Compliance Management
Governance, Risk Management and Compliance (GRC)
Nonprofit Management
Nonprofit Whistleblower Policy: Template, Form 990 Line 13 and How to Handle Reports
Last updated: October 15, 2026 · Independent guide · We do not sell rankings or coverage.
A whistleblower policy for a nonprofit is a board-adopted document that tells staff, volunteers and directors how to report suspected wrongdoing, who receives those reports, and how the organization protects the person who reports. Federal tax law does not require one, but Form 990 asks about it on Part VI, line 13, and two Sarbanes-Oxley criminal provisions on retaliation and document destruction apply to nonprofits. Below are a copyable policy, an audit committee workflow and a report log.
How to use this template
Part 1 is the policy your board adopts by resolution. Part 2 is the internal procedure for handling each report, and Part 3 is the log that proves the procedure ran. Fill in the bracketed contacts and have counsel check the text against your state’s law. Minute the adoption date, because the IRS counts a policy for Form 990 only if the board, or a committee it authorized to adopt the policy, adopted it by the end of the tax year.
Part 1: Whistleblower policy template
This text combines the three elements the IRS uses to describe a whistleblower policy in the 2025 Form 990 instructions with the required contents of New York’s Not-for-Profit Corporation Law section 715-b, one of the more detailed state statutes. Section 7 applies only if you receive federal awards.
| Section | Policy text (adapt to your organization) |
|---|---|
| 1. Purpose | This policy encourages anyone with credible information about illegal practices or policy violations to come forward, and it protects them from retaliation. |
| 2. Who is covered | Directors, officers, employees and volunteers. Reports from contractors, clients and the public are also accepted. |
| 3. What to report | Suspected fraud, theft or misuse of funds; questionable accounting, internal controls or audit matters; violations of law or regulation; misuse of restricted or grant funds; undisclosed conflicts of interest; destruction or falsification of records; and violations of any adopted policy of the Organization. |
| 4. How to report | A person may report to their supervisor, to the Compliance Officer [name, email, phone], or through the anonymous reporting channel [web address or hotline number]. A report that involves the Executive Director, the Compliance Officer or a finance officer goes directly to the Chair of the Audit Committee [name, email]. |
| 5. No retaliation | No person who reports in good faith will suffer intimidation, harassment, discrimination or other retaliation, and no employee will suffer an adverse employment consequence. Anyone who retaliates is subject to discipline up to and including termination or removal from the board. |
| 6. Good faith | A reporter must have reasonable grounds to believe the information is true. A knowingly false report is a disciplinary matter. |
| 7. Federal award rights | Employees working on federal contracts or grants also have rights under 41 U.S.C. 4712, including the right to report gross mismanagement of a federal contract or grant or gross waste of federal funds to an Inspector General, a federal oversight official or a member of Congress. The Organization will give employees written notice of these rights. |
| 8. Confidentiality | The Organization keeps the reporter’s identity and the report confidential, sharing it only as needed to investigate and act. Anonymous reports are accepted, though anonymity can limit follow-up. |
| 9. Compliance Officer | The board designates [title] as Compliance Officer to administer this policy. The Compliance Officer acknowledges each report, arranges an investigation, and reports on implementation, the general types of complaints and their resolution to the Audit Committee at each meeting and to the full board at least annually. |
| 10. Conflicted persons | A person who is the subject of a report may not be present for or take part in board or committee deliberations or votes on that report. The board or committee may ask that person for information before deliberations begin. Employees who serve as directors may not take part in deliberations or votes on administering this policy. |
| 11. Record holds | Once a report is received, routine destruction under the document retention policy stops for every record related to it until the Audit Committee closes the matter in writing. |
| 12. Distribution | The Organization gives a copy of this policy to all directors, officers, key persons, employees and volunteers who provide substantial services, posts it on its website, and includes it in onboarding. |
Sections 9, 10 and 12 track New York’s requirements. Section 11 links this policy to Form 990 line 14 and the federal record-destruction statute described below.
Part 2: Report handling and audit committee workflow
The timings are illustrative internal targets, not legal deadlines. Have the Audit Committee approve your own.
| Step | Owner | Illustrative timing | Record created |
|---|---|---|---|
| 1. Receive and log the report; assign a case number | Compliance Officer (Audit Committee Chair if management is implicated) | Same business day | Log entry, original report saved unedited |
| 2. Acknowledge receipt to the reporter | Compliance Officer | Within 5 business days | Copy of acknowledgment |
| 3. Triage: category, severity, conflicts, legal hold | Compliance Officer with Audit Committee Chair | Within 5 business days | Triage note, hold notice if issued |
| 4. Investigate | Assigned investigator; outside counsel or auditor for financial or senior-staff matters | Target 30 to 60 days | Interview notes, documents reviewed |
| 5. Decide outcome and corrective action | Audit Committee (subject of report excluded) | Next committee meeting | Committee minutes |
| 6. Close out with the reporter and check for retaliation | Compliance Officer | At closing and again after 90 days | Closing note, retaliation check |
| 7. Report to the board | Audit Committee Chair | Annually at minimum | Summary by category and outcome, no names |
Part 3: Whistleblower report log
Keep one row per report in a file only the Compliance Officer and Audit Committee Chair can open. Example entries are illustrative.
| Field | What to record | Illustrative entry |
|---|---|---|
| Case number | Sequential ID by year | 2026-004 |
| Date received | Date and channel | March 3, 2026, web form |
| Reporter | Name, or “Anonymous” with the follow-up method | Anonymous, portal messages |
| Category | From Part 1, Section 3 | Misuse of restricted grant funds |
| Federal award involved | Yes/No and award number | Yes, [award number] |
| Record hold issued | Date and recipients | March 5, 2026, finance and program staff |
| Key dates | Acknowledged, triaged, committee review, closed | March 4; March 6; April 21; April 28 |
| Outcome | Substantiated, partly substantiated, unsubstantiated | Partly substantiated |
| Corrective action | What changed and who owns it | Costs reclassified; second approval added to grant charges |
| Retaliation check | Date and result | July 27, 2026, no concerns raised |
Form 990 Part VI, line 13 (and line 14)
The 2025 Form 990 asks on line 13, “Did the organization have a written whistleblower policy?” and on line 14 whether it had a written document retention and destruction policy. Section B covers “policies not required by the Internal Revenue Code,” so “No” is permitted, but funders read the public return.
| Line | What the IRS describes | What supports “Yes” | Evidence to keep |
|---|---|---|---|
| 13 | A policy that encourages staff and volunteers to come forward, protects them from retaliation, and names the people to whom reports go | Written policy adopted by the board, or an authorized committee, by year end | Signed policy, adopting resolution, minutes, distribution record |
| 14 | A policy that assigns retention responsibilities for storing and destroying the organization’s records | Same adoption test, plus a retention schedule | Policy, schedule, destruction log, hold notices |
Line 13 does not ask how many reports you received, so the Part 3 log stays internal.
The Sarbanes-Oxley provisions that apply to nonprofits
Most of Sarbanes-Oxley is aimed at public companies, but the National Council of Nonprofits notes that its protections against retaliation and evidence destruction also apply to nonprofits. Both are criminal provisions.
- Retaliation, 18 U.S.C. 1513(e). Section 1513(e) punishes anyone who knowingly takes harmful action, including interference with lawful employment, against a person for giving a law enforcement officer truthful information about a possible federal offense. The penalty is up to 10 years in prison.
- Record destruction, 18 U.S.C. 1519. Section 1519 covers anyone who knowingly destroys, alters, conceals or falsifies a record to obstruct a federal matter, or in contemplation of one. The penalty is up to 20 years. This is why Part 1, Section 11 suspends routine destruction once a report arrives.
The civil whistleblower provision most people associate with Sarbanes-Oxley, 18 U.S.C. 1514A, covers companies with securities registered or reported under the Securities Exchange Act, so it does not reach a typical nonprofit. If you receive federal awards, 41 U.S.C. 4712 protects your employees’ disclosures about federal grant or contract misconduct, and 2 CFR 200.217 requires recipients and subrecipients to “inform their employees in writing” of those rights.
State law adds more. The National Council of Nonprofits says more than 45 states have workplace whistleblower laws, so check yours with counsel.
Walking through each part of the template
Reporting channels. Give at least one route that bypasses management. If every route leads to the Executive Director, a report about the Executive Director has nowhere to go.
Audit Committee role. Without an audit committee, name the finance committee or board chair, as long as the person is independent of management. Line 1b of Part VI already asks you to count independent voting members, so you know who qualifies.
Conflicts. Section 10 should use the same recusal process and minuting as your nonprofit conflict of interest policy.
Common mistakes
- Adopting after year end. The IRS counts a policy only if the board, or an authorized committee, adopted it by the end of the tax year.
- A policy nobody received. Add it to onboarding and the website, not only the board binder.
- Using a general inbox. Reports sent to an info@ address or a shared HR inbox reach people who may be the subject.
- Destroying records on schedule. Without a hold, routine deletion during an investigation can look like obstruction under section 1519.
- Skipping the federal notice. Federal award recipients must give employees written notice of their 41 U.S.C. 4712 rights.
When to move from a spreadsheet to software
A restricted spreadsheet and a dedicated email address work for a few reports a year. Move to a hosted channel when you need anonymous two-way messaging, after-hours phone intake or an audit trail you can show a funder.
NAVEX EthicsPoint Essentials. NAVEX’s small business pricing page (no date shown) lists pricing “starting at $1,980” a year for organizations with 250 or fewer employees, with web and phone reporting, anonymous reporting and case management. It does not publish prices for larger organizations.
Whistlelink. Whistlelink’s pricing page (modified September 11, 2026) lists euro prices from 79 EUR a month for up to 49 employees, billed annually, including anonymous two-way messaging and a tamperproof log. A phone hotline is a separate add-on, and it says NGO pricing is available without stating the discount.
Board portals. If your board already uses one of the board management platforms, put the anonymized log summary in the Audit Committee’s meeting materials there rather than in email. For policy distribution and attestation tracking across all your policies, see nonprofit compliance and risk management software.
How we researched this
On October 15, 2026 we read the 2025 Form 990 and its instructions, the IRS Part VI governance guidance, the federal statutes and regulation cited, New York’s section 715-b and the New York Attorney General’s guidance, and vendor pricing pages. This is general information, not legal or tax advice.
Related guides
- Gift Acceptance Policy: Template and Non-Cash Gift Rules
- Nonprofit Audit Checklist: PBC List and Schedules
- Form 990 Schedule O: Required Lines and Sample Wording
Frequently asked questions
Is a whistleblower policy required for a 501(c)(3)?
Not under the Internal Revenue Code. Form 990 Part VI labels the question as one about policies the Code does not require. Some states do require one; New York requires it for corporations with 20 or more employees and more than $1 million in prior-year revenue.
What does Form 990 line 13 ask?
It asks, “Did the organization have a written whistleblower policy?” Answer “Yes” only if the board, or a committee the board authorized to adopt it, adopted it by the end of the tax year.
Does Sarbanes-Oxley apply to nonprofits?
Mostly not, but two criminal provisions do. 18 U.S.C. 1513(e) prohibits retaliation against people who report federal offenses to law enforcement, and 18 U.S.C. 1519 prohibits destroying records to obstruct a federal investigation.
Who should receive whistleblower reports at a small nonprofit?
Name a Compliance Officer and a second contact independent of management, usually the audit or finance committee chair, who receives any report about the Executive Director or finance staff.
Sources
- IRS, Form 990 (2025), Part VI lines 13 and 14, created April 30, 2025. irs.gov
- IRS, Instructions for Form 990 (2025), Part VI lines 13 and 14, dated December 9, 2025. irs.gov
- IRS, Form 990 Part VI, Governance: Policies adopted by authorized board committees, last reviewed or updated June 28, 2026. irs.gov
- 18 U.S.C. 1513(e), Retaliating against a witness, victim, or an informant, no date shown. law.cornell.edu
- 18 U.S.C. 1519, Destruction, alteration, or falsification of records, no date shown. law.cornell.edu
- 18 U.S.C. 1514A, Civil action to protect against retaliation in fraud cases, no date shown. law.cornell.edu
- 41 U.S.C. 4712, Enhancement of contractor protection from reprisal for disclosure of certain information, no date shown. law.cornell.edu
- 2 CFR 200.217, Whistleblower protections, eCFR up to date as of October 8, 2026. ecfr.gov
- New York Not-for-Profit Corporation Law section 715-b, revision dated November 15, 2019. nysenate.gov
- New York Attorney General, Charities Bureau, Whistleblower Policies guidance document 2015-5, April 13, 2015. ag.ny.gov
- National Council of Nonprofits, Whistleblower Protections for Nonprofits, modified October 5, 2026. councilofnonprofits.org
- NAVEX (vendor), EthicsPoint Essentials pricing page for small and midsize businesses, no date shown. navex.com
- Whistlelink (vendor), pricing page, modified September 11, 2026. whistlelink.com
Sherman Hsieh
Independent analysis of enterprise software — ERP, CRM and more
