How to Create a Nonprofit Whistleblower Policy

Why Nonprofits Adopt a Whistleblower Policy

A whistleblower policy gives staff, volunteers, and board members a clear, safe channel to report suspected illegal activity or violations of the organization's own policies, such as financial misconduct, conflicts of interest, or safety violations, without fearing they will lose their job or position for speaking up. Beyond the practical governance benefit, the policy answers a direct question on Form 990, the annual return most tax-exempt organizations file, which makes its existence (or absence) visible to donors, grantmakers, and watchdog groups who review these public filings.

What Form 990 Actually Asks

Part VI of Form 990, the governance section, asks: "Did the organization have a written whistleblower policy?" Answering "yes" accurately requires more than having some informal understanding that employees can raise concerns. Per the IRS Form 990 instructions, a policy should satisfy three elements to support a "yes" answer:

1. It encourages staff and volunteers to come forward with credible information about illegal practices or violations of the organization's adopted policies.
2. It specifies that the organization will protect the individual who reports from retaliation.
3. It identifies the staff, board members, or outside parties to whom such information can be reported.

A policy missing any of these three elements may not support a "yes" answer, even if the organization believes informally that it protects whistleblowers.

Element One: Encourage Reporting

The policy should affirmatively invite people to report concerns, rather than simply stating that misconduct is against the rules. Effective language describes the kinds of issues covered, such as financial impropriety, fraud, harassment, safety violations, or other illegal practices, and makes clear that reporting is expected and valued, not merely tolerated.

Element Two: Promise Protection From Retaliation

The policy needs an explicit anti-retaliation commitment: a statement that no one will be disciplined, demoted, terminated, or otherwise retaliated against for reporting in good faith, even if the underlying concern turns out to be unfounded after investigation. Many policies also address what happens if someone believes they have experienced retaliation despite this promise, giving them a path to raise that separately.

Element Three: Name Who Receives Reports

The policy must identify specific people or channels for reporting, not just a vague instruction to "tell someone." Common structures include designating a specific officer (such as the board chair or an audit committee chair) as the primary contact, offering an alternative contact when the concern involves that primary person directly, and in some organizations, an anonymous third-party hotline. Smaller nonprofits without the budget for a hotline service commonly designate two board members, so a reporter always has an alternative if their concern involves one of them.

Board Adoption and Communication

Like most Form 990 governance policies, a whistleblower policy should be formally adopted by board resolution and documented in meeting minutes, not just drafted and filed away. After adoption, distribute it to staff, volunteers, and board members, and include it in new employee and new board member orientation materials, since a policy no one knows exists does little to actually encourage reporting.

Check Whether Your State Requires One by Law

Beyond the Form 990 governance question, some states impose their own legal requirement for a whistleblower policy as part of nonprofit corporation law, generally for larger organizations above a revenue threshold. New York's Nonprofit Revitalization Act, for example, requires certain nonprofits to adopt a whistleblower policy as a matter of state law, not just IRS preference. New York's specific threshold, for example, applies to a not-for-profit corporation or charitable trust with 20 or more employees and annual revenue over $1,000,000 in the prior fiscal year, per the New York Attorney General's Charities Bureau. Check your own state's nonprofit corporation statute or charities bureau guidance to see if a written policy is a state-law requirement for an organization your size, separate from the federal governance question.

A Policy Is Only as Good as the Follow-Through

Adopting a well-written policy that the board then ignores when an actual report comes in undermines the protection it promises and can expose the organization to real legal and reputational risk. Pair the written policy with an actual practice of taking reports seriously, investigating them fairly, and following through on the anti-retaliation promise.

Keep Reporting Channels Genuinely Independent of Day-to-Day Management

If the only person designated to receive reports also supervises most of the staff, employees may hesitate to report concerns involving that person or their close colleagues. Building in a board-level alternative contact, separate from operational management, strengthens the credibility of the channel.

Coordinate With Your Conflict-of-Interest and Document Retention Policies

A whistleblower policy works alongside, not instead of, your organization's conflict-of-interest policy and document retention policy, since a whistleblower report often concerns exactly the kind of conflict or financial irregularity those other policies are meant to catch. Review all three together rather than drafting them in isolation.

Retaliation Claims Can Arise Under Laws Beyond Your Own Policy

Separate from the Form 990 governance question, an employee who reports suspected fraud involving federal funds, for example, may have independent legal protections against retaliation under other federal or state law, regardless of what your internal policy says. Your policy should be consistent with, not a substitute for, those external protections.

Not Legal Advice

Whether your state legally requires a whistleblower policy, and how to word one that holds up if a report and retaliation dispute ever actually occurs, are questions a nonprofit attorney can help answer. Have counsel review your policy, especially if your organization is above the size threshold some states use to make this a legal requirement rather than a best practice.