Whistleblower & Ethics Hotline Framework

Build a confidential reporting system and ethics investigation workflow for your organization. Covers anonymous intake, case triage, investigation protocols, regulatory obligations, and retaliation prevention.

What This Skill Does

When activated, guide the user through:

1. Intake Channel Design — Set up anonymous reporting (web form, hotline, email alias, physical drop box). Ensure no metadata leaks caller identity. Recommend third-party platforms (EthicsPoint, NAVEX, AllVoices) vs self-hosted.

2. Case Triage Matrix | Severity | Examples | Response SLA | Escalation | |----------|----------|-------------|------------| | Critical | Fraud >$50K, safety hazard, harassment by exec | 24 hours | Board/Audit Committee + outside counsel | | High | Policy violation, discrimination, data breach | 72 hours | General Counsel + CHRO | | Medium | Conflict of interest, expense abuse | 5 business days | Compliance Officer | | Low | Policy questions, minor conduct | 10 business days | HR Business Partner |

3. Investigation Protocol

4. Preserve evidence before interviewing
5. Separation of duties: investigator ≠ accused's manager
6. Interview template: open questions, avoid leading, document verbatim
7. Chain of custody for digital evidence
8. Timeline reconstruction framework

9. Findings memo template (facts only, no opinion)

10. Regulatory Compliance by Jurisdiction

11. US: SOX Section 301 (public companies must have anonymous channel), Dodd-Frank (SEC bounty program, anti-retaliation), False Claims Act (qui tam)
12. EU: EU Whistleblower Directive 2019/1937 (mandatory for 50+ employees, 3-month feedback deadline)
13. UK: Public Interest Disclosure Act 1998 (PIDA), FCA whistleblowing rules
14. Australia: Corporations Act 2001 Part 9.4AAA

15. Canada: PSDPA (federal public sector), provincial variations

16. Retaliation Prevention Checklist

17. Document reporter's current performance rating, comp, role BEFORE investigation
18. No adverse actions (termination, transfer, demotion, schedule change) without compliance sign-off
19. Monitor for subtle retaliation: exclusion from meetings, workload changes, peer pressure
20. Mandatory retaliation training for all managers annually

21. Exit interview flag: "Were you ever discouraged from reporting concerns?"

22. Board Reporting Template

23. Quarterly: # reports received, # open, # closed, avg resolution time, category breakdown

24. Annual: trends, benchmarking vs industry (NAVEX Hotline Benchmark Report), policy changes made, training completion rates

25. Policy Document Generator Output a complete Whistleblower Protection Policy covering:

26. Purpose and scope
27. Protected disclosures definition
28. Reporting channels
29. Confidentiality and anonymity guarantees
30. Investigation process overview
31. Non-retaliation commitment
32. Record retention (7 years minimum)

33. Annual review clause

34. 10-Industry Benchmarks | Industry | Avg Reports per 100 Employees | Top Category | Compliance Focus | |----------|-------------------------------|-------------|-----------------| | Financial Services | 1.4 | Fraud/Theft | SOX, BSA/AML, FCA | | Healthcare | 1.8 | Patient Safety | HIPAA, False Claims Act | | Manufacturing | 0.9 | Safety/Environment | OSHA, EPA | | Technology | 0.7 | HR/Discrimination | SOX (if public), GDPR | | Government | 1.2 | Waste/Abuse | Inspector General, PSDPA | | Education | 0.8 | Title IX, Safety | Clery Act, Title IX | | Retail | 1.1 | Theft/HR | FLSA, state wage laws | | Energy | 1.0 | Safety/Environment | NRC, EPA, OSHA | | Legal/Professional | 0.6 | Conflicts of Interest | Bar rules, SOX | | Construction | 1.3 | Safety/Wage | OSHA, Davis-Bacon |

Output Format

Deliver as structured markdown with clear sections. Include jurisdiction-specific callouts based on user's location. Provide copy-paste policy language where appropriate.

Built by AfrexAI — AI agent context packs for every business function. Browse all packs: https://afrexai-cto.github.io/context-packs/