Policy templates / Whistleblowing Policy
Charity Whistleblowing Policy Template (Free, UK)
Filled in from your workspace when you adopt it in CharityControl. A starting point to adapt, not legal advice.
1. Purpose and who this policy is for
your charity wants anyone who works for us to feel safe raising a genuine concern about serious wrongdoing, and to know it will be taken seriously and looked into. Speaking up early helps us put things right and protects the people we exist to help, our money and our reputation.
This policy applies to everyone connected to your charity, including employees, trustees, volunteers, agency and casual workers, contractors and anyone on work experience or a placement. The law's strongest protection is for workers, but we choose to offer the same route and the same protection to everyone in that list.
This is not a legal document and does not change anyone's rights under the Public Interest Disclosure Act 1998.1 It is a starting point your charity has adopted to make those rights easy to use.
2. What whistleblowing means, and how it differs from a complaint or grievance
Whistleblowing is when you raise a concern about wrongdoing that affects others or the public interest, not just you. For example, that money is being misused, someone is being put at risk, or a rule is being broken.
It is different from:
- a personal grievance about your own job, pay or how you have been treated as an employee. Grievances are not covered by this governance policy set. Staff should use the charity's employment and HR procedures. Volunteers do not have a formal grievance route, but can still raise any worry with their named contact;
- a complaint about our services from a member of the public. Use our complaints policy.
If you are not sure which route fits, raise it under this policy anyway. We would always rather hear a concern than miss one.
3. Concerns you can raise
You can raise a concern if you reasonably believe something is happening at your charity that involves, for example:
- a risk to the health or safety of any person, including harm to a child or an adult at risk (a safeguarding concern);
- a criminal offence, such as theft, fraud or bribery;
- money or assets being misused, or serious financial mismanagement;
- a failure to meet a legal duty the charity is bound by;
- damage to the environment;
- someone deliberately hiding any of the above.
You do not need proof, and you do not need to be right. You are protected as long as your belief is honest and reasonable and you are acting in the public interest, not out of personal gain.
4. How to raise a concern
Raise your concern as soon as you can with from your register. You can do this in whatever way feels easiest. Tell them in person, by phone or in writing to from your register. You can also raise a concern online at Raise a concern online.
It helps if you can say what you are worried about, who is involved, and what has happened, but do not hold back just because you cannot fill in every detail. If it is safe and appropriate, putting it in writing gives us a clear record to act on.
Fill in the names and email addresses here and in clause 5 before the trustees adopt this policy, so both reporting routes work from day one.
5. If your concern involves the person you would normally tell
Sometimes the concern is about the very person you are meant to report to, so telling them would send your concern straight to the person it is about. If that happens, or you do not feel able to go to them for any reason, raise it instead with from your register.
Because your charity is small, we deliberately keep more than one route in, so no single person can sit on a concern that is about them. For example, if you are worried that the manager you report to is ignoring a health and safety risk, you can take that worry to the Chair without going through the manager first.
6. Your protection: confidentiality and no reprisals
No one at your charity will be penalised for raising a genuine concern under this policy. Victimising or trying to silence someone who has spoken up is itself a disciplinary matter, and it is against the law.
We will keep your identity confidential as far as we reasonably can. We cannot promise complete anonymity. An investigation may make it obvious who raised the concern, or the law may require us to name you. Where that happens we will talk it through with you first and only share what we need to.
You can also raise a concern anonymously. We will still look into it, though it is harder for us to investigate or to give you feedback if we cannot come back to you.
from your register will check in with you a few weeks after you raise a concern, to make sure you have had no comeback for speaking up. If anything has changed in how you are treated, tell them and we will act on it.
7. Raising a concern outside your charity
We hope you feel able to raise a concern with us first. But you do not have to, and you stay protected in law if you go to a proper external body instead. You might do this if the concern is very serious, involves the trustees, or you have raised it with us and nothing has changed.
You can report a concern about a charity to the Charity Commission, which is a prescribed person you can go to and remain protected.2 See 'Report serious wrongdoing at a charity as a worker or volunteer' on GOV.UK. Other regulators are prescribed for their own areas, for example the Health and Safety Executive, or the police for a crime. GOV.UK publishes the full list of prescribed people and bodies.4
For free, confidential advice before you decide what to do, you can contact Protect, the independent whistleblowing charity, on 020 3117 2520 (please confirm this number is current before you adopt the policy) or at protect-advice.org.uk.7
8. What we will do when you raise a concern
When you raise a concern we will:
- acknowledge it within 5 working days;
- decide how to look into it. This might mean asking a few questions, or a fuller look if the concern is serious;
- keep you informed of what is happening, so far as we are able, and tell you the outcome where we can.
We write every concern down, however it reaches us, so nothing raised in a corridor or a quick chat gets lost.
If your concern points to a safeguarding incident, a crime, or a matter we must report, we will act on that straight away rather than wait for the rest of the process (see clause 10).
9. Untrue concerns
You are protected even if it turns out you were mistaken, as long as you raised the concern honestly and reasonably. Since 2013 the protection has turned on a reasonable belief in the public interest, not on your motive, so no one will be disciplined for an honest concern that is not upheld.1
Deliberately making a false accusation to cause harm, or for personal gain, is different and may be treated as a disciplinary matter. This is not meant to discourage you. The vast majority of concerns are raised in good faith and we treat them that way.
10. Link to our safeguarding and serious incident duties
A whistleblowing concern can be the first sign of something the trustees must report. If a concern involves harm or risk of harm to a child or adult at risk, we will follow our safeguarding policy. If it points to a serious incident, for example a significant loss of money, fraud or a safeguarding failure, we will assess and report it under our Serious Incident Reporting Policy, which holds the reporting decision and the reporting threshold in one place. We will tell the police or another regulator where relevant.
Using this policy never removes anyone's own right or duty to report a crime or a safeguarding risk directly to the police or local authority.
11. Ownership and review
The trustees own this policy. from your register is responsible for making sure people know about it and that concerns are handled properly. We will tell every new worker and volunteer about it when they join, and remind everyone once a year.
The trustees will review this policy at least every two years, or sooner if the law changes or a concern shows the policy needs to work better.
Adopted by the trustees on your review date. Next review due your review date.
More about this policy
When you need it
Having a written whistleblowing policy is not itself a strict legal duty for most charities, but the protection it describes is the law. Under the Public Interest Disclosure Act 1998, which amended the Employment Rights Act 1996,[1] a worker who raises a genuine concern about serious wrongdoing in the public interest is protected in law from being dismissed or treated badly for doing so. That protection applies whether or not you have a policy.
The Charity Commission strongly expects charities to have one, and treats a healthy speak-up culture as part of trustees' duty to act in the charity's best interests and to protect its beneficiaries and assets. A worker can take a concern straight to the Commission, which is a prescribed person under the Act,[5] and stay protected.
Every charity that has staff or volunteers should have this policy, however small. If your charity works with children or adults at risk, it sits alongside your safeguarding policy and feeds into your duty to report serious incidents to the Commission.
What it protects against5 examples
A concern about serious wrongdoing routes only to the person involved. Someone suspects the treasurer is moving money to a personal account, but the policy tells them to report to the treasurer, or to the CEO who is the treasurer's close friend. The concern is buried and never reaches an independent trustee or the regulator.
The policy names at least two routes, including one to a trustee or the Chair who has no role in day-to-day money, and names the Charity Commission as an external route the person can use if the internal ones are compromised.
The person who spoke up is punished. After a volunteer reports a safeguarding failure, they lose shifts, get frozen out of the WhatsApp group, or are labelled a troublemaker until they leave. Others see this and decide it is safer to stay quiet next time.
The policy says clearly that anyone who raises a concern in good faith will not be victimised or disadvantaged, that retaliation is itself a disciplinary matter, and that someone checks on the person weeks later to see if they have had any comeback.
A concern is raised out loud in a corridor or a quick email and then forgotten. No one writes it down, no one owns it, no one gets back to the person. Months later they conclude the charity does nothing and go to a journalist or the regulator first, without the charity ever having had a chance to fix it.
Every concern is acknowledged within a few days, logged, and given a named owner. The person is told what will happen and gets an outcome, even where full detail has to stay confidential.
In a small charity where everyone knows everyone, the whistleblower's identity leaks. The circle handling it is too wide, someone mentions it at a meeting, and within a week it is gossip. Trust collapses and no one raises anything again.
Identity is protected as far as the law allows, kept to the smallest possible group, and the policy offers a way to raise a concern anonymously for people who need it.
Trustees try to keep a serious matter quiet. A significant fraud or a safeguarding incident that meets the Charity Commission's serious incident reporting bar is handled privately because the board hopes to avoid embarrassment, and the external report is never filed.
The policy links whistleblowing to the trustees' serious incident reporting duty, names who decides whether an external report is needed, and makes clear that duty is not optional.
Swipe or scroll for more
How to enforce it
Practical steps to make it live, not just filed:
- Put real names and contacts on the policy, not job titles alone. Name the person to raise a concern with, a backup who is not their manager (usually a trustee or the Chair), and the Charity Commission as the external route, each with a working email or phone number. Update the names whenever someone leaves.
- Keep one simple confidential log of concerns: date raised, who is handling it, and the outcome. A locked spreadsheet or a notebook in a safe is enough. It stops concerns being dropped and lets trustees see any pattern.
- Have a set response when a concern arrives: acknowledge it within a few working days, decide whether it is whistleblowing or an ordinary grievance, hand it to someone with no involvement in the matter, and give the person feedback at the end.
- Review it at board level once a year. The trustees look at how many concerns came in, how they were handled, and whether anyone suffered for speaking up. Tell all staff and volunteers where the policy lives at induction and reissue it each year.
- Check back on the person who spoke up. A few weeks later, someone asks whether they have had any negative treatment since, and the charity acts if they have. This is what makes the no-retaliation promise real rather than words on a page.
What larger charities add4
Pull one in only when it matches something you actually do:
- How we investigate a concern Mid-size (£1m to £10m)+
- Independent advice line and reporting to the board Mid-size (£1m to £10m)+
- Independent reporting channel and committee oversight Large (£10m+)+
- Group, partner and overseas workers Large (£10m+)+
What people get wrong
- Copying a large charity's whistleblowing policy, with an outsourced 24/7 hotline, an audit and risk committee, terms of reference and a multi-stage investigation procedure, when you are a handful of people. It looks impressive and then sits unused, because no one can actually run it.. Use only the core clauses, 1 to 11: a named person to tell, a second route if that person is the problem, protection from reprisal, the external Charity Commission route, and a simple promise of what you will do. That fully meets the duty for a small charity. Add the investigation procedure and board reporting only when your size makes them realistic.
- Leaving out the external route. Telling people they must raise concerns internally, with no mention of the Charity Commission or a body like Protect. This is the most damaging gap. It undercuts the legal protection, which exists precisely so a worker can go outside when internal reporting fails or is unsafe.. Always keep the prescribed-person route (clause 7) in the policy, even the smallest version. Name the Charity Commission as a body a worker can go to and stay protected, and signpost Protect for confidential advice.
- Treating whistleblowing as the same thing as a staff grievance or a public complaint, so genuine concerns get routed into the wrong process, or people do not raise them at all because it is unclear where they go.. Spell out the difference (clause 2) and say plainly that if someone is unsure which route fits, they should raise it under this policy anyway. Staff grievances sit in the employment and HR procedures outside this governance set, not here.
- Requiring the concern to be raised in good faith as a condition of protection, or promising complete anonymity. The law changed in 2013: protection turns on a reasonable belief in the public interest, not on the person's motive, and true anonymity often cannot be guaranteed.. Protect anyone with an honest, reasonable concern (clauses 3 and 9). Offer confidentiality and be honest about its limits rather than promising anonymity you cannot deliver (clause 6).
Terms used here3
- Public Interest Disclosure Act
- The 1998 law that protects a worker from being dismissed or badly treated for raising a genuine concern in the public interest.
- prescribed person
- A body, such as the Charity Commission, that a worker can take a whistleblowing concern to and stay legally protected.
- serious incident
- An event the Charity Commission expects trustees to report, such as significant harm, fraud or a major loss.
Sources7
Numbered to match the [n] citations in the template.
- Public Interest Disclosure Act 1998 (which amended the Employment Rights Act 1996), the law protecting whistleblowers legal duty
- Charity Commission: Report serious wrongdoing at a charity as a worker or volunteer Commission guidance
- GOV.UK: Whistleblowing for employees Commission guidance
- GOV.UK: list of prescribed people and bodies for whistleblowing Commission guidance
- Charity Commission: The Public Interest Disclosure Act (the Commission as a prescribed person) Commission guidance
- Charity Governance Code: Integrity principle (a healthy speak-up culture) good practice
- Protect: the independent whistleblowing advice charity good practice