Join the waitlist
Glossary/Fraud and ethics

Whistleblower program

A whistleblower program is a channel for employees and others to report suspected fraud or misconduct, usually confidentially. Auditors ask about it because it is a visible anti-fraud control.

CORAA TeamUpdated November 5, 2026

Definition

A whistleblower program is a process that lets employees, vendors and others report suspected fraud, accounting concerns or ethical violations, with an option to stay anonymous. For public companies, audit committees must establish procedures for complaints about accounting and auditing matters under Sarbanes-Oxley section 301 and SEC Rule 10A-3. For private entities it is voluntary, although many adopt a hotline.

Why it matters in an audit or review

AU-C 240 directs the auditor to inquire of management, internal audit and those charged with governance about their processes for identifying and responding to fraud risks, and about any allegations of fraud. Whether a reporting channel exists and is used tells the auditor something about the control environment. Tips received during the year are also a source of fraud risk information.

Example

A 120-person distributor has no hotline. The auditor asks the owner and the audit committee chair about allegations received in the year, notes that employees have no confidential route to report concerns, and considers that in assessing the control environment and fraud risk. The auditor also inquires of the AP clerk and warehouse lead directly, since there is no formal channel.

Common mistakes

Counting a hotline as effective because it exists. The auditor asks how reports are logged, who reviews them and what happened to recent ones.

Sources

  • Sarbanes-Oxley Act of 2002, section 301; 15 U.S.C. 78j-1(m)(4)
  • 17 CFR 240.10A-3, Listing standards relating to audit committees
  • AICPA, AU-C Section 240, Consideration of Fraud in a Financial Statement Audit
  • AICPA, AU-C Section 260, The Auditor's Communication With Those Charged With Governance

Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error

Standards

AU-C 240AU-C 260

Related terms

  • Fraud risk factors
    Fraud risk factors are events or conditions that indicate an incentive or pressure to commit fraud, an opportunity to do it, or an attitude that justifies it. They are red flags, not proof of fraud.
  • Control environment
    The control environment is the foundation of internal control: the attitudes, awareness and actions of management and those charged with governance about controls and why they matter. The other components rest on it.
  • Tone at the top
    Tone at the top is the example management and the board set about integrity, ethics and accountability. It shapes the control environment more than written policies do.
  • Fraud triangle
    The fraud triangle is a model that says fraud tends to occur when three conditions meet: pressure or incentive, a perceived opportunity, and a rationalization. AU-C 240 builds its fraud risk factors on this idea.

Go deeper

All glossary terms →

For US CPA firms

Join the CORAA waitlist

CORAA AI drafts audit working papers from your client’s QuickBooks books and does the first pass: lead schedules, tie-out, memos, draft notes and letters. CORAA Network reviewers clear every finding. Your firm reviews and signs.

  • First audit free, so you can judge the quality on a real file
  • Flat fee by entity size; messy books included
  • We work only with CPA firms, never their clients
See how it works →

* required