What this is
What is a whistleblowing report record?
What is a whistleblowing report record?
It is the record of a concern raised confidentially about wrongdoing, and how it was handled, from receipt through investigation, protection of the reporter, and outcome. It is built against ISO 37002 cl.8 and forms part of the Ethics, Labour and Anti-Bribery programme.
What counts as a protected reporting channel?
The form's Reporting Channel field covers a confidential hotline, direct to manager, email, in person, or an external body. Which of these count as 'protected' under law depends on the jurisdiction, but the record treats all five as valid entry points to the same handling process.
Why score handler and investigator independence separately?
The person who receives and assigns a report is often not the person who investigates it. Handler Independent Of The Area and Investigator Independent are two separate scored fields precisely so one independent person handing the case to a non-independent investigator doesn't pass unnoticed.
Scope
When is a whistleblowing report record required?
This record is one step in a larger programme. Using it for work that belongs to a neighbouring template produces records that are hard to report on later.
Use this template when
- A concern about wrongdoing is raised through any channel: confidential hotline, direct to manager, email, in person, or an external body
- The workspace is being set up, or the register needs an entry added or retired
- You are running the Ethics, Labour and Anti-Bribery programme and this is one of its steps
- A linked record needs this one to exist: investigations, just culture
- An existing report needs its investigation, protection measures or outcome updated as the case progresses
Do not use it for
- Code of Conduct Acknowledgement, which records that a worker has read and accepted the code of conduct, at hire and on revision.
- Conflict of Interest Declaration, which records a declared interest that could affect a business decision, and how it will be managed.
- Modern Slavery and Labour Standards Assessment, which assesses the site and its labour supply chain for forced labour, debt bondage, withheld documents and unlawful deductions.
- Just Culture Determination, which decides whether an individual's actions were blameworthy or a system failure, a separate judgement from whether the underlying concern was substantiated.
- Anything outside KnowComply, which belongs in the workspace that owns that process.
Compliance mapping
Which ISO 37002 cl.8 requirements does this satisfy?
ISO 37002 cl.8 covers operating the whistleblowing process itself: receiving, assessing, addressing and concluding a report. This record's sections follow that sequence rather than treating handling as one undifferentiated step.
| Clause | Requirement | Where it lands |
|---|---|---|
| ISO 37002 cl.8.2 | Receive the report through a protected channel and record it without delay | Header |
| ISO 37002 cl.8.3 | Assess the report and assign it to a handler independent of the area concerned | Header |
| ISO 37002 cl.8.4 | Investigate proportionately, using an investigator independent of the matter | Handling |
| ISO 37002 cl.8.4 | Communicate timescales and progress to the reporter | Handling |
| ISO 37002 cl.8 | Protect the reporter from retaliation, and monitor for it after the case closes | Protection |
| ISO 37002 cl.7.4 | Give the reporter feedback on the outcome, within the limits confidentiality allows | Outcome |
| ISO 37002 cl.9.3 | Feed systemic findings into management review rather than closing them at case level | Outcome |
| ISO 37002 cl.7.5 | Hold the record as controlled documented information, restricted to those who need it | Outcome |
What it does not cover
- A handler who is not independent of the area concerned, which undermines the confidentiality and impartiality the whole channel depends on before the investigation even starts.
- A confidentiality breach recorded and left unaddressed, which tells every future reporter the 'protected' channel wasn't.
- Retaliation monitoring marked 'No' after a substantiated concern, which leaves the one outcome this standard treats as unrecoverable unwatched.
- A case closed without feedback given to the reporter, which leaves the person who took the risk with no idea whether raising it mattered.
- A systemic issue identified with no action required flagged, which records the finding without committing to fix what caused it.
Global
Whistleblowing Report Record requirements by country
Whistleblowing protection varies sharply by jurisdiction in what counts as a protected disclosure, what channel it must use, and what remedy follows retaliation, and the record needs to hold up under whichever regime applies.
Whistleblower Protection Directive (EU) 2019/1937, transposed into national law across member states
Requires organisations of a defined size to run internal reporting channels, acknowledge receipt within seven days, and respond to the reporter within three months
Report Received and Receipt Acknowledged on this record are standing in for a statutory clock in any transposing jurisdiction, not just good practice
Sarbanes-Oxley Act s.806, the Dodd-Frank Act, and the False Claims Act qui tam provisions
Protects reporters from retaliation and, under Dodd-Frank and the False Claims Act, can reward reporters financially where a report leads to enforcement action
No Adverse Action Taken is not only an internal HR question here; documented retaliation exposes the organisation to a statutory claim independent of whatever this record concludes
Public Interest Disclosure Act 1998 (PIDA), as amended
Protects workers who make a 'protected disclosure' from detriment or dismissal, provided the disclosure meets PIDA's tests for a qualifying disclosure made in the right way
Reporting Channel matters under PIDA; a disclosure made the wrong way or to the wrong recipient can fall outside protection even where the underlying concern is genuine
How to complete it
How to complete a whistleblowing report record, step by step
The fields are straightforward to fill in. What decides whether the finished record would hold up is a smaller set of judgement calls the form itself cannot make.
Independence isn't just 'doesn't report to the same manager'. The call is whether the handler or investigator has any relationship, financial, reporting-line or personal, to the area or people the concern touches, and documenting that reasoning rather than answering from the org chart alone.
Concern Substantiated Or Not offers 'Partly' precisely because investigations often confirm part of an allegation and not the rest. The call is resisting the pull toward a clean Yes or No when the evidence itself is mixed, since a false binary here misreports what was actually found.
Retaliation Monitoring In Place carries an N/A option, but retaliation risk frequently outlasts case closure, sometimes appearing months later as a poor review or quiet exclusion. The judgement is whether N/A reflects a genuine absence of risk or just the end of active monitoring.
Feedback Given To The Reporter is scored, but confidentiality toward the person investigated limits what can be shared. The call is finding the line between no update at all and disclosing findings that identify someone, and holding it consistently rather than by case-by-case discomfort.
What auditors find
Most common whistleblowing report record findings
The same gaps recur across sites running this record, most visible from the record itself without reopening the case.
| Finding | Clause | What fixes it |
|---|---|---|
| Handler Independent Of The Area marked 'No' with the case still assigned to that handler | ISO 37002 cl.8.3 | Reassign the case to a genuinely independent handler before further work proceeds; a non-independent handler taints everything recorded under them, however thorough it looks. |
| Investigation Proportionate or Investigator Independent left at 'Partly' with no explanation captured | ISO 37002 cl.8.4 | Require a short note wherever either field is 'Partly'; an unexplained partial score is indistinguishable from an unassessed one when the record is reviewed later. |
| Retaliation Monitoring In Place set to 'No' while Reporter Protected From Retaliation is only 'Partly' | ISO 37002 cl.8 | A 'Partly' protection score should force active monitoring; treat these two fields as linked rather than independently answered. |
| Feedback Given To The Reporter marked 'No' on a case marked Case Closed Properly 'Yes' | ISO 37002 cl.7.4 | Closure without feedback is not proper closure under this template's own logic; hold the case open, or record the specific confidentiality limit that prevented feedback. |
| Days To Close left blank, or inconsistent with the gap between Report Received and Case Closed Properly | ISO 37002 cl.9.3 | Calculate Days To Close from the recorded dates rather than entering it by memory; this is the field management review will use to judge whether reports are handled promptly. |
| RCA ID or Just Culture ID left blank on a substantiated concern involving individual conduct | ISO 37002 cl.8.4 | A substantiated concern about an individual's actions should produce a Just Culture Determination before closure, and a systemic finding should produce an RCA; leaving both blank closes the case without its follow-on work. |
Case in point
Case in point: the monitoring that stopped at closure
A labour practices concern was raised through the confidential hotline, investigated by an independent handler and investigator, and substantiated in part. Case Closed Properly, Feedback Given To The Reporter and Retaliation Monitoring In Place were all marked 'Yes' for the duration of the investigation. Two months after closure, the reporter was left off a project they would ordinarily have led.
Nothing on the record was false when written. Retaliation Monitoring In Place was answered honestly for the period it covered, but the field carried no indication of when monitoring itself ended, and closure was treated as the natural point to stop watching. The exclusion surfaced through an unrelated grievance, because by then there was no open field left on this record to catch it.
The template
The template, field by field
The form exactly as it installs. Every field, option, score and conditional rule is editable, and the links to other templates come with it.
6 sections
- Reference
- CMP-040
- Archetype
- Record
- Record ID
- WBR-2026-000
- Scoring
- Reports handled
- Direction
- High is good
- Singleton
- Yes
- Basis
- ISO 37002 cl.8
- Links
- Links Investigations, Just culture
- Tags
- Ethics, Whistleblowing
- Sections
- 6
- Fields
- 46
- Follow up fields
- 3
- Repeating sections
- 0
- Links out
- 4
Header
13 fieldsReport ID*
Auto sequence. Format WBR-2026-000.
The record's own ID. Other templates point at this value.
Status*
Drives who this goes to next.
- Planned2 pts
- In progress2 pts
- Complete3 pts
- Deferred0 pts
- Open0 pts
- Closed3 pts
- Overdue0 pts
Date and Time*
Completed By*
Site*
Site ID*
Format SITE-000.
Links to FDN-001 Site ID
Report Received*
Reporting Channel*
Anonymous*
Concern Category*
Handled By*
Handler Independent Of The Area*
- Yes3 pts
- No0 pts
Retaliation Ends The Channel Permanently
One person treated badly after raising a concern, real or perceived, stops every future report. Protecting the reporter matters more than the individual outcome.
Handling
6 fieldsReceipt Acknowledged*
- Yes3 pts
- Partly1 pt
- No0 pts
Confidentiality Maintained*
- Yes3 pts
- Breach occurred0 pts
Investigation Proportionate*
- Yes3 pts
- Partly1 pt
- No0 pts
Investigator Independent*
- Yes3 pts
- Partly1 pt
- No0 pts
Evidence Gathered Fairly*
- Yes3 pts
- Partly1 pt
- No0 pts
Timescales Communicated*
- Yes3 pts
- Partly1 pt
- No0 pts
Protection
6 fieldsReporter Protected From Retaliation*
- Yes3 pts
- Partly1 pt
- No0 pts
Retaliation Monitoring In Place*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Reporter Kept Informed*
- Yes3 pts
- Partly1 pt
- No0 pts
Identity Restricted To Those Who Need It*
- Yes3 pts
- Partly1 pt
- No0 pts
No Adverse Action Taken*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Reporter Supported*
- Yes3 pts
- Partly1 pt
- No0 pts
Outcome
6 fieldsConcern Substantiated Or Not*
- Yes3 pts
- Partly1 pt
- No0 pts
Actions Taken Where Substantiated*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Systemic Issue Identified*
- Yes3 pts
- Partly1 pt
- No0 pts
Feedback Given To The Reporter*
- Yes3 pts
- Partly1 pt
- No0 pts
Learning Shared Appropriately*
- Yes3 pts
- Partly1 pt
- No0 pts
Case Closed Properly*
- Yes3 pts
- Partly1 pt
- No0 pts
Related records
2 fieldsRCA ID
Where the concern led to a formal investigation.
Links to FDN-013 RCA ID
Just Culture ID
Where an individual's actions are involved.
Links to FDN-017 Determination ID
Outcome
13 fieldsOutcome*
Days To Close*
Reporter Satisfied Where Known*
- Yes3 pts
- Partly1 pt
- No0 pts
- Unknown1 pt
Feeds Management Review*
- Yes3 pts
- Partly1 pt
- No0 pts
Records Held Securely*
- Yes3 pts
- No0 pts
Action Required*
Raise the action record, then enter its reference here.
- No2 pts
- Yes0 pts
Priority
- High0 pts
- Medium1 pt
- Low3 pts
CAPA ID
Format CAPA-2026-00000.
Links to FDN-014 CAPA ID
Action Owner
Independent Handler*
Signature*
Site Manager*
Second Signature*
CMP-040 · record IDs look like WBR-2026-000 · Links Investigations, Just culture
Open in KnowellaRun it with agents
From a document you fill in to a programme that runs itself
The form is the easy part. Keeping it current, routing it to the right owner and holding the evidence together is the work that actually slips.
Holds the whistleblowing register against every open case, flags when independence, feedback or retaliation monitoring fields are missing, and keeps the evidence trail intact under restricted access.
Picks up concerns categorised as Safety or Food safety, so a report raised through the hotline routes into the same investigation discipline as an incident raised through the usual safety channels.
Surfaces labour practices concerns touching agency or contracted labour against the provider assessments it already holds, so a whistleblowing finding doesn't sit disconnected from the supplier record it concerns.

Coordinates the crew, rolls completion and exceptions into one view, and holds every write for your approval before it touches a record.
This template lives in KnowComply — audit and governance. Audit programmes, legal register, management review, risk and certification.
Meet KnowComply→Glossary
Whistleblowing Report Record definitions and key terms
- Protected disclosure
- A report of wrongdoing made in a way, and about a matter, that qualifies for legal protection from retaliation under the relevant jurisdiction's whistleblowing law. Not every internal complaint meets the test, even where the underlying concern is genuine.
- Retaliation
- Any adverse action, dismissal, demotion, exclusion, poor treatment, taken against a reporter because they raised a concern. It can be real or perceived; perceived retaliation damages trust just as effectively as proven retaliation.
- Just culture
- A framework for deciding whether an individual's actions in an incident were blameworthy or the product of a system failure, used to reach a fair and consistent response rather than a punitive default.
- Substantiated
- A finding that the evidence gathered during investigation supports the concern raised, in whole or in part. 'Partly substantiated' records that some elements were confirmed and others were not.
- Qui tam
- A US legal mechanism under the False Claims Act allowing a private reporter to bring an action on behalf of the government and share in any recovery, relevant where a whistleblowing concern touches fraud against public funds.
FAQ
Frequently asked questions about whistleblowing report record
Can a whistleblowing report be raised anonymously?+
Yes, the Anonymous field records this directly, and the Reporting Channel options, particularly a confidential hotline or external body, are designed to support it. Anonymity limits how much feedback can later be given, since there is no one to feed back to directly.
What happens if the concern turns out not to be substantiated?+
Concern Substantiated Or Not can be answered 'No' without penalty to the reporter; protection under this record and under whistleblowing law does not depend on the concern being proven true, only on it being raised in good faith.
Who should handle a whistleblowing report?+
Handler Independent Of The Area is scored specifically because the handler must sit outside the area or people the concern touches. Where no one internally qualifies, the record should reflect an external body handling it instead.
Is this a one-off record or does it need repeating?+
It is a singleton in structure, one register maintained over time rather than recreated, but a new instance is raised for each concern reported. Scoring rolls up as 'reports handled', a measure of the register overall, not any single case.
How does 'Days To Close' get used once the case is shut?+
It feeds Feeds Management Review as a measure of how promptly concerns are handled across the register, separate from whether any individual outcome was correct. A short close time on a poorly investigated case is not a good result.
How does this template link to Just Culture Determination?+
Where the investigation implicates an individual's own actions rather than a systemic gap, Just Culture ID links to a separate determination judging blameworthiness. This record concludes the case; the Just Culture record concludes what happens to the individual.
Keep going
Related templates and programmes
Industries this is written for
Programmes this belongs to
Used together in Ethics, Labour and Anti-Bribery
Code of Conduct Acknowledgement
Records that a worker has read and accepted the code of conduct, at hire and on revision
Conflict of Interest Declaration
Records a declared interest that could affect a business decision, and how it will be managed
Modern Slavery and Labour Standards Assessment
Assesses the site and its labour supply chain for forced labour, debt bondage, withheld documents and unlawful deductions
Anti-Bribery Risk Assessment
Assesses exposure to bribery and improper payments across procurement, permits, inspections and customer relationships
Agency Labour Provider Assessment
Assesses an agency for how it screens, trains, inducts and supervises the people it sends
Just Culture Determination
Separates a system problem from a genuine choice to take a risk, using a consistent set of questions
More in Ethics and Conduct
Code of Conduct Acknowledgement
Records that a worker has read and accepted the code of conduct, at hire and on revision
Conflict of Interest Declaration
Records a declared interest that could affect a business decision, and how it will be managed
Modern Slavery and Labour Standards Assessment
Assesses the site and its labour supply chain for forced labour, debt bondage, withheld documents and unlawful deductions
Anti-Bribery Risk Assessment
Assesses exposure to bribery and improper payments across procurement, permits, inspections and customer relationships

Written and reviewed by
Siddarth Singh
Founder & Chief Executive Officer, Knowella
Certified Safety Professional and industrial and systems engineer with more than a decade inside food supply chain, freight and manufacturing operations. This page was written against the current text of the standards it cites, not against secondary summaries of them.
- Certified Safety Professional (CSP), Board of Certified Safety Professionals
- MBA, University of Chicago Booth School of Business
- MS and BS, The Ohio State University, Industrial and Systems Engineering
- Six Sigma Black Belt
Sources and last review. Reviewed 16 August 2026 against:
- ISO 37002:2021 cl.8 — Whistleblowing management systems: Operation
- ISO 37002:2021 cl.7.4 — Communication
- Whistleblower Protection Directive (EU) 2019/1937
- Public Interest Disclosure Act 1998 (PIDA), UK
- Sarbanes-Oxley Act, 18 U.S.C. s.1514A (s.806)
This page is general guidance, not legal advice. Confirm requirements with your jurisdiction’s regulator.