A whistleblower is a person, usually an employee or someone close to an organization, who reports wrongdoing such as fraud, corruption, safety risks, harassment or breaking the law, either inside the organization or to regulators, law enforcement or the media.
Whistleblowers and Whistleblowing in Contemporary Times
The terms whistleblower and whistleblowing are often mentioned in the media and in business publications. Further, we also hear how whistleblowers have brought to light instances of wrongdoing and other aspects to do with violations of corporate governance.
For instance, in 2017, the Indian IT (Information Technology) firm Infosys was in the news for alleged violations that an anonymous whistleblower highlighted to the stock exchanges and other regulatory authorities, including questions about its acquisition of the Israeli company Panaya and severance payments to former executives.
Indeed, Infosys dominated the headlines in the business press for all the wrong reasons, due to the anonymous whistleblower repeatedly bringing alleged violations to light. Thus, whistleblowers and whistleblowing are aspects that all aspiring and working management professionals must be aware of if they want to be “in the know” about the business world.
Who are Whistleblowers and What do they do?
So, who exactly are whistleblowers? To start with, given the instances of violations and issues related to corporate governance, it is important for companies to follow due procedures and norms in the day-to-day conduct of business (see Corporate Governance).
Having said that, it is also the case that many companies often “cover up” and hide instances of wrongdoing, due to which there is a need for highlighting such instances.
This is where whistleblowers come into the picture, wherein they bring to the notice of the relevant stakeholders issues related to violations of corporate governance and misconduct. Indeed, the term whistleblower literally means a person who “blows the whistle” on ethical and normative violations.
This can be done anonymously or openly: some whistleblowers choose to remain in the background, while others go public. Well-known examples include Sherron Watkins, the Enron vice president who warned the CEO about accounting problems in 2001, and Frances Haugen, the former Facebook employee who shared internal research with regulators and the press in 2021.
Why Whistleblowers Matter
Given the fact that there are always issues related to corporate governance and misconduct in many organizations, it is indeed the case that whistleblowers are much needed to ensure that due procedures and norms are followed.
- They uncover fraud early: studies by the Association of Certified Fraud Examiners consistently find that tips are the most common way occupational fraud is detected, ahead of internal audit and management review.
- They protect people: many safety problems in products, workplaces and public services come to light through employees.
- They protect the company: problems found and fixed internally cost far less than scandals, fines and lawsuits later (see Reputation Management in the Age of 24/7 Media).
- They support an ethical culture: when people know they can speak up safely, misconduct becomes riskier (see Business Ethics).
Laws That Protect Whistleblowers
| Country or region | Main law or program | What it does |
|---|---|---|
| United States | Sarbanes-Oxley Act (2002) and Dodd-Frank Act (2010) | Protect employees of public companies from retaliation; the SEC’s whistleblower program pays awards of 10% to 30% of sanctions over $1 million for original information |
| European Union | Whistleblower Directive (2019/1937) | Requires organizations with 50 or more workers to set up confidential reporting channels, and bans retaliation |
| United Kingdom | Public Interest Disclosure Act (1998) | Protects workers who make “protected disclosures” from unfair treatment |
| India | Companies Act, 2013 (Section 177) and SEBI Listing Regulations | Require listed and certain other companies to have a vigil mechanism (whistleblower policy) with direct access to the audit committee chair |
The SEC’s program is large: in fiscal year 2025 alone it received about 27,000 tips and awarded more than $60 million to 48 whistleblowers, and it has paid more than $2 billion in total since 2011.
How to Deal with Whistleblowers
That brings us to the point about how to deal with whistleblowers. To start with, any complaint or act of bringing to light violations must be taken seriously by all relevant stakeholders, including regulators and the wider corporate authorities.
Indeed, the complaints of whistleblowers must be treated with the attention they warrant and the importance they deserve if such complaints have merit.
In other words, whistleblowers and their complaints must not be derided or brushed under the carpet, and companies cannot go on pretending that such complaints are frivolous and do not merit the attention that must be accorded to them. Further, any complaint must be taken seriously, and only after ascertaining its merits and demerits must such acts be decided upon.
In other words, it is very important for companies to treat the complaints of whistleblowers by doing due diligence on them. This means that as soon as whistleblowers bring acts of omission and commission to light, such acts must be investigated and thoroughly processed to find out instances of violations and take possible action on them.
How to Proceed with Complaints?
Having said that, it is also the case that all complaints must be investigated or acted upon in a careful and thorough manner. Indeed, there are some whistleblowers who create a nuisance just for the sake of it and send in anonymous and public allegations without any basis or logic.
Such acts not only vitiate the atmosphere in companies, but they also have the effect of diverting and occupying the time and energy of decision makers. Indeed, this is the reason why many companies usually do not take complaints seriously, even when such complaints have merit in them.
Thus, the best course of action would be to first ascertain the facts of the case and then ensure that the complaints are investigated if there is any merit in them. This is the reason why regulators and some companies have dedicated committees and departments to deal with whistleblowers and their complaints.
Further, since the #MeToo movement from 2017 put a spotlight on sexual harassment and gender discrimination in corporate America and beyond, it is also the case that whistleblowers and their complaints are taken seriously and, at the same time, they are not hyped up (see How to Spot Signs of Sexual Harassment).
A good whistleblowing process:
- Several safe channels: a hotline, web portal, email and direct access to the audit committee, with an anonymous option.
- Acknowledge quickly: confirm receipt (the EU directive requires this within seven days).
- Triage: assess the seriousness and decide who should investigate, keeping anyone implicated out of the process.
- Investigate independently: gather evidence fairly, protect confidentiality and respect the rights of the accused.
- Act: discipline, fix controls, report to regulators where required.
- Give feedback: tell the whistleblower what was done, as far as possible (the EU directive requires feedback within three months).
- Protect against retaliation: monitor how the whistleblower is treated and act on any victimization.
How Companies Deal with Whistleblowers: Good and Bad Practice
In other words, any complaint by whistleblowers must not be dismissed, and at the same time it must also not be hyped up. Indeed, how well companies deal with whistleblowers is often a reflection of how well they manage corporate governance and discrimination issues.
For instance, many companies often deal with gender discrimination by setting up hotlines that provide complainants with much-needed anonymity and confidentiality, and this is the way to go as far as treating and dealing with whistleblowers is concerned.
Further, there are some companies that first record the complaints and then ask the whistleblowers to go public with their allegations and submit proof, after which the decision makers and the regulators take over. This is not good practice: whistleblowers should not have to go public, and protecting their identity is a legal requirement in many countries. Asking for available evidence is reasonable, but it is the organization’s job to investigate.
Retaliation (firing, demoting, isolating or harassing a whistleblower) is illegal in many countries and is one of the most damaging things a company can do: it silences future reporting and can lead to lawsuits and penalties. A clear policy, training for managers and visible support from leaders are essential (see Ethics Management Programs).
Conclusion
It is also the case that when whistleblowers allege wrongdoing at the highest levels, it creates a crisis that is difficult for everyone to handle.
This is what happened in the case of Infosys, where wrongdoing at the highest level was alleged, and the way in which the whole issue was handled reflected poorly on a venerable organization such as Infosys.
To conclude, it is better for all corporate norms to be followed, and in case there are any complaints, they must be treated with the respect they deserve. (See also What is Good Corporate Governance?)
FAQs
What is a whistleblower?
A whistleblower is someone, usually an employee, who reports wrongdoing such as fraud, corruption, safety risks or illegal conduct, either within the organization or to regulators, law enforcement or the media.
Why are whistleblowers important?
They help uncover fraud and misconduct early, protect people from harm, save companies from bigger scandals and support an ethical culture. Tips are the most common way fraud is detected.
Are whistleblowers protected by law?
In many countries, yes. Examples include the Sarbanes-Oxley and Dodd-Frank Acts in the US, the EU Whistleblower Directive, the UK’s Public Interest Disclosure Act and the vigil mechanism required under India’s Companies Act, 2013.
How should a company handle a whistleblower complaint?
Acknowledge it quickly, assess it, investigate independently and confidentially, take action on findings, give feedback to the whistleblower and protect them from retaliation.
