Policy required document Workplace
Whistleblower and Internal Investigation Policy
A whistleblower policy tells employees how to report suspected wrongdoing inside the company, promises they will not be punished for it, and sets out how the company investigates. It is required in name for public companies and asked about by the IRS for nonprofits, and it is the practical defense for everyone else.
The Sarbanes-Oxley Act prohibits retaliation against employees of public companies who report securities fraud (18 U.S.C. 1514A) and requires audit committees to maintain a confidential, anonymous channel for accounting concerns. Form 990, which every larger nonprofit files publicly, asks at Part VI line 13 whether the organization has a written whistleblower policy.
New York's Labor Law 740, rewritten in 2022, protects employees, former employees and contractors who disclose or threaten to disclose an activity they reasonably believe violates a law or endangers public health or safety, requires employers to post a notice of those rights, and provides reinstatement, back pay, civil penalties up to $10,000 and punitive damages.
The policy also does a job for the trade secrets policy: the Defend Trade Secrets Act lets an employer meet its immunity-notice duty by cross-referencing a policy document that sets out its reporting policy for suspected violations of law (18 U.S.C. 1833(b)(3)(B)), which is this document.
And it sits underneath the anti-retaliation policy, since retaliation was alleged in 61.6 percent of the 88,201 charges the EEOC received in fiscal year 2025 (EEOC Table E1a). What separates a claim that survives from one that does not is usually the investigation record: who received the report, when, what was done, and what was decided, written down at the time.
Obligation ledger
Who requires it, and what each one says.
| Source | Applies when | What it requires | Status |
|---|---|---|---|
| Sarbanes-Oxley Act, whistleblower protection 18 U.S.C. 1514A | Public companies, their subsidiaries, officers, employees, contractors and agents | No discharge, demotion, suspension, threat, harassment or discrimination against an employee for lawfully providing information about conduct the employee reasonably believes constitutes securities or shareholder fraud. Legally required. | Mandatory |
| Sarbanes-Oxley Act, audit committee complaint procedures 15 U.S.C. 78j-1(m)(4) | Listed public companies | The audit committee must establish procedures for receiving and handling complaints about accounting and auditing matters, including confidential, anonymous submission by employees. The policy documents the channel. | Mandatory |
| New York Labor Law, retaliatory action by employers NY Labor Law 740 | Every New York employer; protects employees, former employees and independent contractors | No retaliation for disclosing or threatening to disclose, to a supervisor or public body, an activity the employee reasonably believes violates a law, rule or regulation or poses a substantial and specific danger to public health or safety; employers must post a notice of rights; remedies include reinstatement, lost compensation, civil penalties up to $10,000, punitive damages for willful violations, and attorney fees. Legally required. | Mandatory |
| Form 990, Part VI, Section B, line 13 IRS Form 990 | Tax-exempt organizations filing Form 990 | Asks whether the organization has a written whistleblower policy. Not required by federal tax law; the answer is public, and funders and state charity regulators read it. | Attestation |
| Defend Trade Secrets Act, immunity notice by cross-reference 18 U.S.C. 1833(b)(3)(B) | Any employer with confidentiality agreements | The immunity notice may be given by cross-reference to a policy document setting out the employer's reporting policy for suspected violations of law. This policy is that document. | Implied |
Required sections
- What can be reported: violations of law, fraud, safety dangers, policy breaches, and that a reasonable belief is enough
- How to report, with more than one route including one outside the reporter's chain and, for public companies, an anonymous channel to the audit committee
- A statement that reports to government agencies are protected and that the policy does not require internal reporting first
- The DTSA immunity notice, in the statutory terms
- No retaliation, cross-referenced to the anti-retaliation policy, and what an employee should do if it happens
- How investigations run: who leads, confidentiality to the extent possible, the duty to cooperate, interim measures, and the written record
- Timelines and how the reporter is told the outcome, to the extent appropriate
- The New York posting and any other state notice
- Records: what is kept, where, and for how long
What the examiner asks for
What changed
Change log.
Frameworks
Where this document is required.
Need a hand implementing it?
Find a Consultant for Whistleblower and Internal Investigation Policy
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Manage This Document in AllyMatter
Route it for approval, keep every version, and record a named acknowledgment from everyone who has to read it.
Questions
What people ask.
We are private and small. Who requires this?
No statute names the document for you, unless you have staff in New York, where the posting duty applies to every employer. What requires it in practice is the retaliation claim: the employee who reported something and was later disciplined. The investigation record and the outside-the-chain reporting route are the defense, and they only exist if the policy created them.
Can we require employees to report internally before going to a regulator?
No. The SEC, OSHA, the Labor Department and state statutes protect reports made directly to them, and a policy that conditions protection on internal reporting first is unlawful under several of them. The policy should say external reporting is protected.
How does this relate to the trade secrets policy?
The federal trade secrets law lets you give the required immunity notice by cross-referencing this policy. If this policy carries the notice, every confidentiality agreement can point here instead of repeating it, and a missing notice no longer costs you exemplary damages.
What is the most common investigation mistake?
Not writing it down. A complaint received in a hallway, looked into informally and resolved by a conversation leaves no record, and a year later it is the reporter's word against the manager's. The policy's value is the file it forces into existence.
Sources
18 U.S.C. 1514A, Sarbanes-Oxley whistleblower protection (Cornell LII)15 U.S.C. 78j-1, audit requirements including complaint procedures (Cornell LII)NY Labor Law 740, retaliatory action by employers (NY Senate)IRS, About Form 99018 U.S.C. 1833, DTSA immunity notice (Cornell LII)EEOC Table E1a, Charge Receipts by Basis or Statute, FY 1997 to FY 2025