Knowella

Whistleblowing Report Record

The recurring failure in whistleblowing isn't a report going unheard, it's one handled by someone close enough to the area concerned that people learn from the outcome, not the policy, whether raising a concern is actually safe. One act of retaliation, real or perceived, against one reporter closes the channel for everyone who was ever going to use it, and no policy document repairs that afterwards.

KnowComplyRecordCMP-04046 fields across 6 sectionsFull researchSee the form

Reviewed by Siddarth SinghCSPLast reviewed 16 August 2026

Basis
ISO 37002 cl.8
Workspace
KnowComply
Form type
Record
Handled by
A person independent of the area concerned
Anonymous reports
Accepted through any channel

The short version

  • Handler Independent Of The Area and Investigator Independent are two separate scored fields, so both the person receiving the report and the person investigating it must independently be confirmed clear of the area concerned.
  • Retaliation Monitoring In Place and No Adverse Action Taken both carry an N/A option, so the register can distinguish 'no retaliation risk to monitor' from 'risk present and unaddressed', a distinction a plain Yes/No field would lose.
  • Days To Close is a scored numeric field alongside the outcome, tying case duration directly to whether the record's contribution to 'reports handled' reads as strong or weak.
  • The template cross-references a Root Cause Analysis (RCA ID) and a Just Culture Determination (Just Culture ID) as optional fields, meaning a substantiated concern involving individual conduct should produce two further records, not just a closed case.

What this is

What is a whistleblowing report record?

What is a whistleblowing report record?

It is the record of a concern raised confidentially about wrongdoing, and how it was handled, from receipt through investigation, protection of the reporter, and outcome. It is built against ISO 37002 cl.8 and forms part of the Ethics, Labour and Anti-Bribery programme.

What counts as a protected reporting channel?

The form's Reporting Channel field covers a confidential hotline, direct to manager, email, in person, or an external body. Which of these count as 'protected' under law depends on the jurisdiction, but the record treats all five as valid entry points to the same handling process.

Why score handler and investigator independence separately?

The person who receives and assigns a report is often not the person who investigates it. Handler Independent Of The Area and Investigator Independent are two separate scored fields precisely so one independent person handing the case to a non-independent investigator doesn't pass unnoticed.

Scope

When is a whistleblowing report record required?

This record is one step in a larger programme. Using it for work that belongs to a neighbouring template produces records that are hard to report on later.

Use this template when

  • A concern about wrongdoing is raised through any channel: confidential hotline, direct to manager, email, in person, or an external body
  • The workspace is being set up, or the register needs an entry added or retired
  • You are running the Ethics, Labour and Anti-Bribery programme and this is one of its steps
  • A linked record needs this one to exist: investigations, just culture
  • An existing report needs its investigation, protection measures or outcome updated as the case progresses

Do not use it for

  • Code of Conduct Acknowledgement, which records that a worker has read and accepted the code of conduct, at hire and on revision.
  • Conflict of Interest Declaration, which records a declared interest that could affect a business decision, and how it will be managed.
  • Modern Slavery and Labour Standards Assessment, which assesses the site and its labour supply chain for forced labour, debt bondage, withheld documents and unlawful deductions.
  • Just Culture Determination, which decides whether an individual's actions were blameworthy or a system failure, a separate judgement from whether the underlying concern was substantiated.
  • Anything outside KnowComply, which belongs in the workspace that owns that process.

Compliance mapping

Which ISO 37002 cl.8 requirements does this satisfy?

ISO 37002 cl.8 covers operating the whistleblowing process itself: receiving, assessing, addressing and concluding a report. This record's sections follow that sequence rather than treating handling as one undifferentiated step.

ClauseRequirementWhere it lands
ISO 37002 cl.8.2Receive the report through a protected channel and record it without delayHeader
ISO 37002 cl.8.3Assess the report and assign it to a handler independent of the area concernedHeader
ISO 37002 cl.8.4Investigate proportionately, using an investigator independent of the matterHandling
ISO 37002 cl.8.4Communicate timescales and progress to the reporterHandling
ISO 37002 cl.8Protect the reporter from retaliation, and monitor for it after the case closesProtection
ISO 37002 cl.7.4Give the reporter feedback on the outcome, within the limits confidentiality allowsOutcome
ISO 37002 cl.9.3Feed systemic findings into management review rather than closing them at case levelOutcome
ISO 37002 cl.7.5Hold the record as controlled documented information, restricted to those who need itOutcome

What it does not cover

  • A handler who is not independent of the area concerned, which undermines the confidentiality and impartiality the whole channel depends on before the investigation even starts.
  • A confidentiality breach recorded and left unaddressed, which tells every future reporter the 'protected' channel wasn't.
  • Retaliation monitoring marked 'No' after a substantiated concern, which leaves the one outcome this standard treats as unrecoverable unwatched.
  • A case closed without feedback given to the reporter, which leaves the person who took the risk with no idea whether raising it mattered.
  • A systemic issue identified with no action required flagged, which records the finding without committing to fix what caused it.

Global

Whistleblowing Report Record requirements by country

Whistleblowing protection varies sharply by jurisdiction in what counts as a protected disclosure, what channel it must use, and what remedy follows retaliation, and the record needs to hold up under whichever regime applies.

European Union

Whistleblower Protection Directive (EU) 2019/1937, transposed into national law across member states

Requires organisations of a defined size to run internal reporting channels, acknowledge receipt within seven days, and respond to the reporter within three months

Report Received and Receipt Acknowledged on this record are standing in for a statutory clock in any transposing jurisdiction, not just good practice

United States

Sarbanes-Oxley Act s.806, the Dodd-Frank Act, and the False Claims Act qui tam provisions

Protects reporters from retaliation and, under Dodd-Frank and the False Claims Act, can reward reporters financially where a report leads to enforcement action

No Adverse Action Taken is not only an internal HR question here; documented retaliation exposes the organisation to a statutory claim independent of whatever this record concludes

United Kingdom

Public Interest Disclosure Act 1998 (PIDA), as amended

Protects workers who make a 'protected disclosure' from detriment or dismissal, provided the disclosure meets PIDA's tests for a qualifying disclosure made in the right way

Reporting Channel matters under PIDA; a disclosure made the wrong way or to the wrong recipient can fall outside protection even where the underlying concern is genuine

How to complete it

How to complete a whistleblowing report record, step by step

The fields are straightforward to fill in. What decides whether the finished record would hold up is a smaller set of judgement calls the form itself cannot make.

What 'independent' actually requires of the handler and the investigator

Independence isn't just 'doesn't report to the same manager'. The call is whether the handler or investigator has any relationship, financial, reporting-line or personal, to the area or people the concern touches, and documenting that reasoning rather than answering from the org chart alone.

When 'partly substantiated' is the honest answer, not a compromise

Concern Substantiated Or Not offers 'Partly' precisely because investigations often confirm part of an allegation and not the rest. The call is resisting the pull toward a clean Yes or No when the evidence itself is mixed, since a false binary here misreports what was actually found.

Whether retaliation monitoring still applies once a case is closed

Retaliation Monitoring In Place carries an N/A option, but retaliation risk frequently outlasts case closure, sometimes appearing months later as a poor review or quiet exclusion. The judgement is whether N/A reflects a genuine absence of risk or just the end of active monitoring.

How much feedback the reporter is actually owed

Feedback Given To The Reporter is scored, but confidentiality toward the person investigated limits what can be shared. The call is finding the line between no update at all and disclosing findings that identify someone, and holding it consistently rather than by case-by-case discomfort.

What auditors find

Most common whistleblowing report record findings

The same gaps recur across sites running this record, most visible from the record itself without reopening the case.

FindingClauseWhat fixes it
Handler Independent Of The Area marked 'No' with the case still assigned to that handlerISO 37002 cl.8.3Reassign the case to a genuinely independent handler before further work proceeds; a non-independent handler taints everything recorded under them, however thorough it looks.
Investigation Proportionate or Investigator Independent left at 'Partly' with no explanation capturedISO 37002 cl.8.4Require a short note wherever either field is 'Partly'; an unexplained partial score is indistinguishable from an unassessed one when the record is reviewed later.
Retaliation Monitoring In Place set to 'No' while Reporter Protected From Retaliation is only 'Partly'ISO 37002 cl.8A 'Partly' protection score should force active monitoring; treat these two fields as linked rather than independently answered.
Feedback Given To The Reporter marked 'No' on a case marked Case Closed Properly 'Yes'ISO 37002 cl.7.4Closure without feedback is not proper closure under this template's own logic; hold the case open, or record the specific confidentiality limit that prevented feedback.
Days To Close left blank, or inconsistent with the gap between Report Received and Case Closed ProperlyISO 37002 cl.9.3Calculate Days To Close from the recorded dates rather than entering it by memory; this is the field management review will use to judge whether reports are handled promptly.
RCA ID or Just Culture ID left blank on a substantiated concern involving individual conductISO 37002 cl.8.4A substantiated concern about an individual's actions should produce a Just Culture Determination before closure, and a systemic finding should produce an RCA; leaving both blank closes the case without its follow-on work.

Case in point

Case in point: the monitoring that stopped at closure

A labour practices concern was raised through the confidential hotline, investigated by an independent handler and investigator, and substantiated in part. Case Closed Properly, Feedback Given To The Reporter and Retaliation Monitoring In Place were all marked 'Yes' for the duration of the investigation. Two months after closure, the reporter was left off a project they would ordinarily have led.

Nothing on the record was false when written. Retaliation Monitoring In Place was answered honestly for the period it covered, but the field carried no indication of when monitoring itself ended, and closure was treated as the natural point to stop watching. The exclusion surfaced through an unrelated grievance, because by then there was no open field left on this record to catch it.

The template

The template, field by field

The form exactly as it installs. Every field, option, score and conditional rule is editable, and the links to other templates come with it.

46fields
6 sections
Reference
CMP-040
Archetype
Record
Record ID
WBR-2026-000
Scoring
Reports handled
Direction
High is good
Singleton
Yes
Basis
ISO 37002 cl.8
Links
Links Investigations, Just culture
Tags
Ethics, Whistleblowing
Sections
6
Fields
46
Follow up fields
3
Repeating sections
0
Links out
4
Field typesOwn ID, generated on saveCase thread and parentPick list from a registryLinked to another templateFollow up, dashed outlineScored

Header

13 fields
Text

Report ID*

Generated on save

Auto sequence. Format WBR-2026-000.

The record's own ID. Other templates point at this value.

Single Choice

Status*

Scored

Drives who this goes to next.

  • Planned2 pts
  • In progress2 pts
  • Complete3 pts
  • Deferred0 pts
  • Open0 pts
  • Closed3 pts
  • Overdue0 pts
Date & Time

Date and Time*

Users

Completed By*

Pick List

Site*

From FDN-001 Site NameFilter: Status is Active
Text

Site ID*

Linked

Format SITE-000.

Links to FDN-001 Site ID

Date & Time

Report Received*

Single Choice

Reporting Channel*

Confidential hotlineDirect to managerEmailIn personExternal body
Single Choice

Anonymous*

YesNo
Single Choice

Concern Category*

SafetyFood safetyFraudBriberyDiscriminationLabour practicesEnvironmental
Users

Handled By*

Single Choice

Handler Independent Of The Area*

Scored
  • Yes3 pts
  • No0 pts
Info

Retaliation Ends The Channel Permanently

One person treated badly after raising a concern, real or perceived, stops every future report. Protecting the reporter matters more than the individual outcome.

Handling

6 fields
Single Choice

Receipt Acknowledged*

Scored
  • Yes3 pts
  • Partly1 pt
  • No0 pts
Single Choice

Confidentiality Maintained*

Scored
  • Yes3 pts
  • Breach occurred0 pts
Single Choice

Investigation Proportionate*

Scored
  • Yes3 pts
  • Partly1 pt
  • No0 pts
Single Choice

Investigator Independent*

Scored
  • Yes3 pts
  • Partly1 pt
  • No0 pts
Single Choice

Evidence Gathered Fairly*

Scored
  • Yes3 pts
  • Partly1 pt
  • No0 pts
Single Choice

Timescales Communicated*

Scored
  • Yes3 pts
  • Partly1 pt
  • No0 pts

Protection

6 fields
Single Choice

Reporter Protected From Retaliation*

Scored
  • Yes3 pts
  • Partly1 pt
  • No0 pts
Single Choice

Retaliation Monitoring In Place*

Scored
  • Yes2 pts
  • No0 pts
  • N/Aexcluded from denominator
Single Choice

Reporter Kept Informed*

Scored
  • Yes3 pts
  • Partly1 pt
  • No0 pts
Single Choice

Identity Restricted To Those Who Need It*

Scored
  • Yes3 pts
  • Partly1 pt
  • No0 pts
Single Choice

No Adverse Action Taken*

Scored
  • Yes2 pts
  • No0 pts
  • N/Aexcluded from denominator
Single Choice

Reporter Supported*

Scored
  • Yes3 pts
  • Partly1 pt
  • No0 pts

Outcome

6 fields
Single Choice

Concern Substantiated Or Not*

Scored
  • Yes3 pts
  • Partly1 pt
  • No0 pts
Single Choice

Actions Taken Where Substantiated*

Scored
  • Yes2 pts
  • No0 pts
  • N/Aexcluded from denominator
Single Choice

Systemic Issue Identified*

Scored
  • Yes3 pts
  • Partly1 pt
  • No0 pts
Single Choice

Feedback Given To The Reporter*

Scored
  • Yes3 pts
  • Partly1 pt
  • No0 pts
Single Choice

Learning Shared Appropriately*

Scored
  • Yes3 pts
  • Partly1 pt
  • No0 pts
Single Choice

Case Closed Properly*

Scored
  • Yes3 pts
  • Partly1 pt
  • No0 pts

Related records

2 fields
Text

RCA ID

OptionalLinked

Where the concern led to a formal investigation.

Links to FDN-013 RCA ID

Text

Just Culture ID

OptionalLinked

Where an individual's actions are involved.

Links to FDN-017 Determination ID

Outcome

13 fields
Single Choice

Outcome*

SubstantiatedPartly substantiatedNot substantiatedUnable to determine
Numeric Answer

Days To Close*

Scored
Single Choice

Reporter Satisfied Where Known*

Scored
  • Yes3 pts
  • Partly1 pt
  • No0 pts
  • Unknown1 pt
Single Choice

Feeds Management Review*

Scored
  • Yes3 pts
  • Partly1 pt
  • No0 pts
Single Choice

Records Held Securely*

Scored
  • Yes3 pts
  • No0 pts
Single Choice

Action Required*

Scored

Raise the action record, then enter its reference here.

  • No2 pts
  • Yes0 pts
Single Choice

Priority

OptionalScoredShows if Action Required equals Yes
  • High0 pts
  • Medium1 pt
  • Low3 pts
Text

CAPA ID

OptionalLinkedShows if Action Required equals Yes

Format CAPA-2026-00000.

Links to FDN-014 CAPA ID

Users

Action Owner

OptionalShows if Action Required equals Yes
Users

Independent Handler*

Signature

Signature*

Users

Site Manager*

Signature

Second Signature*

CMP-040 · record IDs look like WBR-2026-000 · Links Investigations, Just culture

Open in Knowella

Run it with agents

From a document you fill in to a programme that runs itself

The form is the easy part. Keeping it current, routing it to the right owner and holding the evidence together is the work that actually slips.

KnowComply

Holds the whistleblowing register against every open case, flags when independence, feedback or retaliation monitoring fields are missing, and keeps the evidence trail intact under restricted access.

KnowSafe

Picks up concerns categorised as Safety or Food safety, so a report raised through the hotline routes into the same investigation discipline as an incident raised through the usual safety channels.

KnowContractor

Surfaces labour practices concerns touching agency or contracted labour against the provider assessments it already holds, so a whistleblowing finding doesn't sit disconnected from the supplier record it concerns.

Ella
Ella

Coordinates the crew, rolls completion and exceptions into one view, and holds every write for your approval before it touches a record.

This template lives in KnowComply — audit and governance. Audit programmes, legal register, management review, risk and certification.

Meet KnowComply→

Glossary

Whistleblowing Report Record definitions and key terms

Protected disclosure
A report of wrongdoing made in a way, and about a matter, that qualifies for legal protection from retaliation under the relevant jurisdiction's whistleblowing law. Not every internal complaint meets the test, even where the underlying concern is genuine.
Retaliation
Any adverse action, dismissal, demotion, exclusion, poor treatment, taken against a reporter because they raised a concern. It can be real or perceived; perceived retaliation damages trust just as effectively as proven retaliation.
Just culture
A framework for deciding whether an individual's actions in an incident were blameworthy or the product of a system failure, used to reach a fair and consistent response rather than a punitive default.
Substantiated
A finding that the evidence gathered during investigation supports the concern raised, in whole or in part. 'Partly substantiated' records that some elements were confirmed and others were not.
Qui tam
A US legal mechanism under the False Claims Act allowing a private reporter to bring an action on behalf of the government and share in any recovery, relevant where a whistleblowing concern touches fraud against public funds.

FAQ

Frequently asked questions about whistleblowing report record

Can a whistleblowing report be raised anonymously?+

Yes, the Anonymous field records this directly, and the Reporting Channel options, particularly a confidential hotline or external body, are designed to support it. Anonymity limits how much feedback can later be given, since there is no one to feed back to directly.

What happens if the concern turns out not to be substantiated?+

Concern Substantiated Or Not can be answered 'No' without penalty to the reporter; protection under this record and under whistleblowing law does not depend on the concern being proven true, only on it being raised in good faith.

Who should handle a whistleblowing report?+

Handler Independent Of The Area is scored specifically because the handler must sit outside the area or people the concern touches. Where no one internally qualifies, the record should reflect an external body handling it instead.

Is this a one-off record or does it need repeating?+

It is a singleton in structure, one register maintained over time rather than recreated, but a new instance is raised for each concern reported. Scoring rolls up as 'reports handled', a measure of the register overall, not any single case.

How does 'Days To Close' get used once the case is shut?+

It feeds Feeds Management Review as a measure of how promptly concerns are handled across the register, separate from whether any individual outcome was correct. A short close time on a poorly investigated case is not a good result.

How does this template link to Just Culture Determination?+

Where the investigation implicates an individual's own actions rather than a systemic gap, Just Culture ID links to a separate determination judging blameworthiness. This record concludes the case; the Just Culture record concludes what happens to the individual.

Keep going

Related templates and programmes

Siddarth Singh

Written and reviewed by

Siddarth Singh

Founder & Chief Executive Officer, Knowella

Certified Safety Professional and industrial and systems engineer with more than a decade inside food supply chain, freight and manufacturing operations. This page was written against the current text of the standards it cites, not against secondary summaries of them.

  • Certified Safety Professional (CSP), Board of Certified Safety Professionals
  • MBA, University of Chicago Booth School of Business
  • MS and BS, The Ohio State University, Industrial and Systems Engineering
  • Six Sigma Black Belt
Verify with BCSP →

Sources and last review. Reviewed 16 August 2026 against:

  • ISO 37002:2021 cl.8 — Whistleblowing management systems: Operation
  • ISO 37002:2021 cl.7.4 — Communication
  • Whistleblower Protection Directive (EU) 2019/1937
  • Public Interest Disclosure Act 1998 (PIDA), UK
  • Sarbanes-Oxley Act, 18 U.S.C. s.1514A (s.806)

This page is general guidance, not legal advice. Confirm requirements with your jurisdiction’s regulator.

Start in Minutes, Not Weeks

Launch a Ready-Made Template and Customize It Your Way

Every template is fully editable. Adjust fields, workflows, and branding to match your processes, then deploy to your team instantly.