Row edge-slant Shape Decorative svg added to bottom

Template

Free Nonprofit Whistleblower Protection Policy

A free nonprofit whistleblower protection policy template for 501(c)(3) organizations. Meets IRS Form 990 requirements and Sarbanes-Oxley guidelines. Download or import into ClearPolicy for staff and board signatures.

This template is provided for informational purposes and should be adapted to fit your organization's specific context. It is not legal advice.

Preview

Whistleblower Protection Policy

[ORGANIZATION NAME] Adopted: _______________ | Last Reviewed: _______________

1. Purpose

[Organization Name] (the “Organization”) is committed to ethical conduct, legal compliance, and responsible stewardship of its resources. This policy encourages directors, officers, employees, and volunteers to report concerns about illegal activity, financial misconduct, or violations of organizational policy — and protects those who do so from retaliation.

The Organization believes that honest, open reporting is essential to good governance. People who raise concerns in good faith are performing a valuable service to the Organization and the communities it serves.

2. Who This Policy Covers

This policy applies to all:

  • Members of the Board of Directors
  • Officers and executive leadership
  • Employees (full-time, part-time, and temporary)
  • Volunteers

Together, these individuals are referred to as “covered persons.”

3. What Should Be Reported

Covered persons are encouraged to report any good-faith concern about:

  • Fraud, theft, or misappropriation of organizational funds or assets
  • Falsification of financial records, reports, or tax filings
  • Violations of federal, state, or local law
  • Violations of the Organization’s adopted policies (including this policy)
  • Actions that could jeopardize the Organization’s tax-exempt status
  • Any other conduct that is illegal, unethical, or contrary to the Organization’s mission

This policy is not intended for personal employment grievances (e.g., disputes about scheduling, compensation, or interpersonal conflict). Those should be addressed through the Organization’s standard personnel procedures.

4. How to Report a Concern

Concerns may be reported to:

  • Board Chair: [Name / Email]
  • Executive Director: [Name / Email] (if not implicated in the concern)

If the concern involves the Executive Director or Board Chair, it should be reported directly to the full Board of Directors or its designated committee.

Reports may be made verbally or in writing. The Organization encourages written reports to ensure accuracy and to create a clear record.

Anonymous reporting: Covered persons may report concerns anonymously. Anonymous reports will be taken seriously and investigated to the extent reasonably possible given the information provided.

5. Protection from Retaliation

The Organization strictly prohibits retaliation against any covered person who, in good faith:

  • Reports a concern under this policy
  • Participates in an investigation related to a reported concern
  • Refuses to participate in activity they reasonably believe to be illegal or unethical

Prohibited retaliation includes termination, demotion, suspension, harassment, or any other adverse action taken because of a protected report.

Any covered person who retaliates against a whistleblower is subject to disciplinary action, up to and including removal from their role.

Federal law note: The Sarbanes-Oxley Act (Section 1107) makes it a federal crime to retaliate against anyone who provides truthful information about a possible federal offense to a law enforcement officer. Violations may result in fines or imprisonment.

6. Investigation Procedure

All reports will be:

  1. Acknowledged promptly (within 5 business days where possible)
  2. Reviewed by the Board Chair, Executive Director, or a designated board committee — excluding any individual implicated in the report
  3. Investigated in a timely, thorough, and confidential manner
  4. Documented, with findings recorded and retained

The Organization will take appropriate corrective action if a violation is confirmed, which may include disciplinary action, referral to law enforcement, or other remedies.

7. Confidentiality

The Organization will make reasonable efforts to protect the confidentiality of anyone who reports a concern. Complete anonymity cannot always be guaranteed — particularly if a matter requires legal proceedings — but the Organization will limit disclosure of the reporter’s identity to those with a genuine need to know.

8. Good Faith Requirement

This policy protects individuals who report concerns honestly and in good faith, even if the reported concern turns out to be unfounded. It does not protect individuals who make reports they know to be false, or who use this policy to harass others.

9. Annual Review

This policy will be reviewed by the Board at least once per year and updated as needed to reflect changes in law or organizational practice.

Disclaimer: This template is provided for informational purposes only and does not constitute legal advice. Whistleblower protections vary by state, and some states impose additional requirements beyond federal law. Consult a nonprofit attorney to ensure this policy meets the requirements of your state and organization.

Acknowledgment

I have received, read, and understand the Whistleblower Protection Policy of [Organization Name]. I agree to comply with this policy and understand that retaliation against anyone who reports a concern in good faith is strictly prohibited.

How Nonprofits use ClearPolicy

Having this policy is step one. Getting every board member, staff member, or volunteer to sign it — and proving they did — is where most nonprofits get stuck.

ClearPolicy lets you send this policy to your entire team with one click, collect electronic signatures without anyone needing an account, and see who's signed in real time. When your Form 990 is due or an auditor asks for documentation, your records are ready.

Row edge-slant Shape Decorative svg added to top
Row edge-slant Shape Decorative svg added to bottom

Stop chasing signatures every year

Most organizations email a PDF, wait, follow up, wait again, and still have missing signatures when their compliance deadlines are due. ClearPolicy is policy management software that was built to fix that.

1. Create a policy

Import this policy, upload your PDF, import from Google Drive, or write it in ClearPolicy. Update it anytime.

2. Add contacts

Staff, volunteers, board members—no user accounts needed.

3. Send for signatures

Send a secure link. Recipients review and sign electronically in seconds.

4. Track compliance

See who's signed, who hasn't, and who needs to re-sign after updates.

Send your first signature request in under 5 minutes

ClearPolicy helps nonprofits get policies signed electronically — with automatic reminders and audit-ready records.

Still deciding how to collect board signatures each year? Here's how your options compare →

Learn more