---

name: whistleblower-protection-policy language: en description: >- Drafts a U.S. whistleblower-protection policy for corporate and nonprofit organizations. Triggers when the user needs a whistleblower policy, retaliation-prohibition clause, hotline-reporting framework, compliance-ethics policy, or governance document addressing SOX, Dodd-Frank, OSHA, or state whistleblower statutes. tags:

• corporate
• drafting
• memo

---

Whistleblower Protection Policy

Produces a board-adoptable whistleblower policy with fill-in placeholders and U.S. compliance guardrails for public, private, and nonprofit entities.

Quick Start

Gather before drafting:

1. Org profile — legal name, entity type (public/private/nonprofit), governing state, reporting contacts.
2. Statute applicability — SOX, Dodd-Frank, OSHA, False Claims Act, state statutes.
3. Governance stack — existing code of conduct, handbook, grievance/investigation policies.
4. Administration model — who receives reports, investigates, and oversees outcomes.
5. Channel preferences — email, portal, hotline, written/verbal; tone and length targets.
6. Adoption mechanics — signatory roles, effective-date process, review cadence.

If any input is missing, emit a short clarifying checklist before drafting.

Policy Sections (fixed order)

#	Section	Required Content
0	Title block & version	Org name, version, effective date, scope entities
1	Introduction & commitment	Scope statement, non-retaliation promise, protected intent
2	Covered concerns	Serious-misconduct taxonomy, explicit non-coverage examples
3	Reporting procedures	Normal path, override path, anonymous option, channel placeholders
4	Investigation & resolution	Triage, assignment, timeline expectations, reporter updates
5	Anti-retaliation	Strict prohibition, protected-conduct examples, sanctions
6	Confidentiality & limits	Need-to-know bounds, legal exceptions, expectation management
7	Good-faith reporting	Reasonable-belief standard (no certainty burden), bad-faith consequences
8	Administration & governance	Board/committee roles, secure records, training, periodic review
9	External legal rights	Supplement-not-replace, no internal-prerequisite condition
10	Adoption & effective date	Board resolution, signature block, supersession language

Required Placeholders

Use exactly these tokens:

• [Organization Name], [State of Formation], [Board Chair], [Executive Director/CEO]
• [Primary Contact], [Alternative Contact], [Hotline URL/Number]
• [Adoption Date], [Effective Date], [Review Cycle]

Citation Discipline

• Reference statutes only when clearly supported by entity type and jurisdiction.
• Tag uncertain scope with [VERIFY] and request jurisdictional confirmation.
• Always verify: SOX §806 applicability, Dodd-Frank retaliation channels, OSHA/state overlap.

Output Format

• Numbered sections with clear headings.
• Prose-first; bullets only where needed (max 5 per section).
• End each section with implementation-ready fill-ins, not drafting notes.
• Close with signature block for Board Chair and CEO/Executive Director.

Pitfalls & Checks

• Never state that internal reporting is a legal prerequisite for external agency filing.
• Branch public-company vs. nonprofit/private language where statute relevance differs.
• Distinguish anti-frivolous-reporting language from negligent or honest mistakes.
• Protect good-faith reporters regardless of substantiation outcome.
• Set explicit confidentiality limits: need-to-know, lawful disclosure, legal process, audit/defense.
• Require annual or semiannual review, training completion, and board reporting metrics.
• End with disclaimer: "This policy is internal guidance and does not replace legal counsel for specific rights."