Whistleblower Compliance

⚠️ EXPERIMENTAL — This skill is provided for educational and informational purposes only. It does NOT constitute legal advice. All responsibility for usage rests with the user. Consult qualified legal professionals before acting on any output.

Whistleblower Compliance Skill

Overview

Production-ready whistleblower compliance toolkit for auditing existing reporting systems and drafting compliant policies. Covers EU Directive 2019/1937, US SOX Section 806, US Dodd-Frank, and UK Public Interest Disclosure Act 1998. Operates in two modes: Mode A (Assessment) runs an 8-phase, 56-checkpoint audit of existing systems; Mode B (Drafting) generates jurisdiction-specific reporting policies.

Table of Contents

• Tools
• Reference Guides
• Workflows
• Troubleshooting
• Success Criteria
• Scope & Limitations
• Anti-Patterns
• Tool Reference

Clarify First

Before generating output, confirm these inputs. If any is unknown or vague, ASK — do not assume:

• Mode: assess an existing system or draft a policy — Mode A runs a 56-checkpoint audit with gap scoring; Mode B produces a policy skeleton — completely different artifacts
• Jurisdiction — EU, US, or UK — sets which regulation's requirements, thresholds, and timelines apply (EU 7-day ack / 3-month feedback vs SOX 180-day filing)
• Headcount + org type — EU thresholds differ (private 50+, public sector all); determines applicability and which sections are mandatory
• Sector — financial, healthcare, defense, nuclear, transport — triggers the Phase 8 sector-specific requirements

Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the output.

Tools

1. Compliance Checker (scripts/whistleblower_compliance_checker.py)

Assess an existing whistleblower system against regulatory requirements. Takes organizational parameters and outputs a compliance score with priority-classified gaps.

python scripts/whistleblower_compliance_checker.py \
  --jurisdiction EU --headcount 300 --sector financial \
  --channels internal,external --has-designated-person \
  --has-confidentiality --has-gdpr-measures --has-dissemination

python scripts/whistleblower_compliance_checker.py \
  --jurisdiction US --headcount 5000 --sector healthcare \
  --channels internal --json

python scripts/whistleblower_compliance_checker.py \
  --jurisdiction UK --headcount 50 --sector technology \
  --channels none

2. Policy Scaffolder (scripts/whistleblower_policy_scaffolder.py)

Generate a whistleblower policy skeleton pre-populated with required sections per regulatory framework.

python scripts/whistleblower_policy_scaffolder.py \
  --jurisdiction EU --org-type private --headcount 500 \
  --org-name "Acme Corp"

python scripts/whistleblower_policy_scaffolder.py \
  --jurisdiction US --org-type public --headcount 10000 \
  --org-name "MegaCorp Inc" --json

python scripts/whistleblower_policy_scaffolder.py \
  --jurisdiction UK --org-type nonprofit --headcount 100 \
  --org-name "CharityOrg" --output policy-draft.md

Reference Guides

Workflows

Mode A: Assessment Workflow

1. Gather Parameters -- Collect jurisdiction, headcount, sector, and system description
2. Run Compliance Checker -- Execute whistleblower_compliance_checker.py with parameters
3. Review Gaps -- Prioritize CRITICAL gaps first, then IMPORTANT, then IMPROVEMENT
4. Cross-Reference Checklist -- Walk through assessment_checklist.md for manual verification
5. Generate Remediation Plan -- Address gaps by priority, set deadlines per regulatory timelines

Mode B: Drafting Workflow

1. Determine Jurisdiction -- Identify applicable regulations based on headquarters and operations
2. Generate Scaffold -- Run whistleblower_policy_scaffolder.py with organization details
3. Customize Sections -- Replace placeholders with organization-specific information
4. Legal Review -- Route draft through legal counsel for jurisdiction-specific validation
5. Approval & Publication -- Obtain board/management approval and disseminate to all personnel

8-Phase Assessment Framework

Three Reporting Channels

Whistleblower Protections

Priority Classification

Troubleshooting

Success Criteria

• Compliance Coverage: Assessment covers 100% of applicable regulatory requirements for specified jurisdiction
• Gap Identification: All CRITICAL and IMPORTANT gaps identified with clear remediation guidance
• Policy Completeness: Generated policies include all mandatory sections per applicable regulation
• Timeline Compliance: Policies reflect correct acknowledgment (7 days) and feedback (3 months) timelines
• Audit Readiness: Assessment output sufficient for regulatory audit preparation and evidence gathering

Scope & Limitations

This skill covers:

• Compliance assessment against EU Directive 2019/1937, US SOX/Dodd-Frank, UK PIDA
• Policy scaffolding with jurisdiction-specific mandatory sections
• Gap analysis with priority classification and remediation guidance
• Multi-sector considerations (financial, healthcare, defense, nuclear, transport)

This skill does NOT cover:

• Actual whistleblower case management or investigation procedures
• Legal advice or attorney-client privileged analysis
• Real-time regulatory monitoring or automatic updates when laws change
• Whistleblower hotline software implementation or vendor selection
• Cross-border reporting coordination between multiple regulators

Anti-Patterns

Tool Reference

scripts/whistleblower_compliance_checker.py

Assess whistleblower system compliance against regulatory requirements.

usage: whistleblower_compliance_checker.py [-h] [--json]
                                           --jurisdiction {EU,US,UK}
                                           --headcount HEADCOUNT
                                           --sector SECTOR
                                           [--channels CHANNELS]
                                           [--has-designated-person]
                                           [--has-confidentiality]
                                           [--has-gdpr-measures]
                                           [--has-dissemination]
                                           [--has-acknowledgment-timeline]
                                           [--has-feedback-timeline]

options:
  -h, --help            Show help message and exit
  --json                Output in JSON format
  --jurisdiction        Regulatory jurisdiction: EU, US, or UK
  --headcount           Number of employees in the organization
  --sector              Industry sector (financial, healthcare, technology, etc.)
  --channels            Comma-separated channel types: internal, external, none
  --has-designated-person  Designated person(s) appointed for handling reports
  --has-confidentiality    Confidentiality measures in place
  --has-gdpr-measures      GDPR/data protection measures implemented
  --has-dissemination      Policy disseminated to all personnel
  --has-acknowledgment-timeline  7-day acknowledgment timeline met
  --has-feedback-timeline  3-month feedback timeline met

scripts/whistleblower_policy_scaffolder.py

Generate jurisdiction-specific whistleblower policy skeleton.

usage: whistleblower_policy_scaffolder.py [-h] [--json]
                                          --jurisdiction {EU,US,UK}
                                          --org-type {public,private,nonprofit}
                                          --headcount HEADCOUNT
                                          [--org-name ORG_NAME]
                                          [--output OUTPUT]

options:
  -h, --help            Show help message and exit
  --json                Output in JSON format
  --jurisdiction        Regulatory jurisdiction: EU, US, or UK
  --org-type            Organization type
  --headcount           Number of employees
  --org-name            Organization name (used in policy template)
  --output              Write policy to file instead of stdout