How Can Your Organisation Establish a Safe Whistleblowing System?

‏05 اغسطس 2026 SHIREEN MIQDAD

Introduction

Strong governance within the non-profit sector is no longer measured solely by the existence of policies and procedures. Today, it is assessed by an organisation's ability to identify risks, respond to concerns promptly, and address misconduct before it develops into a crisis that could undermine its mission, damage public confidence, or jeopardise donor relationships.

Throughout the previous articles in this series, we explored the Code of Conduct, Safeguarding, Prevention of Sexual Exploitation and Abuse (PSEA), and Child Safeguarding. Together, these policies define the standards of behaviour expected throughout an organisation and establish the protections required for beneficiaries, employees, volunteers, and partners.

However, these policies can only achieve their intended purpose if individuals have a safe and trusted way to report concerns whenever they witness conduct that appears inconsistent with those standards.

This is where a Whistleblowing Policy becomes essential.

Rather than serving merely as an administrative reporting mechanism, an effective whistleblowing system is now recognised as one of the most important instruments of organisational governance. It enables employees, volunteers, trustees, partners, suppliers, and beneficiaries to report concerns confidentially and responsibly, allowing organisations to identify emerging risks, protect people and resources, strengthen accountability, and reinforce public trust.

Today, whistleblowing arrangements are regarded by many international donors as a core element of institutional governance. Boards of Trustees, Audit Committees, Compliance Officers, and senior leadership increasingly rely upon whistleblowing systems as strategic tools for risk management, organisational integrity, and continuous improvement.

Consequently, a well-designed whistleblowing system is no longer viewed as optional good practice. It has become an essential component of organisational readiness, governance, compliance, and responsible humanitarian management.

This article explains the purpose of whistleblowing, explores its role within organisational governance, and presents the key principles required to establish a reporting system that protects whistleblowers, strengthens transparency, and enhances institutional readiness for sustainable donor partnerships.

First: What Is Whistleblowing?

Whistleblowing refers to the reporting, in good faith, of conduct that an individual reasonably believes constitutes a breach of law, organisational policy, ethical standards, or any practice that could place an organisation, its beneficiaries, employees, volunteers, resources, reputation, or operations at risk.

Whistleblowing is not limited to employees.

A mature whistleblowing system should enable concerns to be raised by anyone connected with the organisation, including:

Employees.
Volunteers.
Members of the Board of Trustees.
Consultants.
Contractors.
Suppliers.
Implementing partners.
Beneficiaries.
Interns.
Any individual interacting with the organisation.

The underlying principle is straightforward:

Organisations protect themselves by enabling people to speak up when something appears wrong, without fear of retaliation, discrimination, or negative consequences.

Accordingly, whistleblowing is not about encouraging people to report one another.

It is about creating an organisational culture in which reporting concerns is recognised as a responsible professional contribution to protecting the organisation and the people it serves.

Second: Where Does Whistleblowing Fit Within Governance and Compliance?

A Whistleblowing Policy forms one of the central pillars of an organisation's governance and compliance framework.

It does not operate in isolation.

Instead, it complements and reinforces the policies discussed throughout this series, including:

The Code of Conduct, which defines expected standards of professional behaviour.
The Safeguarding Policy, protecting everyone connected with the organisation.
The Prevention of Sexual Exploitation and Abuse (PSEA) Policy, addressing sexual exploitation, abuse, and misuse of organisational authority.
The Child Safeguarding Policy, protecting children participating in organisational activities.
The Anti-Fraud and Anti-Corruption Policy, discussed in the next article.
Enterprise Risk Management (ERM), which relies upon early identification of emerging risks.
Internal Audit and Internal Control Systems.
Human Resources Policies, including disciplinary procedures.

Whistleblowing therefore acts as the mechanism that enables organisations to detect weaknesses across their governance framework before those weaknesses develop into serious organisational failures.

Third: Why Has Whistleblowing Become a Core Donor Requirement?

International donors recognise that organisations without trusted reporting mechanisms frequently discover problems only after significant harm has already occurred.

Financial misconduct, safeguarding failures, conflicts of interest, abuse of authority, and governance failures often come to light because someone inside the organisation felt sufficiently safe to raise a concern.

For this reason, donors increasingly regard whistleblowing arrangements as a direct indicator of organisational maturity, transparency, accountability, and effective risk management.

During institutional assessments, funding organisations do not merely verify whether a written Whistleblowing Policy exists.

They also evaluate:

Whether reporting mechanisms are trusted.
Whether whistleblowers are adequately protected.
Whether investigations are conducted independently.
Whether concerns are handled fairly and confidentially.
Whether lessons learned are used to improve organisational systems.

Consequently, an effective whistleblowing system does far more than identify misconduct.

It demonstrates an organisation's ability to govern itself responsibly, protect public resources, and maintain the confidence of beneficiaries, partners, regulators, and donors alike.

Fourth: What Is the Difference Between Whistleblowing, Complaints, and Grievances?

One of the most common misunderstandings within organisations is the assumption that whistleblowing, complaints, and grievances are interchangeable. Although these mechanisms may appear similar, they serve fundamentally different purposes and should be managed through separate procedures.

Whistleblowing

Whistleblowing concerns the disclosure of information relating to conduct that may expose the organisation, its beneficiaries, employees, volunteers, resources, or reputation to significant risk. It is intended to protect the wider public interest rather than resolve an individual's personal concern.

Examples include:

Suspected fraud or corruption.
Abuse of authority.
Serious breaches of the Code of Conduct.
Safeguarding concerns.
PSEA incidents.
Child safeguarding concerns.
Misuse of organisational assets.
Deliberate manipulation of records or reports.
Serious legal or regulatory breaches.

Complaints

A complaint generally concerns dissatisfaction with the quality of services, programme delivery, or the behaviour of organisational representatives.

Complaints seek to improve service quality and beneficiary experience rather than investigate organisational misconduct.

Grievances

A grievance relates to an individual's employment or contractual relationship with the organisation.

Typical grievances include concerns regarding recruitment decisions, workplace conditions, disciplinary actions, performance evaluations, or employment rights.

Unlike whistleblowing, grievances are intended to resolve personal employment disputes rather than protect organisational integrity.

Distinguishing clearly between these three mechanisms enables organisations to direct each matter to the appropriate process while preventing misuse of whistleblowing procedures.

Fifth: Who Should Be Able to Raise a Concern?

A mature whistleblowing system should be accessible to anyone who becomes aware of conduct that could threaten organisational integrity or the safety of those connected with the organisation.

Accordingly, reporting mechanisms should be available to:

Employees.
Volunteers.
Members of the Board of Trustees.
Consultants and advisers.
Contractors.
Suppliers.
Implementing partners.
Beneficiaries.
Parents or guardians where appropriate.
Any individual interacting with the organisation.

Importantly, whistleblowers are not expected to prove misconduct before reporting it.

They are only expected to report concerns in good faith, based upon reasonable grounds for believing that misconduct, wrongdoing, or significant organisational risk may exist.

Investigating those concerns remains the responsibility of the organisation.

Sixth: How Can Concerns Be Reported?

People differ in their circumstances and their confidence when reporting sensitive concerns.

For this reason, effective organisations do not rely upon a single reporting channel.

Instead, they provide several secure and accessible options, including:

A dedicated whistleblowing email address.
Secure online reporting forms.
Confidential telephone reporting lines.
Physical reporting boxes where appropriate.
Direct reporting to designated Compliance Officers.
Independent external reporting platforms operated by specialist providers.

Whatever reporting channels are adopted, they should be:

Easy to access.
Clearly communicated.
Available to all relevant stakeholders.
Supported by clear guidance explaining what should be reported and how reports will be handled.

Seventh: What Types of Reports Can Be Submitted?

Not everyone feels comfortable revealing their identity when raising concerns.

Consequently, mature whistleblowing systems generally recognise three types of reports.

Open Reports

In an open report, the whistleblower identifies themselves and is willing to cooperate throughout the investigation.

Open reports often facilitate more effective investigations because investigators can seek clarification or additional evidence where necessary.

Confidential Reports

In confidential reporting, the organisation knows the whistleblower's identity but undertakes to protect that information and disclose it only where strictly necessary and in accordance with organisational policy or legal requirements.

This approach balances confidentiality with the practical needs of an investigation.

Anonymous Reports

Anonymous reports allow individuals to submit concerns without revealing their identity.

Although anonymity may make investigations more challenging, anonymous reporting remains an important safeguard where individuals fear retaliation or believe that disclosure of their identity could expose them to personal risk.

Many leading organisations therefore investigate anonymous reports whenever sufficient information has been provided to justify further enquiries.

Eighth: Who Should Receive Whistleblowing Reports?

Whistleblowing reports should not automatically be submitted to an employee's immediate manager, particularly where that manager could be involved in the reported concern.

Such arrangements create conflicts of interest and may undermine confidence in the reporting process.

Instead, organisations should clearly identify the individuals or bodies responsible for receiving whistleblowing reports.

Depending upon organisational size and governance arrangements, this responsibility may rest with:

A Compliance Officer.
A designated Whistleblowing Officer.
An Audit Committee.
A Governance Committee.
The Board of Trustees, particularly where allegations concern senior executives.
An independent external reporting provider.

Clearly allocating responsibilities helps ensure that concerns are directed to appropriately independent decision-makers while strengthening confidence in the integrity of the whistleblowing process.

Ninth: What Does the Whistleblowing Process Look Like?

An effective whistleblowing system follows a structured and transparent process that ensures fairness, consistency, confidentiality, and accountability.

Although organisations may adapt procedures to suit their governance arrangements, the process generally follows these stages:

Concern Raised

↓

Acknowledgement of Receipt

↓

Preliminary Assessment

↓

Classification and Risk Assessment

↓

Appointment of an Independent Investigator

↓

Formal Investigation

↓

Decision and Corrective or Disciplinary Action

↓

Communication of Outcome (where appropriate)

↓

Case Closure and Secure Record Keeping

↓

Lessons Learned and Organisational Improvement

Following a clearly defined process ensures that every concern is managed consistently while demonstrating that the organisation takes whistleblowing seriously and treats all parties fairly.

Tenth: The Fundamental Principles of an Effective Whistleblowing System

The effectiveness of a whistleblowing system is not measured by the number of reports it receives, but by the level of confidence it inspires and its ability to handle concerns professionally, fairly, independently, and consistently.

For this reason, every effective whistleblowing framework should be built upon several core principles.

Confidentiality

The identity of the whistleblower, together with all information relating to the report, should be protected and disclosed only to those whose responsibilities require access to that information.

Confidentiality protects not only the whistleblower but also the integrity of the investigation and the rights of everyone involved.

Maintaining confidentiality reduces speculation, prevents unnecessary reputational damage, and encourages individuals to report concerns without fear.

Independence

Whistleblowing concerns should always be managed independently from those who may be implicated in the allegation.

Investigators should be free from conflicts of interest and able to conduct enquiries objectively and without inappropriate influence.

Many organisations therefore appoint a dedicated Compliance Officer, establish an Audit or Governance Committee, or engage an independent external provider to oversee sensitive cases.

Where allegations involve senior management or members of the Board, responsibility should automatically transfer to an independent governance body with appropriate authority.

Fairness

Receiving a whistleblowing report does not imply that misconduct has occurred, nor should the organisation assume that the concern is unfounded.

Every report should be assessed impartially, with all parties treated fairly and respectfully.

Investigations should be evidence-based, proportionate, and conducted in accordance with established organisational procedures rather than assumptions or personal opinions.

Fairness protects both the whistleblower and the individual who is the subject of the allegation while maintaining confidence in the integrity of the system.

Timely Response

Delays in responding to whistleblowing concerns may allow misconduct to continue, evidence to disappear, or confidence in the reporting system to deteriorate.

Organisations should therefore establish clear timeframes covering:

Acknowledgement of receipt.
Initial assessment.
Commencement of investigation.
Case management updates where appropriate.
Completion and closure of investigations.

Prompt action demonstrates organisational commitment to accountability and reinforces confidence in the whistleblowing process.

Accessibility

A reporting system is of little value if people do not know it exists or find it difficult to use.

Reporting mechanisms should therefore be:

Easy to locate.
Clearly explained.
Available to all relevant stakeholders.
Appropriate for different languages, abilities, and operating contexts where necessary.

Regular awareness campaigns and induction training should ensure that everyone understands how and when concerns should be reported.

Eleventh: Protecting Whistleblowers—The Foundation of an Effective System

Experience across both the public and non-profit sectors consistently demonstrates that the greatest barrier to whistleblowing is fear of retaliation, rather than the absence of reporting channels.

Retaliation may take many forms, including:

Direct or indirect threats.
Unfair performance assessments.
Exclusion from meetings or projects.
Denial of promotion opportunities.
Termination of employment or volunteer arrangements.
Damage to professional reputation.
Workplace isolation or intimidation.

To address these risks, leading organisations adopt a formal Non-Retaliation Policy, making a clear organisational commitment that no adverse action will be taken against any individual who raises a concern in good faith, even if an investigation ultimately concludes that no misconduct occurred.

Protecting whistleblowers is not simply an employee welfare measure.

It is an essential governance safeguard that enables organisations to identify risks before they escalate into serious organisational failures.

Twelfth: What About Malicious or Bad-Faith Reports?

Protecting whistleblowers does not mean accepting every report without scrutiny.

Professional whistleblowing systems distinguish carefully between reports submitted in good faith and those submitted maliciously.

Good-Faith Reporting

A report made in good faith is one submitted because the individual genuinely and reasonably believes that misconduct, wrongdoing, or significant organisational risk may exist.

Even where an investigation finds that no misconduct occurred, the whistleblower remains entitled to organisational protection provided the concern was raised honestly and responsibly.

Malicious Reporting

A malicious report is one deliberately submitted with knowledge that the allegation is false, or with the intention of harming another individual, damaging reputations, or pursuing personal advantage.

Such behaviour represents misconduct in its own right and should be addressed through the organisation's disciplinary procedures.

An effective whistleblowing system therefore balances two equally important principles:

Protecting everyone who reports concerns in good faith.
Preventing deliberate misuse of the reporting process.

Thirteenth: Managing Conflicts of Interest During Investigations

One of the greatest risks to the credibility of a whistleblowing system arises when the individual responsible for receiving or investigating reports is themselves the subject of the allegation or has a close relationship with those involved.

For this reason, every whistleblowing policy should include clear procedures for managing conflicts of interest.

For example:

Reports concerning an employee's immediate manager should bypass that manager entirely.
Allegations involving the Compliance Officer should be referred directly to the Audit Committee or Board of Trustees.
Allegations concerning the Chief Executive Officer should be overseen by the Board or an independent committee.
Where a Board member is the subject of a report, that individual should be excluded from all aspects of the investigation and decision-making process.

Maintaining independence throughout investigations protects organisational integrity and reinforces confidence that everyone is accountable to the same standards, regardless of seniority.

Fourteenth: How Do Donors Assess Whistleblowing Arrangements?

International donors no longer regard the existence of a written Whistleblowing Policy as sufficient evidence of organisational readiness.

Instead, they seek practical evidence demonstrating that whistleblowing arrangements operate effectively in practice.

During Organisational Readiness Assessments, funding organisations commonly review whether the organisation has:

A formally approved Whistleblowing Policy.
A clear Non-Retaliation Policy protecting whistleblowers.
Multiple confidential reporting channels.
Anonymous reporting arrangements where appropriate.
Written investigation procedures.
Clearly defined governance responsibilities.
Secure case management and record-keeping arrangements.
Regular policy reviews and organisational learning processes.
Mandatory whistleblowing training.
Periodic reporting to the Board or Audit Committee regarding system effectiveness.

Organisations capable of demonstrating these practical measures are significantly better positioned to satisfy donor expectations and strengthen confidence among beneficiaries, regulators, and funding partners.

Fifteenth: Common Mistakes That Undermine the Effectiveness of a Whistleblowing System

Many organisations invest significant time and effort in developing comprehensive whistleblowing policies and establishing multiple reporting channels. Nevertheless, these systems often fail to achieve their intended purpose because confidence in the process is weakened by poor implementation rather than inadequate documentation.

Among the most common mistakes are the following:

Viewing Reports as a Sign of Organisational Failure

Some organisations assume that receiving a large number of whistleblowing reports reflects poor organisational performance.

In reality, the opposite may be true.

A healthy reporting culture often demonstrates that employees and volunteers trust the organisation enough to raise concerns before problems escalate into serious incidents.

Organisations should therefore focus on the quality of reporting and organisational learning rather than attempting to minimise the number of reports received.

Failing to Communicate with the Whistleblower

One of the quickest ways to lose confidence in a reporting system is to acknowledge neither the receipt nor the progress of a report.

While confidentiality must always be respected, organisations should keep whistleblowers appropriately informed by:

Confirming receipt of the concern.
Explaining the next steps in the process.
Providing updates where appropriate.
Informing the whistleblower when the case has been concluded, subject to confidentiality obligations.

Such communication reinforces trust without compromising the integrity of the investigation.

Using Whistleblowing to Resolve Personal Disputes

Where organisations fail to define clearly what constitutes whistleblowing, reporting mechanisms may become a means of pursuing personal disagreements or workplace conflicts.

To prevent misuse, policies should clearly distinguish whistleblowing from complaints and grievances and ensure that each concern is directed to the appropriate organisational process.

Insufficient Awareness and Training

Even well-designed reporting systems are ineffective if employees and volunteers are unaware that they exist or do not understand how to use them.

Whistleblowing awareness should therefore form part of:

Staff induction.
Volunteer orientation.
Periodic refresher training.
Internal governance communications.
Leadership messaging.

Regular communication reinforces confidence and encourages responsible reporting.

Focusing Only on Investigation Rather Than Prevention

Whistleblowing should never be viewed solely as a mechanism for investigating wrongdoing after it has occurred.

Every report should also be treated as an opportunity to identify weaknesses within organisational systems, strengthen internal controls, improve policies, and reduce the likelihood of future incidents.

Organisations that learn from concerns become progressively stronger and more resilient over time.

Sixteenth: Indicators of a Mature Whistleblowing System

The maturity of a whistleblowing system cannot be measured simply by counting the number of reports received.

In some cases, unusually low reporting levels may indicate fear, lack of confidence, or limited awareness rather than the absence of misconduct.

Instead, organisational maturity is reflected through a number of governance indicators.

A mature organisation typically demonstrates:

Full integration of whistleblowing within governance, compliance, and Enterprise Risk Management.
Active oversight by the Board of Trustees or Audit Committee.
High levels of confidence among employees and volunteers.
Regular policy reviews and continuous improvement.
Consistent use of investigation outcomes to strengthen organisational controls.
Ongoing awareness and training programmes for all personnel.

Leading organisations also monitor performance using measurable Key Performance Indicators (KPIs) such as:

Average response time to reported concerns.
Average investigation completion time.
Percentage of cases resolved within established service standards.
Percentage of employees and volunteers completing whistleblowing training.
Frequency of Board or Audit Committee reviews.
Number of policy or procedural improvements resulting from whistleblowing investigations.
Percentage of substantiated reports.
Frequency of repeated incidents following corrective action.

Monitoring these indicators enables organisations to evaluate the effectiveness of their whistleblowing arrangements objectively while supporting continuous organisational improvement.

Seventeenth: Whistleblowing as a Component of Enterprise Risk Management

Modern organisations no longer regard whistleblowing as an isolated governance function.

Instead, it forms an integral component of Enterprise Risk Management (ERM).

Whistleblowing provides early warning information regarding risks that may not be visible through financial reporting, internal audits, operational monitoring, or performance indicators alone.

Analysis of whistleblowing data enables organisations to:

Identify weaknesses within organisational systems.
Detect emerging risks before they escalate.
Strengthen internal controls.
Improve governance decision-making.
Update organisational risk registers.
Enhance institutional resilience.

Rather than treating reports as isolated incidents, mature organisations analyse reporting trends to generate organisational knowledge that supports strategic planning, risk mitigation, and continuous improvement.

Before Moving to the Next Article...

If your organisation wishes to strengthen its institutional readiness, begin by taking the following practical steps:

✓ Formally adopt a comprehensive Whistleblowing Policy.

✓ Designate an independent individual or committee responsible for receiving and managing reports.

✓ Establish multiple confidential and accessible reporting channels.

✓ Adopt a clear Non-Retaliation Policy protecting whistleblowers acting in good faith.

✓ Provide whistleblowing training for all employees, volunteers, and relevant stakeholders.

✓ Integrate whistleblowing into governance, compliance, and Enterprise Risk Management.

✓ Review the effectiveness of reporting arrangements regularly and report findings to the Board or Audit Committee.

✓ Use investigation outcomes to strengthen organisational policies, procedures, and internal controls.

These practical actions provide the foundation for building an organisational culture in which integrity, accountability, and transparency are embedded throughout everyday operations.

Quick Self-Assessment

Consider the following questions:

□ Does our organisation have a formally approved Whistleblowing Policy?

□ Do employees and volunteers understand how to report concerns safely?

□ Are confidential reporting channels available and easily accessible?

□ Do we have a formal Non-Retaliation Policy?

□ Are investigations conducted independently and fairly?

□ Does the Board or Audit Committee receive regular whistleblowing reports?

□ Are investigation outcomes used to improve organisational systems?

□ Is whistleblowing integrated into Enterprise Risk Management?

If you answered "No" to more than two of these questions, your organisation may need to strengthen this important element of institutional readiness.

Conclusion

An effective Whistleblowing System is one of the most important components of organisational governance and compliance because it enables institutions to identify risks at an early stage and address them before they develop into crises affecting beneficiaries, employees, organisational resources, or public trust.

However, successful whistleblowing is not achieved simply by publishing a policy or creating a reporting mailbox.

It depends upon committed leadership, independent governance, fair investigative procedures, genuine protection for whistleblowers, and an organisational culture that encourages responsible reporting while viewing concerns as opportunities for learning and continuous improvement rather than sources of conflict.

Organisations that successfully integrate whistleblowing into their governance, compliance, and Enterprise Risk Management frameworks become better equipped to protect their humanitarian mission, strengthen accountability, build donor confidence, and sustain long-term organisational resilience.

This article forms the sixth chapter in the series "Building a Funding-Ready and Institutionally Compliant Charity." It has examined the governance mechanism that transforms organisational policies into practical accountability by enabling people to speak up safely whenever concerns arise.

Having established a trusted mechanism for identifying misconduct and organisational risks, we now turn to one of the most important preventative governance frameworks:

Anti-Fraud and Anti-Corruption: How Can Your Organisation Protect Donor Funds and Strengthen Institutional Integrity?

In the next article, we will examine how charitable organisations can develop comprehensive anti-fraud and anti-corruption systems, strengthen financial controls, manage fraud risks proactively, and safeguard donor resources in accordance with international governance standards and donor expectations.

sign in