure submission referencing previous generalized context markers safely.
  3. Ensure the operational team does not link the unsecured email identity to the active pseudonymous case file in any permanent system records to preserve forward secrecy.

Scenario C: Receipt of Vague or Maliciously False Allegations

• Trigger: An intake submission contains generalized, unverifiable accusations against a department head without corroborating documentation or actionable specifics.
• Immediate Corrective Action Protocol:
  1. Process the intake through standard Phase 1 and Phase 2 protocols without prejudice.
  2. Issue a secure request through the portal for specific, corroborating evidence within a 7-day window.
  3. If no supplementary evidence is provided and initial triage indicates bad-faith disruption, document the findings in the Triage Memo and recommend administrative closure due to insufficient verifiable basis, retaining the record in cold storage for audit defense.