Six free whistleblower and anti-retaliation policy templates for a small business without an HR department: a full policy, a one-page statement, a report intake form, an investigation record, an anti-retaliation check-in log, and an acknowledgment form. Download as DOCX.
The first time someone at a small company reports something serious, the policy is almost never the problem. The process is. Somebody tells a manager in a hallway. The manager is not sure whether it counts. Two weeks pass. Then the reporter gets moved off an account for reasons that were probably genuine, and now there is no way to prove it.
I have watched that sequence enough times to be blunt about what a whistleblower policy is for. It is not a statement of values. It is an operating procedure with three parts: how a report gets in, who looks at it when there is nobody whose job that is, and what you can produce afterwards to show the reporter was not punished.
These six templates cover that whole path: a full whistleblower and anti-retaliation policy, a one-page statement for a handbook, a report intake form, an investigation record, an anti-retaliation check-in log, and an acknowledgment form. Each downloads as a Word document, free and without an email. They pair naturally with your HR policy manual and your harassment policy.
TL;DR
A whistleblower policy tells employees how to report illegal conduct, fraud, or unsafe conditions, and guarantees no retaliation for reporting in good faith. Small private employers are covered by more of it than they expect: OSH Act Section 11(c) and the False Claims Act anti-retaliation provision have no size floor. Download six free DOCX templates, then have US counsel review.
What a Whistleblower Policy Does
A whistleblower policy is a written document that tells people how to report suspected illegal conduct, fraud, unsafe conditions, or a serious policy violation, sets out how the company responds, and promises that nobody who reports in good faith will be punished for it. It is really two policies stapled together.
The reporting half names the channels. The anti-retaliation half defines retaliation broadly enough to catch the quiet version, applies to coworkers as well as managers, and states in writing that nothing in the policy stops an employee from going straight to a government agency. Skip either half and the document stops working.
Retaliation Is the Most Alleged Basis in EEOC Charges
In fiscal year 2025 the EEOC recorded 54,350 retaliation-based charge receipts out of 88,201 total charges, or 61.6 percent, more than any other basis and up from 42,301 the prior year (U.S. Equal Employment Opportunity Commission, Table E1a). A charge can allege more than one basis, so shares sum above 100 percent.
That number is the whole argument for having this policy. Retaliation claims outnumber the underlying complaints because they are easier to prove: the employee shows a report, then an adverse action, then a short gap in between. Your defense is the record you built at the time, which is exactly what the forms on this page produce.
Which Whistleblower Laws Reach a Small Employer
Several major whistleblower protections apply to small private employers with no headcount threshold at all, while the two people associate most with the word, Sarbanes-Oxley and the SEC award program, mostly do not. Getting that backwards is the common mistake, and it usually leads a small business to skip the policy entirely.
Law
What it protects
Reaches a small private employer?
Where a complaint goes
OSH Act Section 11(c)
Raising a safety or health concern, filing an OSHA complaint, reporting a work injury
Yes. No size floor
OSHA, within 30 days. OSHA sues, not the employee
False Claims Act, 31 U.S.C. 3730(h)
Acts to stop a false claim for federal money, including by contractors and agents
Yes. Any employer touching federal funds
Private lawsuit in federal court
NLRA Section 7
Employees acting together about pay or working conditions, including one employee raising a shared concern
Most private employers, union or not, subject to the revenue-based standards the NLRB uses to take jurisdiction
NLRB charge, within six months
18 U.S.C. 1513(e), criminal
Retaliating against someone who gave truthful information to law enforcement about a federal offense
Yes. Applies to any person or organization
Federal criminal prosecution
Title VII, ADA, ADEA retaliation
Reporting or opposing discrimination or harassment, or taking part in a charge
Once you meet each statute’s coverage threshold
EEOC charge
Sarbanes-Oxley, 18 U.S.C. 1514A
Reporting shareholder fraud
Only public companies, plus their contractors and subcontractors
OSHA, within 180 days
SEC whistleblower rules
Reporting securities violations. Rule 21F-17 bars impeding contact with the SEC
The award program centers on securities violations, but the anti-impeding rule has reached a private company
Start with Section 11(c) of the OSH Act, because it applies to essentially every private employer. It protects employees who complain about safety, participate in an OSHA proceeding, or report an injury, and the complaint window is 30 days. Note the structure: the employee cannot sue directly, so the Secretary of Labor brings the case. That means an OSHA obligation can become a federal lawsuit without any private attorney involved.
The False Claims Act catches more small businesses than owners expect. Its anti-retaliation provision, 31 U.S.C. 3730(h), covers employees, contractors, and agents, with no employer size limit, and the remedy includes reinstatement, double back pay, interest, special damages, and attorney fees. If your company bills a federal program, holds a federal contract, or sits under a prime contractor, it applies to you.
One Sarbanes-Oxley Provision Does Apply to Everyone
The civil whistleblower section, 18 U.S.C. 1514A, is a public-company rule, though the Supreme Court extended it to employees of a public company’s private contractors and subcontractors in Lawson v. FMR LLC (2014). The criminal provision added by the same act, 18 U.S.C. 1513(e), applies to any person or organization and makes knowing retaliation against someone who gave truthful information to law enforcement about a federal offense a federal crime. This is general information, not legal advice.
Then there is the labor overlay. Section 7 of the National Labor Relations Act protects employees who act together about pay, hours, or working conditions, and it applies to most private employers whether or not anyone is unionized. Two employees jointly complaining about unpaid overtime are engaged in protected concerted activity, which is why a whistleblower policy should never require reports to stay confidential or to go through management first.
Still Using Spreadsheets for Onboarding?
Automate documents, training assignments, task management, and track onboarding progress in real time.
Finally, the securities layer touches private companies through a side door. The SEC whistleblower program pays awards of 10 to 30 percent of monetary sanctions when they exceed $1 million, and its Rule 21F-17 forbids impeding anyone from communicating with the SEC. In September 2023 the SEC charged Monolith Resources LLC, a privately held company, over separation agreements requiring departing employees to waive whistleblower awards, and the company paid a $225,000 penalty. Check your confidentiality and severance agreement language for that clause.
How a Report Actually Comes In
A report almost never arrives the way the policy imagines. It arrives sideways: a comment at the end of a one-on-one, a message that starts with "this is probably nothing", a resignation letter with one strange paragraph. Your intake design has to catch that, not just the formal written complaint.
That means multiple channels, at least one that bypasses the reporter’s own manager, at least one that works when the concern is about leadership, and one instruction drilled into every manager: pass it up the same day, even if it sounded casual.
Any manager, not just their own
The most common real-world route. A concern arrives sideways, in a hallway or a chat message. Managers need one instruction: pass it up the same day, even if it sounded casual.
A named person and a named alternate
One owner by name, plus a second person for concerns involving the owner or leadership. A policy that routes everything to a single founder has no path for a concern about that founder.
A confidential or anonymous channel
A dedicated email alias, a simple web form, or a voicemail box. It does not need to be an expensive hotline. It does need to exist and to reach someone who is not implicated.
Directly to a government agency
Employees keep this route whatever your policy says. Saying so in writing costs nothing and removes any argument that you discouraged it.
Whatever channel it arrives through, the day-one move is the same. Open the intake form, write down what was said and when, run the conflict check, decide whether it escalates, and record the reporter’s current role, schedule, pay, assignments, and any discipline already in progress. That last field takes two minutes and is the single most valuable thing in the file if a retaliation claim follows.
Write Down the Baseline Before You Do Anything Else
Record the reporter’s role, schedule, pay, assignments, review rating, and any discipline or restructuring already documented, on the day the report arrives. A performance problem documented before the report is evidence. The same problem documented afterwards reads as manufactured, no matter how genuine it was.
Who Investigates With No HR Department
The investigator has to be impartial, which in a small company is a scarcity problem rather than a policy problem. Impartial means not named in the report, not supervised by anyone named in it, not the reporter’s supervisor, and holding no personal stake in the outcome. Work down that list and the pool shrinks fast.
So decide the routing in advance, in the policy, before any report exists. Choosing an investigator in the middle of a live complaint always looks like a reaction, even when the choice is perfectly reasonable.
The owner or a senior manager
Use whenRoutine concerns: a policy breach, a minor expense question, a disagreement about a process, where nobody senior is implicated.
Watch forStop immediately if the trail leads toward the person investigating, or toward anyone they are close to.
An office manager or operations lead
Use whenFact-gathering that is mostly documentary: timesheets, invoices, schedules, access logs. A careful, organized person who is not in the reporting line.
Watch forGive them the forms and a clear scope, and keep decisions about outcomes with the owner.
An outside employment attorney
Use whenAnything naming an owner or officer, anything involving discrimination, harassment, safety, or government money, and anything that could end in termination or litigation.
Watch forEngaging counsel early is also what preserves privilege over the work product.
An independent HR consultant or investigator
Use whenSerious matters where you want impartiality and interviewing skill without a full legal engagement, or where everyone internal has a conflict.
Watch forAgree the scope, the deliverable, and who receives the report before the work starts.
The escalation triggers worth writing into the policy are consistent across small businesses: anything naming an owner or officer, anything involving a protected characteristic, anything about safety, and anything touching government money. Those four go outside. Everything else can be handled internally with a written scope and a proper record, and our guide to conducting a workplace investigation covers the mechanics.
One practical warning. Do not let the same person be the intake contact, the investigator, the decision-maker, and the person who later handles the reporter’s performance review. Splitting those roles costs nothing when nothing is wrong and is worth a great deal when something is.
Pick the Version That Fits
Start with the full policy if you have people, a manager layer, or any exposure to government money, safety-sensitive work, or regulated sectors. Start with the one-page statement if you are early-stage or slotting this into a handbook. The three forms are not optional extras: they are what turns the policy into something you can prove you ran.
Whistleblower and Anti-Retaliation Policy (Full)
The flagship
The complete policy: what to report, five reporting channels including an anonymous one, a six-step response process, confidentiality limits stated honestly, a broad anti-retaliation clause, a carve-out preserving the right to contact a government agency, manager duties, and records.
Short Whistleblower Policy Statement
One page, handbook-ready
The essentials on a single signable page for a small or early-stage company, or to drop into an employee handbook as one section. How to report, what happens next, no retaliation, and the agency carve-out.
Whistleblower Report Intake Form
The first record
Filled in the day a report arrives, including verbal and anonymous reports. Captures the concern, the conflict check, the escalation decision, the preservation notice, and the reporter baseline that later shows nothing changed.
Whistleblower Investigation Record
Contemporaneous findings
Scope, evidence log, interview summaries, per-allegation findings with the evidence each rests on, credibility basis, corrective action, and a consistency check against how comparable conduct was handled before.
Anti-Retaliation Check-In and Monitoring Log
The proof afterwards
Baseline at the time of the report, a list of who knew, a decision log with independent reasons, a comparator check, and dated 30, 60, and 90 day check-ins where the reporter confirms nothing has changed.
Whistleblower Policy Acknowledgment Form
Ready to sign
Records that each person received the policy and knows the channels, plus a separate manager acknowledgment covering the duty to escalate and the rule against acting on a reporter without clearance.
Match the Template to Your Setup
Established team with managers: the full policy plus all three forms. Early-stage or handbook insert: the short statement plus the intake form. Regulated sector, federal contracts, or safety-sensitive work: the full policy, and have counsel review it. Everyone: the acknowledgment form, including the separate manager section. Fill in real names and contact details before you distribute anything.
6 Free Whistleblower Policy Templates
Download all six as a single Word bundle or copy individual templates. The policy sets the rules, the three forms create the record, and the acknowledgment proves everyone was told. Fill in your policy owner, alternate contact, confidential channel, retention period, and any state or industry specifics, then have US counsel review before you adopt.
Download All 6 Whistleblower Policy Templates
A full anti-retaliation policy, a one-page statement, a report intake form, an investigation record, a check-in log, and an acknowledgment form. All in one download.
Template 1: Whistleblower and Anti-Retaliation Policy (Full)
The complete policy: what to report, five reporting channels including an anonymous one, a six-step response process, honest confidentiality limits, a broad anti-retaliation clause covering coworkers, an explicit carve-out preserving the right to contact a government agency, manager duties, and recordkeeping.
Whistleblower and Anti-Retaliation Policy (Full)
WHISTLEBLOWER AND ANTI-RETALIATION POLICY
[Company Name]
Effective date: _ Policy owner: __
Last reviewed: _
1. PURPOSE
[Company Name] expects every employee to act honestly and lawfully, and we want to
hear about it early when something looks wrong. This policy explains how to report a
concern about suspected illegal conduct, fraud, unsafe conditions, or a serious
violation of company policy, how the company responds, and the protection every
person who reports in good faith receives against retaliation.
Reporting a concern is a service to the company. Nothing in this policy limits any
right an employee has under federal, state, or local law to contact a government
agency directly.
2. SCOPE
This policy applies to all employees, including full-time, part-time, temporary, and
seasonal staff, and to interns, applicants, contractors, and volunteers. It covers
conduct by any employee, owner, officer, manager, contractor, vendor, customer, or
visitor connected to our work.
3. WHAT TO REPORT
Report any activity you reasonably believe involves:
•A violation of federal, state, or local law or regulation
•Fraud, theft, bribery, kickbacks, or misuse of company or customer funds
•False or misleading financial records, invoices, timesheets, or billing
•A false or inflated claim submitted for payment under a government contract
or program
•An unsafe or unhealthy working condition, or a hazard to the public
•Discrimination, harassment, or retaliation
•Falsification or destruction of records, or interference with an investigation
•A serious conflict of interest, or a serious breach of company policy
You do not need proof, and you do not need to be right. You need a good-faith,
reasonable belief. Knowingly making a false report is itself a violation of this
policy.
4. HOW TO REPORT
Use whichever channel you are most comfortable with. You do not have to go to your
manager first.
Channel 1: Your manager or any other manager.
Channel 2: The policy owner named above.
Name: __ Email: _ Phone: _
Channel 3: The alternate contact, for use when the concern involves the policy owner
or company leadership.
Name: __ Email: _ Phone: _
Channel 4: The confidential reporting line or web form.
[Phone / email / URL: __]
Channel 5: [Optional: an outside intake provider, or company counsel at
__]
Reports may be submitted in writing or verbally, and anonymously through Channel 4.
Anonymous reports are accepted and investigated, but an anonymous report limits our
ability to ask follow-up questions, so we ask you to identify yourself where you can.
Please include: what happened, who was involved, when and where, how you learned of
it, whether anyone else knows, and any documents you already have. Do not attempt to
investigate on your own.
5. HOW WE RESPOND
Step 1: Acknowledgment. The person who receives the report records it on the
whistleblower report intake form and acknowledges receipt to the reporter within
[e.g. two business days], where the reporter is known.
Step 2: Assignment. The policy owner assigns the matter to an impartial reviewer.
Anyone named in the report, anyone who supervises the reporter, and anyone with a
personal stake is excluded from the review.
Step 3: Triage. Some reports are resolved on the same day. Others require a full
investigation. Reports involving financial fraud, safety, government funds,
discrimination, or company leadership are escalated to [owner / counsel / the
board] before any action is taken.
Step 4: Investigation. The reviewer gathers documents, interviews the people
involved, and records the findings on the investigation record form.
Step 5: Outcome. The company takes corrective action where the concern is
substantiated, up to and including termination, and closes the matter in writing.
Step 6: Follow-up. The reporter is told the matter is closed and, where appropriate
and lawful, what was done. We check in with the reporter after [30 / 60 / 90 days]
to confirm there has been no retaliation.
6. CONFIDENTIALITY
We keep reports confidential to the extent possible. Information is shared only with
those who need it to investigate and respond, or where disclosure is required by law
or by a government agency. We cannot promise absolute confidentiality, because a fair
investigation sometimes requires disclosing the substance of a concern. Investigation
files are stored separately from personnel files with restricted access.
7. NO RETALIATION
[Company Name] prohibits retaliation of any kind against anyone who, in good faith,
reports a concern under this policy, participates in an investigation, refuses to
take part in conduct they reasonably believe is unlawful, or contacts a government
agency.
Retaliation includes termination, demotion, discipline, a pay or hours cut, a
schedule or shift change, reassignment to less desirable work, exclusion from
meetings or projects, a negative reference, threats, and any other action that would
discourage a reasonable person from raising a concern. It also includes retaliation
by coworkers and retaliation against a family member or close associate who works
here.
Anyone who retaliates is subject to discipline up to and including termination.
If you believe you have experienced retaliation, report it immediately through any
channel in Section 4. Retaliation is treated as a separate violation and is
investigated on its own, whether or not the original concern is substantiated.
8. YOUR RIGHT TO CONTACT A GOVERNMENT AGENCY
Nothing in this policy, in any agreement you have signed, or in any confidentiality
obligation prevents or discourages you from reporting possible violations of law to a
government agency or regulator, from participating in an agency investigation, or
from receiving an award for information provided to a government agency. You do not
need company permission and you do not need to tell the company first.
9. RESPONSIBILITIES
•Every employee: report concerns in good faith and cooperate honestly with any
investigation.
•Every manager: pass any concern you receive to the policy owner promptly, even if
it seems minor or was shared informally. Never discourage a report, never promise
secrecy you cannot deliver, and never take any action affecting the reporter
where required, document outcomes, and run the anti-retaliation check-ins.
10. RECORDS
The company maintains a log of all reports and their outcomes, and retains intake
forms, investigation records, and follow-up documentation for [retention period, for
example the length of employment plus a defined number of years, consistent with
applicable federal and state recordkeeping rules]. Records are reviewed at least
annually for patterns.
ACKNOWLEDGMENT
I acknowledge that I have received and read the [Company Name] Whistleblower and
Anti-Retaliation Policy, that I know how to report a concern, and that I understand I
will not be retaliated against for reporting in good faith.
Employee signature: __ Date: _
DISCLAIMER: This is a sample template for general informational purposes only. It is
not legal advice and not a guarantee of compliance. Federal, state, and local
whistleblower and anti-retaliation laws differ, apply differently by industry and by
employer size, and change over time. Have this policy reviewed and adapted by
qualified US employment counsel before adopting it.
Template 2: Short Whistleblower Policy Statement
The essentials on one signable page for a small or early-stage company, or as a single section inside an employee handbook. How to report, what happens next, no retaliation, and the agency carve-out. Expand into the full policy as the team grows.
Short Whistleblower Policy Statement
WHISTLEBLOWER POLICY STATEMENT (SHORT)
[Company Name]
Effective date: _
A concise, one-page version for a small or early-stage company, or to drop into an
employee handbook as a single section. Expand into the full policy as the team grows.
POLICY STATEMENT
[Company Name] wants to know when something is wrong. If you reasonably believe that
someone here has broken the law, committed fraud, falsified records, created an unsafe
condition, or seriously violated company policy, report it. You do not need proof and
you do not need to be certain.
HOW TO REPORT
•Tell your manager, or any manager you trust, or
•Contact [name and title], at [email] and [phone], or
•If the concern involves that person or company leadership, contact [alternate name
and title], at [email] and [phone], or
•Submit it confidentially or anonymously through [phone / email / web form].
WHAT HAPPENS NEXT
We acknowledge your report, assign someone impartial to look into it, investigate as
far as the facts require, take corrective action where warranted, and close the matter
in writing. We keep your report as confidential as a fair investigation allows.
NO RETALIATION
No one will be fired, disciplined, demoted, have hours or pay cut, be reassigned, be
excluded, or be treated worse in any way for reporting a concern in good faith,
participating in an investigation, refusing to take part in conduct they reasonably
believe is unlawful, or contacting a government agency. Retaliation is a separate
violation of this policy and results in discipline up to and including termination.
If you think you are being retaliated against, say so immediately.
YOUR RIGHT TO GO TO AN AGENCY
Nothing in this policy or in any agreement you have signed stops you from reporting
possible violations of law to a government agency, cooperating with an investigation,
or receiving an agency award. You do not need our permission and you do not need to
tell us first.
ACKNOWLEDGMENT
I acknowledge that I have received and read this Whistleblower Policy Statement.
Employee signature: __ Date: _
DISCLAIMER: This is a sample template for general information only and is not legal
advice. Have it reviewed by qualified US employment counsel before adopting it.
Template 3: Whistleblower Report Intake Form
Filled in the day a report arrives, including verbal and anonymous ones. It captures the concern, the conflict check, the escalation decision, the document preservation notice, and the reporter baseline. This form is the first entry in the record showing what you knew and what you did about it.
Whistleblower Report Intake Form
WHISTLEBLOWER REPORT INTAKE FORM
[Company Name]
CONFIDENTIAL. Store with restricted access, separately from personnel files.
Use this form for every report, including verbal and anonymous ones. The person who
receives the report fills it in the same day. This form is the first entry in the
record that shows what you knew, when you knew it, and what you did about it.
SECTION A: INTAKE
Report reference number: _
Date received: _ Time received: _
Received by (name and title): __
How received: [ ] In person [ ] Phone [ ] Email [ ] Web form [ ] Letter
[ ] Other: _
SECTION B: REPORTER
[ ] Named reporter [ ] Anonymous reporter
Name: __ Title / department: __
Contact for follow-up: __
Relationship to company: [ ] Employee [ ] Former employee [ ] Contractor
Reporter's manager and any decision-maker put on notice not to take any action
affecting the reporter without clearing it first: [ ] Yes Date: _
Reporter's current status recorded as a baseline (role, schedule, pay, assignments,
open performance issues, discipline already in progress as of today):
___
___
Check-in dates scheduled: 30 days ______ 60 days ______ 90 days ______
SECTION F: TRIAGE DECISION
[ ] Resolved at intake. Explanation: __
[ ] Full investigation opened. Investigation reference: _
[ ] Referred to outside investigator or counsel: __
[ ] No action. Documented reason: __
Signature of intake recipient: __ Date: _
DISCLAIMER: This is a sample form for general information only and is not legal
advice. Adapt it to your company, your industry, and your recordkeeping obligations.
Template 4: Whistleblower Investigation Record
Scope, an evidence log, interview summaries, per-allegation findings with the evidence each rests on, the basis for any credibility assessment, corrective action, and a consistency check against how comparable conduct was handled before. Complete it as you go, not afterwards from memory.
Whistleblower Investigation Record
WHISTLEBLOWER INVESTIGATION RECORD AND FINDINGS
[Company Name]
CONFIDENTIAL. Attorney work product where prepared at the direction of counsel.
Complete this record as the investigation proceeds, not afterwards from memory. Dated
contemporaneous entries are what make the record credible later.
Template 5: Anti-Retaliation Check-In and Monitoring Log
The document most small businesses do not have and most need. Baseline at the time of the report, a dated list of who knew, a decision log with independent reasons, a comparator check, and 30, 60, and 90 day check-ins where the reporter confirms nothing has changed.
Anti-Retaliation Check-In and Monitoring Log
ANTI-RETALIATION CHECK-IN AND MONITORING LOG
[Company Name]
CONFIDENTIAL. This is the document that shows nothing happened to the reporter.
Most retaliation claims are proved with circumstantial evidence: a report, then an
adverse action shortly afterwards. This log is the counterweight. It records the
reporter's baseline at the time of the report, every decision affecting them since,
and a dated confirmation from the reporter that they have not experienced retaliation.
SECTION A: BASELINE AT THE TIME OF THE REPORT
Reporter: __ Report reference: _
Date of report: _
Recorded by: __ Date recorded: _
Role and title: __
Manager: __
Schedule and hours: __
Pay rate and last change: __
Current assignments, accounts, or territory: __
Performance status and last review rating: __
Discipline, performance plan, or restructuring already documented and in progress as
of the date of the report (attach the dated documents):
___
___
Planned changes already decided before the report (attach dated evidence):
___
SECTION B: NOTICE TO DECISION-MAKERS
Who was told the report exists, and when. Keep this list as short as the
investigation allows.
Name and role | Date told | What they were told | Reminder given not to act alone
|____||_____
|____||_____
Managers reminded that no action affecting the reporter (discipline, schedule, pay,
assignment, review, reference) may be taken without clearing it with the policy owner
first: [ ] Yes Date: _
SECTION C: DECISION LOG
Record every employment decision affecting the reporter after the report date, and
the independent, documented reason for it.
Date | Decision | Decided by | Reason and evidence | Cleared with policy owner
_____|___|_____||_____
_____|___|_____||_____
_____|___|_____||_____
Comparator check: how were other employees in the same situation, who did not report,
treated? _
SECTION D: CHECK-INS WITH THE REPORTER
30-day check-in Date: _ Conducted by: __
"Since your report, has anything changed in how you are treated, scheduled,
Reporter confirms no retaliation experienced: [ ] Yes [ ] No
Additional check-in (optional) Date: _
Response:
SECTION E: CLOSE-OUT
Monitoring period closed on: _
Summary of any concerns raised and how each was resolved:
___
Any adverse action taken during the monitoring period, and the documented,
independent reason for it: ____
___
Policy owner signature: __ Date: _
DISCLAIMER: This is a sample form for general information only and is not legal
advice. It does not by itself establish a defense to any claim. Have your process
reviewed by qualified US employment counsel.
Template 6: Whistleblower Policy Acknowledgment Form
Records that each person received the policy and knows the channels, with the current contacts written on the form itself. It includes a separate manager acknowledgment covering the duty to escalate and the rule against acting on a reporter without clearance.
Whistleblower Policy Acknowledgment Form
WHISTLEBLOWER POLICY ACKNOWLEDGMENT FORM
[Company Name]
Use this form to record that each person received the whistleblower and
anti-retaliation policy and knows how to use it. Collect it at onboarding, after any
material update to the policy, and after a change to the named contacts.
EMPLOYEE ACKNOWLEDGMENT
I, __ (print name), acknowledge that:
•I have received the [Company Name] Whistleblower and Anti-Retaliation Policy dated
_____, and I have read and understand it.
•I know the channels available to report a concern, and I know that I can report to
someone other than my own manager.
•I know that I can report anonymously through [channel].
•I understand that I do not need proof or certainty. A good-faith, reasonable belief
is enough.
•I understand that the company prohibits retaliation against anyone who reports in
good faith, participates in an investigation, refuses to take part in conduct they
reasonably believe is unlawful, or contacts a government agency, and that I should
report suspected retaliation immediately.
•I understand that nothing in this policy or in any agreement I have signed prevents
me from reporting possible violations of law to a government agency, cooperating
with an agency investigation, or receiving an agency award.
•I understand that knowingly making a false report violates this policy.
•I have had the opportunity to ask questions.
Reporting contacts as of today:
Policy owner: __ Email / phone: __
Alternate contact: __ Email / phone: __
Confidential line or form: __
Employee signature: __ Date: _
MANAGER ACKNOWLEDGMENT (ADDITIONAL)
As a manager, I additionally acknowledge that I will:
•Pass any concern I receive to the policy owner promptly, including concerns raised
informally or in passing.
•Never discourage a report and never promise confidentiality I cannot deliver.
•Take no action affecting a reporter (discipline, schedule, pay, assignment, review,
or reference) without clearing it with the policy owner first.
•Report to the policy owner any conduct that could look like retaliation, including
DISCLAIMER: This is a sample form for general information only and is not legal
advice. Adapt it to your company and recordkeeping practices.
How to Prove There Was No Retaliation
You prove it with dated documents created before and during the events, never with an explanation assembled afterwards. Retaliation cases are usually built on circumstantial evidence: protected activity, an adverse action, and a short gap in between. Your job is to make that sequence explainable with contemporaneous records.
The legal standard varies, which is worth knowing before you rely on any one habit. Title VII retaliation requires but-for causation after University of Texas Southwestern Medical Center v. Nassar (2013). Several statutes OSHA administers use a friendlier employee standard where protected activity need only be a contributing factor, and the employer must then show by clear and convincing evidence it would have acted anyway. Some state laws go further still.
1
Write the baseline down on day one
Record the reporter's role, schedule, pay, assignments, review rating, and any discipline already in motion, on the day the report arrives. A performance problem documented before the report is evidence. The same problem documented after it looks manufactured.
2
Keep the list of who knows short and dated
Causation usually turns on whether the decision-maker knew about the report. Write down who was told, when, and what they were told. A manager who genuinely did not know cannot have acted because of it, and you want that in writing rather than in memory.
3
Route every decision about the reporter through one person
For the monitoring period, no discipline, schedule change, reassignment, review, or reference for the reporter without the policy owner clearing it. This catches the accidental retaliation that does most of the damage, like quietly dropping someone from a project.
4
Log the independent reason at the moment of the decision
If you do have to act, record the reason and the evidence the same day, along with when the decision was actually made. Contemporaneous beats reconstructed every time. Reconstructed reasons are what get characterized as pretext.
5
Check the comparators before you act
How did you treat someone in the same situation who never reported anything? If the answer is different, that gap is the case. If the answer is the same and you can show it, that consistency is your defense.
6
Ask the reporter, on a schedule, and record the answer
A dated 30, 60, and 90 day check-in where the reporter says nothing has changed is a document that no amount of later argument can easily undo. It also surfaces small problems while they are still fixable.
Two failure patterns cause most of the damage. The first is accidental: a manager who was never told about the report quietly drops the reporter from a project, and the timing does the rest. The second is well-intentioned: someone documents a real performance problem for the first time right after the report, which is precisely when new documentation stops being persuasive.
Both are prevented by the same rule. During the monitoring period, no decision affecting the reporter happens without one named person clearing it and writing down the reason and the evidence that day. Our guide to preventing workplace retaliation goes deeper on what counts as an adverse action, and the EEOC charge process explains what happens if a claim is filed anyway.
State Whistleblower Laws to Check
State whistleblower laws are frequently broader than the federal ones, and they are where a small employer is most likely to be caught out. Check the law of every state where you have an employee, not just where the company is registered.
State
What is different
What it means for your policy
California
Labor Code 1102.5 protects internal and external reports. Under Section 1102.6 the employer must show by clear and convincing evidence it would have acted anyway. SB 497 added a rebuttable presumption of retaliation for adverse action within 90 days of protected activity, effective January 1, 2024, plus a civil penalty of up to $10,000 per violation payable to the employee
A 90-day monitoring log stops being optional. Document the independent reason and its date for anything you do in that window
New York
Labor Law 740, substantially expanded effective January 26, 2022, covers current and former employees and independent contractors, uses a reasonable belief standard, and requires a posted notice of rights
Post the state notice, and make sure the policy covers contractors as well as employees
New Jersey
The Conscientious Employee Protection Act is one of the broadest state whistleblower statutes and protects employees of any size employer. Under N.J.S.A. 34:19-7, an employer with 10 or more employees must both post the notice and distribute it annually, naming the person designated to receive reports
If you are at or above that threshold, name a real contact, distribute the notice every year, and keep proof of distribution
Most other states
Coverage varies widely. Some statutes protect only reports made to a public body, meaning a purely internal report may fall outside the statute
Do not assume an internal-only channel is enough. Keep the agency carve-out explicit
The pattern worth internalizing: several states shift the burden onto the employer once the employee shows protected activity and an adverse action close together. That is a documentation problem, not a legal argument you can win later with a good story. It is also why the check-in log exists, and why remote employees in other states quietly expand your obligations.
Running the Policy Without an HR Team
A large company runs this through a compliance function, an ethics hotline vendor, and an audit committee. A small business runs it through one person who also does five other jobs. The policy has to be designed for that, which mostly means naming individuals instead of committees and automating the steps that get forgotten.
Most whistleblower templates on the internet were written for nonprofits and public companies
Search the term and you get nonprofit board policies written for the IRS Form 990 governance question, and corporate policies written around audit committees and outside counsel. Both assume a structure a small business does not have: a board, an audit committee, a compliance function, an ethics hotline vendor. Drop one of those into a small company and the policy names committees that do not exist, which means the first real report has nowhere to go. These templates name a person and an alternate, not a committee, and they assume the investigator is the owner or an office manager rather than a compliance department.
The person who receives the report is often the person the report is about
In a small company the founder hires, manages, signs checks, and sets the culture, so a serious concern is frequently about that person or someone close to them. A policy with one reporting channel that leads to the founder is a policy that quietly guarantees silence. The fix is structural and cheap: name an alternate contact who is not in the leadership chain, add a channel that accepts anonymous reports, and pre-commit in writing to bringing in an outside investigator (an employment attorney or an HR consultant) when a report names an owner, an officer, or anyone who supervises the investigator. Decide that before you need it, because deciding it during a live complaint looks like a reaction.
A policy in a folder is not the same as a process you can prove you ran
The value of this policy comes from the record it produces: the acknowledgment showing every person knew how to report, the intake form showing what you did the day the report arrived, the investigation record showing you looked at it seriously, and the check-in log showing nothing happened to the reporter afterwards. That documentation trail is the people-operations problem FirstHR is built for. E-signature captures the policy acknowledgment and the manager acknowledgment, document management stores the signed versions with version history, task workflows can drive the intake, escalation, and 30, 60, and 90 day check-in steps so they actually happen, and the self-service portal keeps the current policy and the current reporting contacts in front of everyone. To be clear about scope, FirstHR is an onboarding and HR platform, not a law firm and not an investigation service, so pair it with qualified US employment counsel. Applicant tracking is coming soon to FirstHR.
The operational failure is almost never the policy text. It is the 60-day check-in nobody scheduled, the manager acknowledgment never collected, or the fact that the reporting contact left the company a year ago and the document still names them. Those are workflow problems.
Adapt and name real people
Fill in the policy owner, the alternate, and the confidential channel with names and contact details that work today, add your state and industry specifics, and have US counsel review before you adopt it.
Distribute and sign
Send the policy to everyone, capture a signed acknowledgment with e-signature, and collect the extra manager acknowledgment from anyone who supervises people.
Run the intake the same day
Open the intake form the day a report arrives, run the conflict check, escalate where the policy says to, and record the reporter baseline before anything else happens.
Close it and keep checking in
Store the investigation record with restricted access, tell the reporter the matter is closed, and run the 30, 60, and 90 day check-ins on a schedule rather than when someone remembers.
The templates work on their own. To run them without paper, FirstHR captures the policy and manager acknowledgments with built-in e-signature and stores signed versions with version history through document management.
It also drives intake, escalation, and the 30, 60, and 90 day check-ins as task workflows so they happen on schedule rather than when someone remembers, and keeps the current policy and reporting contacts in front of everyone through employee self-service. Applicant tracking is coming soon to FirstHR. FirstHR is an onboarding and HR platform, not a law firm and not an investigation service, so pair it with qualified US employment counsel.
One last habit that costs nothing: re-read the policy once a year and check that the named contacts still work there. Pair it with your open door policy and wider policy set so employees see one consistent story about how to raise a concern. Applicant tracking is coming soon to FirstHR.
Key Takeaways
A whistleblower policy is two policies in one: how a report gets in, and a guarantee that reporting in good faith carries no consequences.
OSH Act Section 11(c), the False Claims Act anti-retaliation provision, and the criminal provision at 18 U.S.C. 1513(e) reach small private employers with no size floor, and NLRA Section 7 reaches most of them.
Name a real person and a real alternate, add an anonymous channel, and decide your outside-investigator triggers before any report exists.
Record the reporter baseline on day one, log who knew, route every decision through one person, and run dated 30, 60, and 90 day check-ins.
Several state laws shift the burden to the employer when adverse action follows a report closely, so contemporaneous documentation is the defense.
These templates are US-first starting points, not certified compliance. Have US counsel review. This is general information, not legal advice.
Frequently Asked Questions
What is a whistleblower policy?
A whistleblower policy is a written document that tells employees how to report suspected illegal conduct, fraud, unsafe conditions, or serious policy violations, explains how the company responds, and promises that nobody who reports in good faith will be retaliated against. In practice it is really two documents in one: a reporting policy and an anti-retaliation policy. The reporting half names the channels, including one that does not run through the reporter’s own manager and one that accepts anonymous reports. The anti-retaliation half defines retaliation broadly, covers coworkers as well as managers, and preserves every employee’s right to contact a government agency directly. A policy that functions in practice also builds the record: an intake form, an investigation record, and a follow-up log. This is general information, not legal advice.
Does a small private company need a whistleblower policy?
Yes, and the assumption that whistleblower law is a public-company topic is the most expensive misconception in this area. Several anti-retaliation protections reach small private employers, and two of them carry no size floor at all. Section 11(c) of the Occupational Safety and Health Act protects employees who raise safety concerns or report a work injury. The False Claims Act protects anyone who acts to stop a false claim for federal money, which reaches any business that touches a government contract, grant, or program, including as a subcontractor. Section 7 of the National Labor Relations Act protects employees who act together about pay or working conditions, union or not, and covers most private employers, subject to the revenue-based standards the NLRB uses to take jurisdiction. Retaliation is also the most frequently alleged basis in charges filed with the Equal Employment Opportunity Commission. This is general information, not legal advice.
Does Sarbanes-Oxley apply to a private company?
Mostly no, with two important exceptions. The main civil whistleblower provision, 18 U.S.C. 1514A, protects employees of publicly traded companies, and complaints are filed with OSHA within 180 days. The first exception is that the Supreme Court held in Lawson v. FMR LLC (2014) that this protection extends to employees of a public company’s private contractors and subcontractors, so a small private vendor to a public company can be covered. The second exception is broader: the criminal retaliation provision at 18 U.S.C. 1513(e), added by Sarbanes-Oxley, applies to any person or organization, public or private, and makes it a federal crime to knowingly retaliate against someone for giving truthful information to law enforcement about a federal offense. This is general information, not legal advice.
Who should investigate a whistleblower report at a company with no HR department?
Whoever is genuinely impartial, which means not named in the report, not supervised by anyone named in it, not the reporter’s supervisor, and with no personal stake in the outcome. For routine concerns, an owner or a senior manager outside the reporting line can handle it with a written scope and a proper record. For documentary fact-gathering, an organized operations or office lead can collect and log evidence while the owner keeps the outcome decision. Anything naming an owner or officer, and anything involving discrimination, harassment, safety, or government money, should go to an outside employment attorney or an independent investigator. Decide those escalation triggers in the policy before a report arrives, because choosing an investigator during a live complaint always looks like a reaction. This is general information, not legal advice.
How do you prove there was no retaliation?
With dated documents created before and during the events, not with an explanation written afterwards. Six habits do most of the work. Record the reporter’s baseline the day the report arrives, including any discipline or restructuring already in motion. Keep a short, dated list of who was told about the report, since causation often turns on whether the decision-maker knew. Route every decision affecting the reporter through one person during the monitoring period. Log the independent reason and the evidence at the moment of each decision. Check comparators, meaning how you treated people in the same situation who never reported. Then run dated 30, 60, and 90 day check-ins where the reporter confirms nothing has changed. This is general information, not legal advice.
Do we have to accept anonymous reports?
There is no single federal rule requiring anonymous reporting for private employers generally, but including an anonymous channel is a practical decision that costs almost nothing. In a small company the reporter often has to walk past the person they are reporting on, and an anonymous option is frequently the only way a serious concern surfaces internally rather than going straight to an agency. It does not have to be a paid hotline. A dedicated email alias, a simple web form, or a voicemail box that reaches a named alternate contact is enough. The tradeoff is real: an anonymous report limits your ability to ask follow-up questions, so the policy should encourage people to identify themselves while making clear that anonymous reports are still accepted and investigated. This is general information, not legal advice.
Can a confidentiality or severance agreement stop an employee from reporting to a regulator?
No, and trying can create a separate problem. Securities and Exchange Commission Rule 21F-17 prohibits taking action to impede someone from communicating with the SEC about possible securities law violations, and the agency has read that broadly to cover employment and separation agreement language, including clauses that let employees report but require them to waive any monetary award. In 2023 the SEC charged Monolith Resources LLC, a privately held company, over separation agreements of that kind, and the company paid a 225,000 dollar penalty without admitting or denying the findings. The practical step is to add an explicit carve-out to your policy, your confidentiality agreements, and your separation agreements preserving the right to report to, cooperate with, and receive an award from a government agency. This is general information, not legal advice.
What is the deadline for an employee to file a retaliation complaint?
It varies by statute, which is one reason the response window is shorter than most owners expect. Under Section 11(c) of the Occupational Safety and Health Act the employee has 30 days from the retaliatory act, and OSHA investigates rather than the employee suing directly. Sarbanes-Oxley complaints go to OSHA within 180 days. The other whistleblower statutes OSHA administers, covering food safety, trucking, aviation, rail, pipelines, consumer finance, the environment, and health coverage, carry their own deadlines ranging from 30 to 180 days. Unfair labor practice charges under the National Labor Relations Act carry a six-month limit. Discrimination-based retaliation charges go to the EEOC on the usual charge timelines. State law deadlines differ again. This is general information, not legal advice.
