This free whistleblowing checklist is for compliance officers, HR and legal teams and the designated whistleblowing officer who receive concerns through an internal reporting channel. It takes one report from receipt to closure: recording and acknowledgement, confidentiality, triage, an impartial investigation plan, evidence and interviews, feedback to the reporter, remediation, retaliation checks and records. It follows the EU Whistleblowing Directive, adapts to UK and other regimes, and leaves a reviewed, dated record of every decision on the case.
A whistleblowing report is about wrongdoing that affects others: fraud, bribery, a safety failure, a breach of law. The person raising it is protected from retaliation for doing so. Handle a report badly and the wrongdoing continues, while a reporter who is ignored or exposed takes the concern to a regulator or the press.
ISO 37002:2021, the guidance standard for whistleblowing management systems, splits the work into receiving, assessing, addressing and concluding, built on trust, impartiality and protection. The phases below follow that order. What the law adds depends on where your workers are.
Who: private employers with 50 or more workers must run internal channels. Those with 50 to 249 workers had until 17 December 2023 and may share resources for receiving and investigating reports.
Clocks: acknowledge within seven days; give feedback within a reasonable time, no later than three months after the acknowledgement.
Confidentiality: the reporter’s identity goes no further than authorised staff without their explicit consent, and every report is recorded.
Watch: national laws fill in the detail, such as whether anonymous reports must be followed up and how long records are kept.
Duty: most employers have no legal duty to run a channel or respond, though government guidance urges both. Workers who make a protected disclosure are protected from detriment (s.47B) and dismissal (s.103A).
New: since 6 April 2026, a disclosure that sexual harassment has occurred or is likely to occur is a qualifying disclosure in its own right (s.43B(1)(da)).
Regulated firms: FCA rules in SYSC 18 require UK banks, building societies and Solvency II insurers to run internal arrangements, give feedback where appropriate and appoint a whistleblowers’ champion.
In the US, a listed company’s audit committee must have procedures for confidential, anonymous employee concerns about accounting or auditing (Exchange Act Rule 10A-3). Section 806 of the Sarbanes-Oxley Act protects public company employees from retaliation, and the SEC pays awards of 10% to 30% when original information leads to sanctions over $1 million.
Six phases, one checklist per report. Your answers decide which steps appear, and both deadlines run from the date the report was received.
The first task’s answers set both deadlines, decide which acknowledgement and feedback steps appear and name the reviewer who signs off the case.
An out-of-scope report gets a routing task. Phases 3 and 4 appear only when the report is wholly or partly in scope.
Shown only for reports in scope. The anonymous-contact task appears only when the reporter is anonymous.
The regime answer decides which feedback task appears. The findings answer on the last task decides whether Phase 5 appears.
Shown only when the findings substantiate at least part of the report.
The closure approval is assigned to the independent reviewer named in Phase 1.
The table maps each requirement for handling a single report to its source under the EU Directive and in the UK, and to the phase that records the evidence. National transposing laws and sector rules add to it, so treat the table as a starting point, not legal advice.
| Requirement | EU Directive 2019/1937 | UK | Evidenced in |
|---|---|---|---|
| Internal channel | Art. 8: private employers with 50+ workers; 50–249 may share resources | No general duty; SYSC 18 for in-scope FCA firms | Phase 1 |
| Secure, confidential channel | Arts. 9(1)(a) and 16 | SYSC 18.3.1R: confidential and anonymous reports | Phases 1 and 3 |
| Oral reports and meetings | Arts. 9(2) and 18(2)–(4): records the reporter can check and sign | Good practice | Phase 1 |
| Acknowledgement | Art. 9(1)(b): within seven days | No statutory deadline | Phase 1 |
| External routes | Art. 9(1)(g): information on reporting to competent authorities | Prescribed persons, ERA 1996 s.43F | Phase 1 |
| Protected subject matter | Art. 2 areas of Union law, often widened nationally | ERA 1996 s.43B, incl. sexual harassment from 6 April 2026 | Phase 2 |
| Impartial follow-up | Art. 9(1)(c)–(d) | SYSC 18.3.1R: assessment and escalation | Phases 2 and 3 |
| Anonymous reports | Arts. 6(2)–(3) and 9(1)(e): national law decides | SYSC 18.3.1R for in-scope firms | Phase 3 |
| Person concerned | Art. 22: presumption of innocence, right to be heard | No statutory equivalent | Phases 3 and 4 |
| Feedback | Art. 9(1)(f): within three months of acknowledgement | SYSC 18.3.1R: where feasible and appropriate | Phases 4 and 6 |
| Retaliation | Arts. 19 and 21(5): employer must justify any detriment | ERA 1996 ss.47B and 103A | Phases 3 and 6 |
| Records | Art. 18(1): every report, kept only as long as necessary | SYSC 18.3.1R: records and an annual board report | Phase 6 |
Some of this was moving at the time of review. Every member state has a transposing law, but several arrived years late: on 6 March 2025 the Court of Justice ordered Germany, the Czech Republic, Hungary, Luxembourg and Estonia to pay for late transposition, Germany €34 million. The Commission’s evaluation of the Directive was still under way, after a public consultation that closed on 22 April 2026, so expect amendments to be discussed. Nothing on this page is legal advice.
Dynamic due dates run from the receipt date you record: the acknowledgement at seven days and the feedback at three months. Answer the regime question and only the steps that apply appear, so an EU case and a UK case run on the same template.
Tasks go to the named handler and investigator, the case carries a reference rather than a name, and conditional logic keeps the investigation phases hidden until the report is confirmed in scope.
The closure approval goes to the reviewer named at intake, and the checklist halts until it is answered. Every step records who completed it and when, which is what a tribunal or regulator will ask for.
CheckFlow is not a whistleblowing channel or a case-management system, and it gives no legal advice. Reports should come in through a dedicated, confidential tool, such as a secure web platform or hotline with an anonymous two-way mailbox, and stay there. CheckFlow tracks the handling steps around them, with access limited to the people on the case. A quarterly checklist on a recurring schedule can review the channel itself: volumes, response times, outcomes and retaliation complaints. CheckFlow’s HR checklist software runs the people processes around it.
Related jobs have their own templates. The Conflict of Interest Declaration Checklist runs the annual disclosure campaign that often surfaces the same issues earlier, and the Annual Policy Review Checklist keeps the whistleblowing policy current. A report that turns into a legal claim moves to the Legal Case Intake Checklist.
Under the EU Directive, within seven days of receipt, with feedback no later than three months after the acknowledgement, or three months after the seven days ran out if no acknowledgement was sent. National laws can be stricter. UK law sets no deadline, but acknowledging within a week and saying what happens next is the simplest way to keep a reporter inside your process.
Most do not. The governmentMost do not. Government guidance for employers, updated in April 2026, saysrsquo;s guidance for employers, in its 6 April 2026 version, says there is no legal requirement to have a policy or to respond to disclosures, while setting out why you should. Firms within SYSC 18, such as UK banks, building societies and Solvency II insurers, must have arrangements, and public bodies and regulated sectors often have their own rules. The protection for workers applies either way.
The Directive leaves it to each member state, so check the transposing law where your workers are. An anonymous reporter who is later identified and suffers retaliation is still protected. Even where follow-up is optional, a channel with a two-way anonymous mailbox lets you ask questions and give feedback without learning who the reporter is.
A grievance is about the worker’s own treatment, such as pay, workload or a dispute with a manager. A whistleblowing report is about wrongdoing with a wider impact. In the UK it must be in the reasonable belief that disclosure is in the public interest. One message can contain both, so the checklist routes the personal part to HR and keeps the rest.
The Directive defines feedback as information on the action planned or taken and the grounds for it. That does not mean handing over the investigation report or disciplinary outcomes for named colleagues. A short account of what was looked at, what changed and why usually meets the definition.
Article 18 requires a record of every report, kept no longer than necessary and proportionate, and data protection law applies throughout. Personal data plainly irrelevant to the report should not be collected or should be deleted. National laws set the figure: Germany’s HinSchG, for example, deletes the documentation three years after the procedure ends unless a longer period is needed.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
