ThomasMoreAI Whistleblower Protection Policy
Produces a board-adoptable whistleblower policy with fill-in placeholders and U.S. compliance guardrails for public, private, and nonprofit entities.
Quick Start
Gather before drafting:
- Org profile — legal name, entity type (public/private/nonprofit), governing state, reporting contacts.
- Statute applicability — SOX, Dodd-Frank, OSHA, False Claims Act, state statutes.
- Governance stack — existing code of conduct, handbook, grievance/investigation policies.
- Administration model — who receives reports, investigates, and oversees outcomes.
- Channel preferences — email, portal, hotline, written/verbal; tone and length targets.
- Adoption mechanics — signatory roles, effective-date process, review cadence.
If any input is missing, emit a short clarifying checklist before drafting.
Policy Sections (fixed order)
| # | Section | Required Content |
|---|---|---|
| 0 | Title block & version | Org name, version, effective date, scope entities |
| 1 | Introduction & commitment | Scope statement, non-retaliation promise, protected intent |
| 2 | Covered concerns | Serious-misconduct taxonomy, explicit non-coverage examples |
| 3 | Reporting procedures | Normal path, override path, anonymous option, channel placeholders |
| 4 | Investigation & resolution | Triage, assignment, timeline expectations, reporter updates |
| 5 | Anti-retaliation | Strict prohibition, protected-conduct examples, sanctions |
| 6 | Confidentiality & limits | Need-to-know bounds, legal exceptions, expectation management |
| 7 | Good-faith reporting | Reasonable-belief standard (no certainty burden), bad-faith consequences |
| 8 | Administration & governance | Board/committee roles, secure records, training, periodic review |
| 9 | External legal rights | Supplement-not-replace, no internal-prerequisite condition |
| 10 | Adoption & effective date | Board resolution, signature block, supersession language |
Required Placeholders
Use exactly these tokens:
[Organization Name],[State of Formation],[Board Chair],[Executive Director/CEO][Primary Contact],[Alternative Contact],[Hotline URL/Number][Adoption Date],[Effective Date],[Review Cycle]
Citation Discipline
- Reference statutes only when clearly supported by entity type and jurisdiction.
- Tag uncertain scope with
[VERIFY]and request jurisdictional confirmation. - Always verify: SOX §806 applicability, Dodd-Frank retaliation channels, OSHA/state overlap.
Output Format
- Numbered sections with clear headings.
- Prose-first; bullets only where needed (max 5 per section).
- End each section with implementation-ready fill-ins, not drafting notes.
- Close with signature block for Board Chair and CEO/Executive Director.
Pitfalls & Checks
- Never state that internal reporting is a legal prerequisite for external agency filing.
- Branch public-company vs. nonprofit/private language where statute relevance differs.
- Distinguish anti-frivolous-reporting language from negligent or honest mistakes.
- Protect good-faith reporters regardless of substantiation outcome.
- Set explicit confidentiality limits: need-to-know, lawful disclosure, legal process, audit/defense.
- Require annual or semiannual review, training completion, and board reporting metrics.
- End with disclaimer: "This policy is internal guidance and does not replace legal counsel for specific rights."