Why private companies need a whistleblower policy

In India, a formal vigil mechanism is mandated for listed companies and certain classes of companies under the Companies Act 2013 and SEBI regulations. Most private companies fall outside those mandates and conclude they do not need one. That conclusion is wrong, and usually discovered to be wrong at the worst possible moment: after a fraud, a harassment cover-up, or a vendor kickback that three employees knew about and none reported.

Why bother when the law does not force you

People inside the company almost always see problems first: the inflated invoice, the manager doctoring attendance, the safety shortcut. Whether they tell you depends entirely on what they believe reporting will cost them. Without a defined channel, the only route is telling one's own manager, who is sometimes the subject of the concern, or emailing a founder, which feels career-ending. So people stay quiet, and problems compound until they are expensive.

A whistleblower policy is cheap insurance. It also signals something to good employees and to customers doing vendor due diligence: this company would rather hear bad news early. Increasingly, enterprise clients ask their vendors whether such a mechanism exists.

What the policy should cover

Keep it to two pages, covering:

• Scope: what can be reported. Financial irregularities, fraud, theft, abuse of authority, safety violations, data misuse, conflicts of interest. State what it is not for: routine grievances about appraisals or workload, which belong in the normal grievance channel, and PoSH complaints, which must go to the Internal Committee under that Act's own process.
• Who can report: employees at minimum; ideally also contractors and vendors.
• Channels: at least one route that bypasses the reporting line, and at least one that permits anonymity.
• Protection: an explicit anti-retaliation commitment with consequences for violating it.
• Process: who receives reports, who investigates, and roughly how long things take.

Anonymity, done honestly

Anonymity is the feature that decides whether the channel gets used. Two design points matter:

• Truly anonymous intake. A form or system that does not capture identity, not a "confidential" inbox where the recipient sees the sender. Confidential and anonymous are different promises; offer both and label them honestly.
• Two-way communication without identity. Investigations often need follow-up questions, and anonymous reports go cold without a way to ask them. The standard solution is a tracking code: the reporter receives a random reference code at submission, and can return with that code to read questions from the investigator and reply, still unnamed. This is how ZekoHR's whistleblower reporting works, and the pattern is worth copying even in a manual process: a code, a status, and a message thread with no name attached.

The tracking code also fixes the reporter's biggest frustration, silence. Being able to check that the report moved from received to under review keeps people from concluding it went into a void.

Who investigates

Small companies do not need an elaborate apparatus, but they do need named roles:

• A designated recipient, typically the HR head plus one founder or board member, so no single person can bury a report.
• A rule for conflicts: if the report concerns the designated recipient, it routes to the other one, or to an external advisor. Write this down in advance; it cannot be improvised mid-case.
• An investigator appropriate to the subject: finance-led for financial matters, external counsel for serious or legally sensitive ones.
• Documentation of what was alleged, what was examined, and what was concluded, even when the conclusion is "unsubstantiated". A closed report with no record is indistinguishable from a buried one.

Commit to timelines loosely but genuinely: acknowledgement within a few days, an initial review within a couple of weeks, and closure communicated via the tracking code.

Anti-retaliation with teeth

State that retaliation against a good-faith reporter, in ratings, assignments, transfers or termination, is itself misconduct with disciplinary consequences, and treat any adverse action against a known reporter in the following months with heightened scrutiny. Equally, state that knowingly false and malicious reports are misconduct too; this protects the channel's credibility without discouraging honest mistakes.

Rolling it out

Announce the policy plainly, put the channel where people already are, mention it in onboarding, and re-mention it yearly. A channel nobody remembers exists is the same as no channel. If you want the intake, tracking codes and case log handled in software rather than a shared inbox, the culture module covers grievance and whistleblower reporting; policy wording samples are in the knowledge base.

Most reports you receive will be small. That is the system working: small is when problems are fixable.

This article is general information, not legal advice. Statutory vigil mechanism requirements apply to specific classes of companies; check whether yours is covered and consult a professional for policy drafting.