A whistleblower policy tells staff how to report wrongdoing safely. In India the same idea appears in law as the "vigil mechanism", which Section 177 of the Companies Act, 2013 requires listed companies and certain other companies to set up, and which the SEBI Listing Regulations also require of listed entities. Having a policy on paper is not enough. An audit should test whether anyone can use it without fear.
Last reviewed: 17 October 2026. Facts checked. We searched for Section 177(9) and (10), Rule 7 of the 2014 Board meetings rules and Regulation 22 of the SEBI Listing Regulations. Search results returned the text of section 177(10) as hosted on the Income Tax Department site (including the website and board's report disclosure proviso), company policies, a Delhi High Court filing and SEBI documents that quote the provisions. We tried to open the SEBI regulations page and the India Code Companies Act page. SEBI timed out and India Code returned 403. We did not open the statute text and have left out the borrowing threshold and any penalty. Confirm the wording on mca.gov.in and sebi.gov.in.
Policy or vigil mechanism: same thing?
Mostly yes. "Vigil mechanism" is the legal term. "Whistleblower policy" is what most companies call the document. One policy can satisfy both. Keep it plain so that a junior clerk can follow it.
What the law says (in outline)
Secondary sources that quote the provisions say:
- Section 177(9): every listed company, and other classes of companies as prescribed, must establish a vigil mechanism for directors and employees to report genuine concerns.
- Section 177(10): the mechanism must protect users from victimisation, give direct access to the audit committee chair in appropriate cases, and the company must disclose it on its website and in the board's report.
- Rule 7 of the 2014 rules lists the other classes of companies covered. We did not open it, so read it to see if your company is included.
- SEBI Listing Regulations, Regulation 22: listed entities must have a vigil mechanism with safeguards against victimisation and access to the audit committee chair in appropriate cases. A Delhi High Court filing records SEBI's position that Regulation 22 and Section 177 work together.
What to include in the policy
| Section | What it should say |
|---|---|
| Who is covered | Directors, employees and, if you choose, vendors and contractors |
| What can be reported | Fraud, bribery, accounting manipulation, policy breach, harassment, safety risks |
| How to report | At least two channels: email, a hotline and a direct line to the audit committee chair |
| Anonymity | Whether anonymous reports are accepted and how they are handled |
| Protection | A clear promise against dismissal, demotion or harassment, and how retaliation is reported |
| Who investigates | A named person or committee with no conflict of interest |
| Timelines | Acknowledge in a few days, give a target for closure, update the reporter |
| Confidentiality | Who sees the report and how files are kept |
| Misuse | What happens to deliberately false complaints, stated carefully so it does not scare off genuine reporters |
| Reporting to the board | Regular summary to the audit committee |
| Disclosure | Where the policy is published |
How to audit it
An audit has to test the mechanism, not just read it. Our whistleblower mechanism review template gives a ready checklist. The core tests are below.
Design
- The policy exists, is approved by the board or audit committee and is current.
- Disclosure is on the website and in the board's report where required.
- The audit committee chair can be reached directly.
Awareness
- Ask a sample of staff, including junior staff and those at remote sites, whether they know how to report. Poor awareness is the most common finding.
- Check that training is part of induction.
Operation
- Get the log of all complaints for the year. Is every complaint numbered, dated and assigned?
- Test for response times against the policy.
- Pick a sample and read the investigation file. Is the investigator independent of the person accused?
- Check outcomes: was action taken, and was the reporter told?
Protection
- Look at complainants who later left, were moved or got a poor rating. Is there any link?
- Confirm HR knows it must not act against a reporter without review.
Reporting
- Does the audit committee get periodic summaries?
- A year with zero complaints at a large company deserves a question about whether the channel works.
Common findings
- Policy copied from a template that names people who left
- Hotline run by the HR head, who is also often the subject of complaints
- No log, or a log kept only by one person
- No feedback to the reporter
- Staff in factories and branches unaware of the channel
Where this connects
Fraud findings often start with a tip. See fraud risk assessment step by step and the role of the audit committee in audit committee in India. Under the Companies Act, auditors also have a duty to report certain frauds, covered in Form ADT-4 and Section 143(12).
Frequently Asked Questions
What is a vigil mechanism?
It is the channel a company sets up so directors and employees can report genuine concerns, with protection from victimisation. It is the legal term for a whistleblower channel.
Is a whistleblower policy mandatory in India?
The Companies Act requires a vigil mechanism for listed companies and other prescribed classes. SEBI rules require it for listed entities. Private companies should check whether Rule 7 covers them.
Can employees report anonymously?
The law, as we read it from secondary sources, does not settle this. The policy should say whether anonymous reports are accepted and how they are handled.
Who should handle whistleblower complaints?
A person or committee independent of the people complained about, with access to the audit committee chair.
How do auditors test a whistleblower policy?
By checking design, staff awareness, the complaint log, investigation files, protection of reporters and reporting to the audit committee.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error