What is the difference between a grievance and whistleblowing?

A grievance is a complaint about how you personally are treated at work. Whistleblowing is reporting wrongdoing that affects others or the public, like fraud or a safety risk. In the UK, personal grievances aren’t covered by whistleblowing law unless they’re in the public interest.

Do companies have to offer anonymous reporting?

Rules vary by country. The EU directive requires internal channels for organizations with 50 or more workers and leaves anonymity to each member state. In the US, prosecutors ask whether a company has an anonymous reporting mechanism and, if not, why not.

How quickly should a whistleblowing report be acknowledged?

The EU directive sets seven days to acknowledge a report and three months to give feedback. Many companies outside the EU use the same timings, because they are easy to explain and to track.

← HR templates

Policies

Whistleblowing and speak up policy template

How to report a problem, what happens next and protection for people who speak up. A complete policy to adapt with your own rules.

A starting point, not legal advice. Leave, pay and expense rules differ by country, state and city. Use the checks on this page to see what to look up where your people work, and have someone qualified review your policy before you publish it.

Knowledge draft. Opens a Knowledge draft with this policy, its checks and what Shuffl already knows, like your HR contact and countries. Draft with Mello can write the rest and show where each value came from. Nothing is published until you choose Publish.

Use in Shuffl

A whistleblowing or speak up policy tells people how to raise a concern, what happens next and how they are protected.

People need more than one route, including one that does not go through their manager or HR.

Shuffl · HR by the numbers

Speaking up in numbers

Source: Association of Certified Fraud Examiners, 2026¹Download PNG

Raising a concern

Words in [square brackets] are for you to fill in. The policy has every section a real handbook policy has, but no allowances, dates or amounts of its own.

# Raising a concern

## Purpose
We want to hear about anything that seems wrong at work. This policy explains how to raise a concern, what happens next, and how you are protected when you do.

## Who this covers
Everyone who works here, including [contractors, interns and former employees], can use this policy.

## What you can raise
- Harassment, bullying or discrimination
- Breaking the law, fraud, bribery or financial wrongdoing
- Risks to health, safety or the environment
- Misuse of data or a breach of privacy
- Breaches of the Code of conduct or any other company policy
- Someone covering up any of these

For a disagreement about your own pay, role or workload, start with [your manager or another route].

## How to raise a concern
Use whichever route you are comfortable with:
1. Your manager, or their manager.
2. [HR contact] at [email].
3. [A named senior person, for example the CEO or a board member], if the concern involves HR or leadership.
4. [An anonymous route, for example a form or an outside hotline], if you would rather not give your name.

You do not need proof. Share what you know, when it happened and who was involved.

## What happens next
1. We confirm we have received your concern within [number] working days.
2. [Role] decides who looks into it. Nobody named in the concern takes part in that review.
3. We tell you when the review is done and, where we can, what we did about it. Some details may stay private to protect other people.

## Confidentiality
We share your concern only with the people who need it to look into it. If you raised it anonymously, we will not try to find out who you are.

## Protection from retaliation
Nobody will lose their job, be disciplined or be treated worse for raising a concern in good faith, or for helping with a review, even if the concern turns out to be unfounded. Retaliation is a serious breach of this policy. Knowingly making a false report is also a breach.

## Reporting outside the company
Nothing in this policy stops you from reporting to a regulator, a government agency or the police, or from talking to a lawyer.

## Where local law differs
If the law where you work gives you more protection or other ways to report, the law applies. These places have their own rules: [list them, or "none"].

## Records
HR keeps a record of each concern and its outcome for [period], separately from personnel files.

## Related policies
Code of conduct and Equal opportunity and anti-harassment.

## About this policy
Owned by [team or person]. Applies in [countries or states]. We may update this policy and will tell you at least [number] days before a change takes effect. This policy is not part of your employment contract.

## Questions
Contact [team or person] at [email or channel].

Check before you publish

Rules that often catch teams out, by place. They are not part of the policy, and not legal advice.

European Union

Under the Whistleblower Directive, organisations with 50 or more workers need an internal reporting channel, must acknowledge a report within 7 days and give feedback within 3 months.

United Kingdom

The Public Interest Disclosure Act protects workers who report to a prescribed person, such as a regulator. Keep the section on reporting outside the company.

United States

Do not restrict reports to agencies such as the SEC, EEOC or NLRB. Federal rules protect them, and confidentiality wording that discourages them can be unlawful.
Public companies must give people a way to raise accounting concerns anonymously with the audit committee (Sarbanes-Oxley section 301).

How to adapt it

Offer an anonymous route, and say how anonymous reports are handled.
Give a time to acknowledge a report in working days.
Never stop people from reporting to a regulator or the police.

What the research says

People inside an organization usually see wrongdoing first. In the Association of Certified Fraud Examiners’ 2026 study of 2,402 fraud cases, 43% were detected by a tip, and 55% of those tips came from employees.¹ Organizations with formal reporting mechanisms had a median loss of $100,000 and caught fraud after a median of 11 months, against $150,000 and 17 months without.¹

How people report is changing. Web-based reporting was the most common route for tips at 46%, then email at 34% and telephone hotlines at 23%.¹ When whistleblowers went to someone inside the organization, it was most often their direct supervisor, in 32% of cases.¹ Managers need to know what to do when a concern lands with them.

What the law requires

In the EU, the Whistleblowing Directive requires private sector organizations with 50 or more workers to set up internal reporting channels. Reports must be acknowledged within seven days, and feedback given within three months of that acknowledgment. Retaliation against people who report is prohibited.² Each member state writes its own law on top, so check national rules.

In the UK, workers are protected from being treated unfairly or losing their job for blowing the whistle on matters in the public interest, such as criminal offences, dangers to health and safety, damage to the environment, sexual harassment or covering up wrongdoing. Personal grievances aren’t covered unless they’re in the public interest.³

In the US, protection comes from federal laws enforced by OSHA, including the Sarbanes-Oxley Act.⁴ SEC rules bar any action that impedes someone from contacting SEC staff directly about a possible securities law violation, including enforcing a confidentiality agreement.⁵ Prosecutors assessing a compliance program check for an anonymous reporting mechanism and an anti-retaliation policy.⁶

Common mistakes

Offering only one route, usually through a manager or HR, which fails when the concern is about them.
Promising anonymity but asking for details that identify the person, or sharing the report too widely.
Going quiet after a report. People who hear nothing back assume nothing happened and stop reporting.
Using confidentiality clauses that seem to stop people going to a regulator or the police.

Common questions

What is the difference between a grievance and whistleblowing?: A grievance is a complaint about how you personally are treated at work. Whistleblowing is reporting wrongdoing that affects others or the public, like fraud or a safety risk. In the UK, personal grievances aren’t covered by whistleblowing law unless they’re in the public interest.
Do companies have to offer anonymous reporting?: Rules vary by country. The EU directive requires internal channels for organizations with 50 or more workers and leaves anonymity to each member state. In the US, prosecutors ask whether a company has an anonymous reporting mechanism and, if not, why not.
How quickly should a whistleblowing report be acknowledged?: The EU directive sets seven days to acknowledge a report and three months to give feedback. Many companies outside the EU use the same timings, because they are easy to explain and to track.

Sources

Read on October 13, 2026. Laws change, so check the source before you act. This page is general information, not legal advice.

Association of Certified Fraud Examiners, Occupational Fraud 2026: A Report to the Nations, 2026. 2,402 occupational fraud cases from 143 countries and territories, reported by Certified Fraud Examiners in a survey run from July to September 2025.
legislation.gov.uk (EU text as adopted), Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law, 23 October 2019. Articles 6, 8, 9 and 19.
GOV.UK, Whistleblowing for employees, Current page, read October 2026.
U.S. Department of Labor, Occupational Safety and Health Administration, Whistleblower Statutes, Current page, read October 2026.
Legal Information Institute, Cornell Law School, 17 CFR § 240.21F-17 - Staff communications with individuals reporting possible securities law violations, Current page, read October 2026.
U.S. Department of Justice, Criminal Division, Evaluation of Corporate Compliance Programs, Updated September 2024.