How would your organization respond if an employee voiced a concern about ethical or legal violations by an executive or other staff member? Are you well-prepared to investigate an accusation and what consequences would there be if the accusation is correct?
All organizations should have a whistleblower policy that tells people how to report suspicious or unethical behavior and how the organization will respond to reports. The IRS Form 990 asks if you’ve adopted a written whistleblower policy. It’s not required in order to maintain tax-exempt status, but it is encouraged as a way to maintain good governance and compliance. A written policy, and the behavior it encourages, can help protect your organization from financial losses, fraud from employees or vendors, and damage to your reputation. If a problem is reported internally, you have the opportunity to address and correct it before the media, law enforcement, or regulators hear about it, and possibly prevent the information from becoming public knowledge outside of the organization.
When answering the Form 990 question about adopting a whistleblower policy, the policy must meet at least 3 criteria for you to be answer affirmatively. It must:
- Encourage staff and volunteers to come forward with information about illegal behavior or violations of organizational policies
- Explicitly state that your organization will protect the whistleblower from retaliation for coming forward with the information
- Identify who information can be reported to, whether it be board or staff members, or outside parties
On top of that, it’s helpful to include additional about the whistleblowing procedure and how you will respond to reports. Consider addressing these topics:
- Who is covered? The policy should at least cover behavior by staff, volunteers, and board members, and you may decide to include outside parties who do business with your organization, such as clients, vendors, and contractors.
- What is covered? What types of behavior should be reported? Fraud and theft may be the most obvious, but the policy should be broad enough to include any illegal activity, and address violations of internal policies, such as conflicts of interest, discrimination, or unsafe work conditions.
- How should information be reported? Is there a specific person or committee people should go to, or a hotline they can call? Can they report information anonymously and confidentially? Who should a whistleblower go to if the person in charge of reporting is suspected of wrongdoing?
- How will accusations be investigated? Potential whistleblowers will want to know how you’ll respond to their reports and how you’ll handle investigations and follow-ups. Ensure that every concern that’s reported will be addressed promptly and thoroughly, and that the people investigating will be independent and objective. After the investigation is complete, will the whistleblower receive feedback? If the accusation is substantiated, what action will you take towards the person who acted illegally or unethically?
- Acting in good faith. People reporting inappropriate behavior should act in good faith. If someone makes an accusation with malicious intent, or one that is reckless or knowingly false, disciplinary action is warranted against the person making the report.
Ensuring ethical behavior in your organization goes beyond having a written whistleblower policy. You should foster a culture that encourages ethical behavior, as well as allowing people to raise concerns without fear of retaliation or hostility. Concerns that are raised about inappropriate behavior should be dealt with promptly and thoroughly to show reports will be taken seriously. Accusations will probably uncomfortable and unpleasant to investigate and resolve, but it’s important to keep in mind that it’s ultimately for the good of your organization to weed out issues before they cause a larger problem.
You can find sample policies from the National Council for Nonprofits, Montana Nonprofit Association, and AICPA. Law firm Wagenmaker and Oberly provides a run-through of a hypothetical whistleblowing report and how to respond to it.