Whistleblowing Policy Template Charity

STANDARD OPERATING PROCEDURE: WHISTLEBLOWING POLICY IMPLEMENTATION & INCIDENT MANAGEMENT

Template Registry | Operations Architecture Division

---

1. DOCUMENT CONTROL BLOCK

• Document ID: SOP-TR-OPS-804
• Effective Date: October 24, 2023
• Version: 3.2
• Review Cadence: Annual
• Target Audience: Board of Trustees, Executive Leadership, Chief Operations Architect, Compliance Officers, HR Directors, and Legal Counsel within registered charities and non-profit entities.

---

2. EXECUTIVE SUMMARY & SCOPE

2.1 Clinical Statement of Operational Boundaries

This Standard Operating Procedure (SOP) defines the institutional requirements for establishing, maintaining, and executing a Whistleblowing Policy within registered charities. It governs the lifecycle of protected disclosures, ensuring strict alignment with statutory reporting obligations, anti-retaliation mandates, and fiduciary accountability standards.

2.2 Regulatory Standards & Applicability

This framework is architected to satisfy compliance frameworks across major jurisdictions, including:

• The Public Interest Disclosure Act (PIDA)
• The Sarbanes-Oxley Act (SOX) Section 301/806 (applicable to non-profits receiving US federal funds or grants)
• Charity Commission Governance Guidelines (e.g., CC27: It’s your decision: charity trustees and decision making)
• EU Directive on the Protection of Persons Who Report Breaches of Union Law (EU Whistleblowing Directive)

---

3. PREREQUISITES & TOOL REQUIREMENTS

3.1 Software & Infrastructure Access

• Secure Intake Portal: Encrypted, zero-knowledge digital drop-box for anonymous and confidential disclosures (e.g., Ethicspoint, Navex, or self-hosted PGP-encrypted systems).
• Case Management System (CMS): Role-based access-controlled database for tracking disclosure lifecycles with immutable audit logs.
• Dedicated Telephony: Encrypted, toll-free reporting hotline with transcription and archiving capabilities.

3.2 Certifications & Clearances

• Investigators: Certified Fraud Examiner (CFE) designation or equivalent legal/compliance credentials.
• Triage Officers: Annual completion of Anti-Bribery, Corruption (ABC), and Whistleblower Protection legislation training.

---

4. ROLES & RESPONSIBILITIES (RACI MATRIX TABLE)

---

5. STEP-BY-STEP OPERATIONAL PROCEDURE

Phase 1: Policy Customization & Institutional Deployment

• 1.1 Review template statutory references against local jurisdiction laws where the charity operates.
• 1.2 Customise designated reporting channels (Email, Hotline, Physical Mail, Web Portal) within Section 4 of the master policy document.
• 1.3 Secure formal adoption and sign-off by the Board of Trustees during a documented quorum meeting.
• 1.4 Publish the finalized policy within the staff intranet, volunteer handbooks, and the public-facing charity website footer.

Phase 2: Intake, Triage, and Initial Assessment

• 2.1 Receive disclosure via designated secure intake channel and generate a unique Case ID within the CMS.
• 2.2 Issue an automated or manual acknowledgment of receipt to the whistleblower within 48 business hours (if identifiable).
• 2.3 Conduct a preliminary triage meeting between the Compliance Lead and Legal Counsel within 5 business days to determine:
  • Credibility of information: Are specific, verifiable details provided?
  • Jurisdictional scope: Does the report allege financial malpractice, safeguarding breaches, regulatory non-compliance, or structural cover-ups?
• 2.4 Classify the case severity (Level 1: Critical/Systemic; Level 2: Moderate/Departmental; Level 3: Minor/Procedural).

Phase 3: Investigation Execution

• 3.1 Appoint an independent Lead Investigator (internal or external) free from conflicts of interest relative to the subjects of the report.
• 3.2 Draft an Investigation Plan outlining scope, required evidentiary artifacts, witness interview schedules, and legal boundaries.
• 3.3 Secure digital and physical evidence using strict Chain of Custody (CoC) protocols.
• 3.4 Conduct interviews under caution and confidentiality agreements; generate verbatim transcripts for the evidentiary file.
• 3.5 Compile the Final Investigation Report within 30 calendar days of initial triage, detailing factual findings, policy breaches, and risk mitigation recommendations.

Phase 4: Remediation & Board Reporting

• 4.1 Submit the Final Investigation Report to the Audit & Risk Committee Chair and designated Executive Officers.
• 4.2 Execute mandated remediation protocols (e.g., asset recovery, disciplinary hearings, mandatory reporting to statutory regulators such as the Charity Commission or law enforcement).
• 4.3 Communicate outcome summaries to the whistleblower (subject to privacy and data protection constraints) within 15 days of investigation closure.

---

6. QUALITY ASSURANCE & VERIFICATION CRITERIA

6.1 Audit Checklist

• Anonymity Preservation: Zero unauthorized disclosures of whistleblower identity in 100% of cases.
• Timeliness Metrics: Triage completed within $\le 5$ business days; investigations concluded within $\le 30$ calendar days.
• Audit Trail Completeness: CMS logs must show unbroken, uneditable timestamps for every action taken on a case file.

6.2 Acceptance Benchmarks

• Annual internal review of closed cases by an external auditor to detect systemic failures or patterns of retaliation.
• Zero substantiated claims of retaliation against registered whistleblowers.

---

7. PRACTICAL TROUBLESHOOTING SCENARIOS

Scenario A: Whistleblower Alleges Retaliation by Executive Leadership

• Symptom: A reporting employee claims their manager reduced their hours or initiated unwarranted disciplinary action following a disclosure regarding grant fund misallocation.
• Immediate Corrective Action Protocol:
  1. Suspend the disciplinary action immediately pending an independent review.
  2. Escalate the retaliation claim directly to the Chair of the Audit & Risk Committee, bypassing the operational management chain.
  3. Engage external employment legal counsel to perform an emergency protective assessment and institute interim protective measures (e.g., temporary reassignment of reporting line with zero loss of compensation or status).

Scenario B: Anonymous Disclosure Involving the Chief Executive Officer (CEO)

• Symptom: An anonymous report submitted via the digital drop-box accuses the sitting CEO of falsifying programmatic impact metrics to secure institutional funding.
• Immediate Corrective Action Protocol:
  1. The Intake Officer routes the report directly to the Chair of the Board of Trustees and External Legal Counsel, restricting access from internal executive systems.
  2. The Board of Trustees convenes an emergency executive session (excluding the CEO) to vote on appointing an independent forensic accounting firm to lead the investigation.
  3. Secure all relevant cloud databases and financial records to prevent data spoliation.