Vigil Mechanism under the Companies Act and SEBI LODR: What Boards and Audit Committees Must Get Right

A vigil mechanism is the formal channel through which directors and employees report genuine concerns about fraud, misconduct and unethical behaviour, with protection against victimisation and oversight by the Audit Committee. In India it is mandatory for listed companies and certain other companies under s. 177 of the Companies Act 2013, and listed entities must also meet SEBI LODR requirements. Boards and Audit Committees must get three things right: who the mechanism covers, how complaints are investigated, and how whistleblowers are protected.

This post sets out the legal requirements and the practical oversight questions. For the operational side, see our step-by-step guide on how to investigate a whistleblower complaint.

Why does the vigil mechanism matter?

It is often the company's most effective fraud detection control. The ACFE's Occupational Fraud 2026: A Report to the Nations found that 43% of frauds were detected by tips, and 55% of those tips came from employees. Web-based and email channels (46% and 34%) were used more than telephone hotlines (23%).

A mechanism that employees trust surfaces problems early. One they distrust sends concerns to regulators, social media or nowhere at all.

Which companies must have a vigil mechanism?

Section 177(9) of the Companies Act 2013 requires every listed company, and every other prescribed class of company, to establish a vigil mechanism for directors and employees to report genuine concerns. Rule 7(1) of the Companies (Meetings of Board and its Powers) Rules 2014 prescribes the classes:

• every listed company;
• companies that accept deposits from the public; and
• companies that have borrowed money from banks and public financial institutions in excess of INR 50 crore.

The scope has been challenged. In Manoj Kumar Grover v. Union of India (decided 24 February 2026), the Delhi High Court declined to extend the mandate to more companies itself, but directed the Ministry of Corporate Affairs to consult stakeholders and decide within a reasonable period whether it should be extended. Companies outside the mandatory classes should watch for any change, and many already adopt a mechanism voluntarily.

What does the Companies Act require?

Oversight

Under Rule 7(2) and (3), a company required to have an Audit Committee oversees the vigil mechanism through that committee. If a member of the committee has a conflict of interest in a given case, that member should recuse. Companies without an Audit Committee must have the Board nominate a director to play the committee's role.

Safeguards and access

Section 177(10) requires the mechanism to provide adequate safeguards against victimisation of persons who use it, and to make provision for direct access to the chairperson of the Audit Committee in appropriate or exceptional cases.

Disclosure

The details of the vigil mechanism must be disclosed on the company's website, if it has one, and in the Board's report.

Misuse

Rule 7 allows the Audit Committee or nominated director to take suitable action, including reprimand, against a director or employee who repeatedly makes frivolous complaints.

Independent directors

Schedule IV (Code for Independent Directors), which s. 149(8) makes binding, requires independent directors to ascertain and ensure that the company has an adequate and functional vigil mechanism, and that the interests of a person who uses it are not prejudiced. They must also report concerns about unethical behaviour, actual or suspected fraud, or violations of the code of conduct.

What does SEBI LODR add for listed entities?

The SEBI (Listing Obligations and Disclosure Requirements) Regulations 2015 overlay the Companies Act with several specific obligations:

Note that Regulation 22(2) protects "any other person" who uses the mechanism, which is wider than the Companies Act's reference to directors and employees.

Insider trading and UPSI leaks

Regulation 9A(6) of the SEBI (Prohibition of Insider Trading) Regulations 2015 requires listed companies to have a whistle-blower policy that lets employees report instances of leak of unpublished price sensitive information, and to make employees aware of it. Regulation 9A(5) requires a Board-approved policy for inquiring into leaks and prompt intimation to SEBI. Separately, Regulation 7I requires protection for employees who report violations to SEBI under the informant mechanism, and Regulation 7J makes agreements that bar such reporting void.

Disclosure when an investigation becomes a forensic audit

Under Schedule III, Part A, Para A, item 17 of LODR, the initiation of a forensic audit (aimed at detecting misstatement, misappropriation or siphoning of funds) is a deemed-material event. The entity must disclose the initiation, who initiated it and the reasons if available, and later the final report with management comments, except for audits initiated by regulators or enforcement agencies. Audit Committees should consider this before commissioning work in response to a complaint.

How do auditors interact with the vigil mechanism?

Under CARO 2020, para 3(xi)(c), the statutory auditor must report whether it has considered whistleblower complaints received by the company during the year. Auditors will therefore ask for the complaint register and investigation outcomes.

If an auditor has reason to believe that a fraud by officers or employees is being or has been committed against the company, the auditor has its own reporting duty under s. 143(12) of the Companies Act: to the Central Government for frauds of INR 1 crore or more, and to the Audit Committee or Board below that. A well-run vigil mechanism lets the Audit Committee respond to these reports with evidence rather than surprise.

What should Audit Committees actually check?

A written policy and a published email address meet the letter of the law. The real test is whether people use the mechanism and whether complaints lead to proper outcomes. Useful questions for each quarterly review:

1. Accessibility. Are channels available in the languages and formats employees and vendors use? Is there an anonymous option? Is the policy easy to find?
2. Volume and mix. How many complaints arrived, by channel, business unit and category? A unit with no complaints for years may signal fear rather than good conduct.
3. Triage discipline. Who decides whether a complaint is investigated, and is each decision recorded? Are POSH matters routed to the Internal Committee under the POSH Act?
4. Independence. Are complaints against senior management routed to the Audit Committee chair, and investigated by people outside the subject's reporting line?
5. Timeliness. What is the average age of open cases? Which have been open for more than 90 days, and why?
6. Quality. Do reports show evidence for each finding? Are recommendations implemented?
7. Retaliation. Has anyone who raised a concern later been transferred, rated poorly or exited? How was that reviewed?
8. Root cause. Do findings feed into the fraud risk assessment and internal controls programme?

Common weaknesses

• The policy names the compliance head as the sole recipient, with no route to the Audit Committee chair.
• Investigations are run by the manager of the team under suspicion.
• Complaints are closed as "no evidence" without any document or data review.
• Whistleblowers never hear back, so they stop reporting.
• Investigation files are not preserved, leaving the company exposed if the matter becomes a dispute.

What should a vigil mechanism policy contain?

A practical policy covers scope (who may report and what about), reporting channels, the role of the Audit Committee or nominated director, the triage and investigation process, confidentiality, protection against victimisation, treatment of anonymous and bad-faith complaints, record-keeping, and reporting to the Board.

Policies should also anticipate the Digital Personal Data Protection Act 2023. Most Data Fiduciary obligations under the DPDP Rules 2025 apply from about 13 May 2027, so complaint registers and investigation files should be designed now with access controls and retention rules in mind.

Finally, define what a whistleblower can expect: acknowledgement, confidentiality, an outcome notice and protection. Trust in those promises is what makes the vigil mechanism work. For a wider view of how this fits Board oversight, see our guide to building a fraud risk management framework.

How Spectra Forensics can help

Our fraud and whistleblower investigations service covers independent investigation of complaints, reporting to Audit Committees, and review of vigil mechanism policies and processes against the Companies Act and SEBI LODR. Our fraud and whistleblower investigation team can also support Audit Committees when complaints involve senior management. With 19+ years of practice and 1,250+ investigations, we work from Pune across India and in 10+ countries. To discuss your vigil mechanism, contact us.