Free whistleblower policy template

A whistleblower policy is a short written policy that tells employees, volunteers and others how to report suspected wrongdoing, how reports are handled, and that people who report in good faith are protected from retaliation. It’s good practice for any small business or nonprofit, and Form 990, Part VI asks nonprofits whether they have one. This sample policy is free to copy, customize and use.

Read it below, copy it, or download it. No email or sign-up needed.

Download Word (.docx) Download PDF

Last updated October 2026 · Not legal advice; have your attorney review.

The template

Sample whistleblower policy

Replace the highlighted [bracketed] text with your own details.

Whistleblower policy template · 10 sections

Sample template from Safe Hotline. Not legal advice; have your attorney review this policy before you adopt it. Replace or delete every [bracketed] item. Last updated October 2026.

[Organization Name] Whistleblower Policy

Effective date: [Date adopted]

Approved by: [Board of Directors / Owner]

Policy contact: [Name and title of designated officer]

1. Purpose

[Organization Name] is committed to honest, ethical and lawful conduct. This policy encourages employees and others to report suspected wrongdoing in good faith, explains how to report it, and protects people who report from retaliation.

2. Who this policy covers

This policy applies to all employees, [volunteers], [members of the Board of Directors], [contractors, vendors and consultants], and anyone else who works with or on behalf of [Organization Name].

3. What to report

Report any conduct you believe in good faith is illegal, unethical or a violation of [Organization Name] policies. Examples include:

  • Financial misconduct, such as questionable accounting, falsified records or misuse of funds
  • Theft, embezzlement or misuse of [Organization Name] property
  • Harassment or discrimination
  • Health and safety risks
  • Undisclosed conflicts of interest
  • Violations of [Organization Name] policies, including our [Code of Conduct]
  • Retaliation against anyone who reported a concern

4. How to report

You may report a concern in any of these ways:

  • To your supervisor, or to [Name or title of designated officer] at [email address or phone number].
  • If the concern involves your supervisor or senior leadership, to [Board Chair / Audit Committee Chair] at [contact information].
  • Anonymously, through our independent third-party ethics hotline, available 24 hours a day, 7 days a week:
    • Web: [Hotline web address]
    • Toll-free phone: [Hotline phone number]
    • Text: [Hotline text number]
    • Company ID: [XXXX]

You do not have to give your name. Anonymous reporters receive a [Report Key / reference number] they can use to check the status of their report and answer follow-up questions. Please include as much detail as you can: what happened, when and where, and who was involved.

5. Confidentiality and anonymity

Reports will be kept confidential to the extent possible, consistent with the need to review the concern properly and with any legal obligations. Information will be shared only with people who need it to review or resolve the concern. If you report anonymously, [Organization Name] will not try to identify you.

6. No retaliation

[Organization Name] will not retaliate against anyone who reports a concern in good faith or who takes part in a review or investigation. Retaliation includes firing, demotion, suspension, threats, harassment or any other adverse action taken because of a report. Anyone who retaliates will face discipline, up to and including [termination of employment / removal from their role]. If you believe you have experienced retaliation, report it using any of the channels above.

7. Good-faith reporting

Report concerns you honestly believe to be true. You do not need proof, and you will not be disciplined if a good-faith concern turns out to be mistaken. Knowingly making a false report is a serious matter and may lead to discipline.

8. How reports are handled

  • [Designated officer] will acknowledge each report within [5 business days] when the reporter can be reached, including anonymous reporters through the hotline.
  • Each report will be reviewed promptly and, where appropriate, investigated by [Designated officer / investigator].
  • Concerns involving [the Executive Director / CEO / Owner], other senior leaders or financial reporting will go to [the Board Chair / Audit Committee Chair], who will oversee the review.
  • No one will review or investigate a report that involves them.
  • Where possible, the reporter will be told when the review is complete. [Organization Name] will take appropriate corrective action when a concern is substantiated.
  • [Designated officer] will give [the Board / Audit Committee] a summary of reports and their outcomes at least [annually / quarterly].

9. Recordkeeping

[Designated officer] will keep a record of each report, the review and the outcome. Records will be stored securely, with access limited to the people who need it, and kept for [retention period] in line with [Organization Name]’s record retention policy.

10. Policy review and acknowledgment

[Board of Directors / Owner] will review this policy at least [once a year]. [Organization Name] will share this policy with everyone it covers and post its hotline information where people can see it.

Adopted by [Board of Directors / Owner] on [Date]. Last reviewed: [Date].

Acknowledgment: I have read and understand the [Organization Name] Whistleblower Policy.

Name: ______________________________

Signature: ______________________________

Date: ______________________________

How to use this template

Five steps from template to policy

  1. Fill in the brackets

    Replace every [bracketed] item with your organization’s details, and delete anything that doesn’t apply.

  2. Get it reviewed and adopted

    Have your attorney review it. Then have your owner adopt it, or for a nonprofit, your board.

  3. Share it with everyone it covers

    Add it to your handbook and onboarding, and collect signed acknowledgments.

  4. Post your hotline information

    Put up a hotline poster so everyone knows how to report, including anonymously.

  5. Review it every year

    Update names, contacts and hotline details whenever they change.

For nonprofits

Sample nonprofit whistleblower policy

To use this template as a nonprofit whistleblower policy, name your board chair or audit committee chair as the reporting contact for concerns about the executive director or other senior leaders, and list volunteers and board members under “Who this policy covers.” IRS Form 990, Part VI asks whether the organization has a written whistleblower policy, so have your board adopt it and note the date it was approved. See how Safe Hotline works for nonprofits.

Make it work

Put the “How to report” section into action

Safe Hotline is the independent, anonymous channel your policy points to. Register, then add your Company ID and hotline details to section 4.

What Safe Hotline adds to your policy

  • Anonymous web, phone and text reporting, 24/7, in English and Spanish, across the US and Canada
  • Reporters don’t need an account. They check the status of their report and answer follow-up questions with their Report Key.
  • Every admin gets an email when a new report comes in
  • Case management with admin and investigator roles. Investigators see only the cases assigned to them.
  • A poster with your Company ID, mailed to you

One flat yearly price

For organizations with under 250 employees

Businesses$600/year

Nonprofits$500/year

No contract required — cancel anytime after the initial 6-month minimum.

Register

See how the service works

Policy FAQ

Whistleblower policy questions

What should a whistleblower policy include?

A good policy says who it covers, what kinds of concerns to report and how to report them, including a way to report anonymously. It should also explain how reports are kept confidential, promise no retaliation for good-faith reports, and describe how reports are reviewed, investigated and recorded. Name who handles concerns about senior leaders, such as a board chair or audit committee. The template on this page covers each of these.

Can I use this template for a nonprofit?

Yes. It’s written for both small businesses and nonprofits. Replace the bracketed text, list volunteers and board members under “Who this policy covers,” and send concerns about the executive director to your board chair or audit committee. Then have your board adopt the policy and review it each year.

Does a whistleblower policy need an anonymous reporting option?

It’s widely recommended. Some people won’t report a concern about a manager or coworker if they have to give their name. A third-party hotline also lets anonymous reporters follow up: with Safe Hotline, reporters don’t need an account, and they check the status of their report with their Report Key. Ask your attorney whether any specific requirements apply to your organization.

See all FAQs

This is a sample template, not legal advice. Requirements can vary by organization and location, so have your attorney review your policy before you adopt it. Last updated October 2026.

Founded in April 2016Based in Chandler, Arizona800+ customers95%+ customer retention