Whistleblower policies protect individuals who risk their careers — or take other kinds of risks — to report illegal or unethical practices. Although no federal law specifically requires non-profits to have such policies in place, several state laws do. Moreover, IRS Form 990 asks non-profits to state whether they have adopted a whistleblower policy.

Adopting a whistleblower policy increases the odds that you will learn about activities before the media, law enforcement, or regulators do. Encouraging stakeholders to speak up also sends a message about your commitment to good governance and ethical behavior.

Be inclusive

Your policy should be tailored to your organization’s unique circumstances, but most policies should spell out who is covered. In addition to employees, volunteers, and board members, you might want to include clients and third parties who conduct business with your organization, such as vendors and independent contractors.

Also specify covered misdeeds. Financial malfeasance often gets the most attention, but you also might include violations of organizational client protection policies, conflicts of interest, discrimination, and unsafe work conditions.

And how should whistleblowers report their concerns? Must they notify a compliance officer, or can they report anonymously? Is a confidential hotline available? Whom can whistleblowers turn to if the designated individual is suspected of wrongdoing?

Investigate thoroughly

Covered individuals and other stakeholders need to know how you will handle reports once they are submitted. Your policy should state that every concern will be promptly and thoroughly investigated and that designated investigators will have adequate independence to conduct an objective query.

Also describe what will happen after the investigation is complete. For example, will the reporting individual receive feedback? Will the individual responsible for the illegal or unethical behavior be punished? If your organization opts not to take corrective action, document your reasoning.

Stress confidentiality

Do not forget to stress confidentiality. Explain in your policy that it may not be possible to guarantee a whistleblower’s identity if he or she needs to become a witness in criminal or civil proceedings. But promise you will protect confidentiality to the extent possible. Finally, be sure to have your attorney review your whistleblower policy.