Who is a whistleblower?

A whistleblower is someone who reports suspected wrongdoing inside an organisation to a person or body able to act on it. Most are current employees, but suppliers, customers, former staff, directors and contractors also blow the whistle. What sets a whistleblower apart from an ordinary complainant is that the concern is about wrongdoing affecting the organisation, its stakeholders or the public, not a purely personal grievance.

Why do whistleblowers matter?

Tips are the single most common way occupational fraud is detected. The ACFE's Occupational Fraud 2026: A Report to the Nations found that 43% of cases were detected by a tip, nearly three times the next most common method, and that 55% of tips came from employees. Web-based and email channels were used more often than telephone hotlines.

That makes whistleblowers central to detecting occupational fraud such as kickbacks, procurement manipulation and expense abuse. Insiders often see the opportunity and rationalisation elements of the fraud triangle long before an auditor does.

What protection do whistleblowers have in India?

India's framework is spread across several instruments rather than one statute:

• Companies Act 2013, s. 177(9)-(10): covered companies must operate a vigil mechanism with safeguards against victimisation and direct access to the Audit Committee chair in appropriate cases.
• SEBI LODR Regulation 22: listed entities must protect directors, employees or any other person who uses the mechanism.
• SEBI PIT Regulations, Chapter IIIA: an informant may report insider trading directly to SEBI's Office of Informant Protection. Regulation 7I requires employers to protect employees against discharge, demotion, suspension, harassment or discrimination for filing or assisting SEBI, and Regulation 7J makes agreement terms that bar such reporting void. Regulation 9A(6) separately requires an internal whistle-blower policy for reporting leaks of unpublished price sensitive information.
• Whistle Blowers Protection Act 2014: this law concerns public interest disclosures about public servants, made to vigilance commissions. It was enacted, but the Central Government has not issued the notification bringing it into force, so its procedures are not operational.

Because private-sector protection is largely policy-driven, the quality of a company's own whistle-blower policy matters a great deal. Some complaints fall under other specific laws: sexual harassment complaints, for example, go to the Internal Committee under the POSH Act.

What happens after a whistleblower reports?

A credible process normally follows these steps:

1. Acknowledge receipt and protect the reporter's identity.
2. Triage the allegation for seriousness, specificity and conflicts of interest.
3. Preserve relevant documents and electronic data before anyone is alerted.
4. Investigate independently, gathering documents, data and interviews.
5. Report findings to the Audit Committee or Board and act on them.
6. Close the loop with the whistleblower, within the limits of confidentiality.

Our step-by-step guide on how to investigate a whistleblower complaint covers each stage in more detail.

What are common mistakes in handling whistleblowers?

• Trying to identify an anonymous reporter instead of testing the allegation.
• Assigning the investigation to the accused person's own reporting line.
• Treating the complaint as an HR grievance and closing it informally.
• Failing to secure email and device data early, allowing evidence to be deleted.
• Not monitoring the reporter's treatment after the complaint, so subtle retaliation goes unnoticed.

How is a whistleblower different from related terms?

A whistleblower is the person; the vigil mechanism is the channel. A whistleblower also differs from an insider threat, who misuses access to harm the organisation. An informant under SEBI's PIT Regulations is a specific kind of whistleblower who reports directly to the regulator. Where an allegation needs independent fact-finding, our fraud and whistleblower investigation service covers intake review, evidence preservation and investigation reporting.