How to Investigate a Whistleblower Complaint: A Step-by-Step Guide for Indian Companies

Investigating a whistleblower complaint well means following a disciplined sequence: triage the complaint, appoint an independent investigator, preserve evidence before anyone is alerted, gather documents and data, interview witnesses and the subject fairly, and report findings to the Audit Committee. Throughout, the company must protect the whistleblower from victimisation and handle personal data lawfully. This guide sets out each step for Indian companies, with the legal touchpoints that matter.

According to the ACFE's Occupational Fraud 2026: A Report to the Nations, 43% of occupational frauds were detected by tips, nearly three times the next most common method, and 55% of those tips came from employees. A complaint handled badly wastes that signal and can expose the company to regulatory and reputational harm.

Step 1: How should a complaint be triaged?

Triage decides what the complaint is, who owns it and how urgent it is. Do it quickly and document every decision.

Start by logging the complaint with a reference number, date, channel and a summary of the allegations. Then classify it:

• Fraud or financial misconduct: misappropriation, false invoices, kickbacks, manipulation of accounts. These go to the vigil mechanism process.
• Sexual harassment: these complaints belong with the Internal Committee under the POSH Act 2013, which has its own statutory procedure and timelines.
• HR grievances: pay, appraisal or workplace disputes usually belong with HR, unless they mask a misconduct allegation.
• Leak of unpublished price sensitive information: listed companies must have a Board-approved policy for inquiring into UPSI leaks and must promptly inform SEBI of leaks, inquiries and results under Regulation 9A(5) of the SEBI (Prohibition of Insider Trading) Regulations 2015.

Assess specificity (names, dates, amounts, documents), plausibility, potential financial impact and seniority of the people named. Anonymous complaints deserve the same assessment; anonymity does not make an allegation false.

Early regulatory checks

Two checks belong in triage, not at the end. First, for listed entities, the initiation of a forensic audit is a deemed-material event under Schedule III, Part A, Para A, item 17 of SEBI LODR, where the audit aims to detect misstatement, misappropriation or siphoning of funds. Second, if the statutory auditor learns of a suspected fraud, the auditor may have a separate reporting duty under s. 143(12) of the Companies Act 2013. Under CARO 2020, para 3(xi)(c), auditors also report whether they considered whistleblower complaints received during the year. Decide early who will brief the auditor and the company secretary.

Step 2: Who should investigate, and how is independence protected?

The investigator must be independent of the people and processes under review. A finance manager cannot credibly investigate a complaint about the CFO.

Under s. 177(9) and (10) of the Companies Act 2013 and Rule 7 of the Companies (Meetings of Board and its Powers) Rules 2014, the vigil mechanism is overseen by the Audit Committee, or by a director nominated by the Board in companies without one. Section 177(10) also requires direct access to the Audit Committee chairperson in appropriate or exceptional cases. When the complaint names a director, KMP or senior manager, the chair should take ownership and appoint the investigator.

Practical points:

1. Terms of reference. Write down the allegations, scope, period, data sources, reporting line and timetable. Narrow scope keeps the work proportionate; it can be widened if evidence warrants.
2. Conflict checks. Confirm that investigators have no reporting, personal or commercial link to the subject.
3. Legal privilege. Where litigation or regulatory action is likely, consider engaging external counsel to direct the work. Whether privilege attaches is a question for specific legal advice.
4. External support. Matters involving senior management, large amounts or digital evidence often justify an external forensic team.

Step 3: What evidence should be preserved first?

Preserve evidence before any interview or inquiry. Once the subject learns of an inquiry, emails get deleted, chats disappear and documents are "updated".

Priorities usually include:

• Mailboxes and cloud storage of the people named, with retention or legal holds applied by IT.
• Laptops and mobile phones issued by the company, captured through forensic imaging rather than casual copying.
• ERP data: vendor master, payment runs, journal entries and user activity logs.
• Physical files, approvals, bank statements and contracts.
• Access card and CCTV records where relevant, before routine overwriting.

Record who collected each item, when, how and where it is stored. A documented chain of custody, with hash values for digital copies, lets the evidence stand up later. If the matter reaches a court, electronic records will need a certificate under s. 63 of the Bharatiya Sakshya Adhiniyam 2023, which replaced s. 65B of the Indian Evidence Act 1872. Our guide on preserving digital evidence in internal investigations covers this in detail.

Step 4: How should documents and data be analysed?

Test the allegation against records before interviewing anyone. Good analysis turns a complaint into specific questions.

Typical work includes reconciling payments to contracts and receipts, matching vendor bank accounts, addresses and phone numbers against employee records, reviewing approvals for split purchases, and searching email for key terms and counterparties. Digital forensics can recover deleted files and establish who did what, and when. Corporate registry and open-source checks can reveal undisclosed links between employees and suppliers.

Keep a working paper for each allegation showing the evidence for and against it. Investigators should look for exculpatory evidence as diligently as for incriminating evidence.

Step 5: How should interviews be conducted?

Interview in a planned order: the whistleblower (if identifiable and willing) for clarification, then neutral witnesses, then people with possible involvement, and the subject last.

Good practice for each interview:

• Two interviewers, one leading and one taking notes.
• Explain the purpose, that the interview is voluntary within the employment relationship, and that retaliation against anyone who cooperates is prohibited.
• Put documents to the interviewee and ask open questions first, then specific ones.
• Give the subject a fair opportunity to respond to each allegation and to offer documents or witnesses.
• Prepare a written record, and invite the interviewee to review and sign it.

Avoid threats, promises of leniency or anything that could make a statement look coerced. Never disclose the whistleblower's identity to the subject.

Step 6: What does the DPDP Act 2023 change?

Investigations process a lot of personal data: emails, device contents, HR files and sometimes family or financial information. The Digital Personal Data Protection Act 2023 and the DPDP Rules 2025 will shape how that is done.

The Rules were notified on 13 November 2025 and commence in phases. Most Data Fiduciary obligations, including notice, security safeguards, breach intimation and retention under Rules 3 and 5 to 16, apply from about 13 May 2027. Companies should design investigation procedures for that regime now.

Three provisions are particularly relevant:

• Section 7(i) lists processing for employment purposes, including safeguarding the employer from loss or liability, as a legitimate use that does not require consent.
• Section 17(1)(c) exempts processing in the interest of prevention, detection or investigation of any offence or contravention of law from much of the Act, but the duty to take reasonable security safeguards still applies.
• Rule 6 sets minimum safeguards such as access controls, logging and encryption.

In practice this means collecting only what the investigation needs, limiting access to the investigation team, keeping a data inventory and deciding retention at closure. Our post on the DPDP Act and workplace investigations goes further. How the exemptions apply to a specific matter may need legal advice.

Step 7: How should findings be reported to the Audit Committee?

The report should let the Audit Committee decide without re-doing the work. A clear structure helps:

Under SEBI LODR, the Audit Committee's role includes reviewing findings of internal investigations into suspected fraud or material control failure and reporting them to the Board (Schedule II, Part C, item 15), and reviewing how the whistleblower mechanism functions (item 18). Listed companies that initiated a forensic audit must also disclose the final report with management comments under Schedule III, Part A, Para A, item 17.

Step 8: How is the whistleblower protected from retaliation?

Protecting the whistleblower is a legal duty. Section 177(10) of the Companies Act 2013 and Regulation 22(2) of SEBI LODR require adequate safeguards against victimisation of those who use the vigil mechanism. Regulation 7I of the PIT Regulations separately protects employees who report insider trading violations to SEBI.

Practical safeguards include restricting knowledge of the whistleblower's identity, monitoring their appraisals, transfers and terminations for a period after the complaint, and treating retaliation as serious misconduct. Close the loop: tell the whistleblower that the matter has been investigated and closed, even if details stay confidential. The protection does not cover deliberately false complaints; Rule 7 allows action against those who repeatedly make frivolous complaints.

For the governance side, including who must have a vigil mechanism and what the Audit Committee must review, see our companion piece on the vigil mechanism under the Companies Act and SEBI LODR.

How Spectra Forensics can help

Our fraud and whistleblower investigations service covers complaint triage, independent investigation, forensic data analysis, interviews and reporting to Audit Committees and Boards. Our digital forensics and eDiscovery team handles device imaging, email review and evidence preservation with documented chain of custody. With 1,250+ investigations over 19+ years, we work from our Pune office across India and internationally. To discuss a complaint in confidence, contact us.