Template · Governance
Whistleblower policy
A short policy that tells staff, volunteers and board members how to report wrongdoing safely, and promises they won't be punished for it.
The Word file opens in Microsoft Word, Google Docs, Pages and LibreOffice. Reviewed October 14, 2026.
A whistleblower is someone who reports something they believe is wrong inside an organization, like money going missing, a law being broken or someone being put at risk. A whistleblower policy tells people how to raise a concern and promises that the charity won't punish them for doing it in good faith.
The IRS describes a whistleblower policy as one that "encourages staff and volunteers to come forward with credible information on illegal practices or violations of adopted policies of the organization, specifies that the organization will protect the individual from retaliation, and identifies those staff or board members or outside parties to whom such information can be reported." Form 990 asks whether you have one. The Form 990 instructions also point out that federal law (18 U.S.C. section 1513(e)) makes it a crime for any organization, including a charity, to retaliate against someone who reports a federal offense. Some states add more protection.
Even a tiny, all-volunteer charity benefits from this policy. It makes problems come out early, when they are small.
How to adapt it
- Name at least two people who can receive reports, so no one ever has to report to the person they are worried about. In a very small charity, one of them can be a trusted outsider, such as your accountant or a lawyer.
- Fill in how people can reach them. Use a role-based contact (like a shared board inbox) rather than a personal one if you can.
- Check whether your state has its own whistleblower law and add anything it requires.
Preview
Whistleblower policy of [ORGANIZATION NAME]
Adopted by the Board of Directors on [DATE].
1. Purpose
[ORGANIZATION NAME] (the "Organization") expects its directors, officers, employees and volunteers to act honestly and follow the law. This policy explains how anyone can report a concern about possible wrongdoing, and promises that people who report in good faith will be protected from retaliation.
2. Who this policy covers
This policy covers all directors, officers, employees, volunteers and contractors of the Organization.
3. What to report
You are encouraged to report any concern, in good faith, about:
- theft, fraud or misuse of the Organization's money or property;
- false or misleading financial records, reports or tax filings;
- breaking any federal, state or local law;
- breaking any of the Organization's policies, including the conflict of interest policy;
- risks to the health or safety of the people we serve, volunteers or staff;
- the destruction of records connected to an investigation or legal case; or
- any attempt to hide any of the above.
"Good faith" means you honestly believe what you are reporting is true. You don't need proof before you report.
4. How to report
- You may report to [NAME AND ROLE, FOR EXAMPLE CHAIR OF THE BOARD] at [HOW TO CONTACT].
- Or you may report to [NAME AND ROLE, FOR EXAMPLE TREASURER OR AN OUTSIDE ADVISOR] at [HOW TO CONTACT].
- If your concern involves one of these people, report to the other. If it involves both, report to any other director.
- You may report in writing or in person. You may report anonymously, but it may be harder to look into a concern if we can't ask you questions.
5. What happens after a report
- The person who receives the report will confirm receipt within [NUMBER] days, unless the report was anonymous.
- They will tell the Chair of the Board, unless the report involves the Chair, in which case they will tell [ROLE, FOR EXAMPLE THE TREASURER OR ANOTHER DIRECTOR].
- The Board, or a person or committee it appoints who is not involved in the concern, will look into the report promptly and fairly.
- Anyone named in a report will have a chance to respond.
- If the concern is confirmed, the Board will take appropriate action. This may include fixing the problem, disciplining or removing the people involved, or reporting the matter to the authorities.
- Where appropriate, the person who reported will be told the outcome, as far as privacy and the law allow.
6. No retaliation
- No one who reports a concern in good faith will be fired, removed from a volunteer role, demoted, threatened, harassed or treated unfairly in any other way because of the report.
- This protection applies even if the concern turns out to be mistaken.
- Anyone who retaliates against a person who reported in good faith will face discipline, up to and including removal from their role.
- If you believe you have been retaliated against, report it the same way as in section 4.
7. Confidentiality
The Organization will keep the identity of the person who reported, and the details of the report, as confidential as possible, sharing them only with those who need to know to look into the concern or as the law requires.
8. False reports
Anyone who knowingly makes a false report will face discipline. A report made in good faith that turns out to be wrong is not a false report.
9. Records
The Secretary will keep a confidential record of each report, how it was handled and the outcome, in line with the Organization's document retention policy.
10. Sharing this policy
The Organization will give a copy of this policy to every director, officer, employee and volunteer, and will make it available on request.
11. Review
The Board will review this policy at least every [NUMBER] years.
General information. Not legal, tax or financial advice. Rules change and every situation is different, so check the official sources and talk to a qualified professional before you act. More about this.
Sources
Checked on October 14, 2026. Rules and fees change, so follow the links for the current version.