The report that went to the subject
A warehouse supervisor at a 180-person distributor notices that one manager keeps splitting purchase orders into amounts just under $5,000, all to the same new supplier. The code of conduct says concerns go to an ethics email address. She writes a careful email on a Sunday night. The address forwards to the CFO. The manager reports to the CFO, and the new supplier was the CFO's idea.
Nothing dramatic happens. The CFO replies that he will look into it. The supervisor hears nothing more, and the next time she sees a problem she keeps it to herself. The example is illustrative, and the design flaw is easy to recognize: a single inbox, owned by one executive, with no record that a report was ever received.
A speak-up channel for a company without a compliance department does not need to be expensive. It needs four properties: reports reach someone independent of the people they name, they are acknowledged and triaged within days, they leave a record, and reporting never costs the reporter anything.
What the channel must do
The DOJ's Evaluation of Corporate Compliance Programs, updated in September 2024, is the clearest list of what a reporting mechanism is expected to do. It asks whether the company has an anonymous reporting mechanism "and, if not, why not", how the channel is publicized, whether employees know about it and feel comfortable using it, and whether the company periodically tests it, for example by tracking a report from start to finish. It also asks whether investigations are properly scoped, independent and documented, and whether the company applies timing metrics to its response.
Two other facts shape the design. The ACFE's 2026 Report to the Nations lists web-based reporting (46%), email (34%) and phone (23%) as the most common ways fraud tips were reported, so a web form deserves priority. And if you plan to list on a US exchange, Section 10A(m)(4) of the Securities Exchange Act, added by the Sarbanes-Oxley Act, requires the audit committee to establish procedures for complaints about accounting, internal accounting controls or auditing matters, and for the confidential, anonymous submission of employee concerns. Building to that standard now avoids a rebuild later.
Do it yourself or use a vendor
Both can work. The choice turns on anonymity, independence and the records you can produce later.
| Factor | Do it yourself | Vendor-hosted channel |
|---|---|---|
| Anonymous follow-up | Hard. An anonymous form cannot ask the reporter a question later unless you build a case code system. | Typically built in: the reporter gets a case number and checks back for questions. |
| Intake hours | Business hours, unless you staff a phone line. | Web and phone intake around the clock, often in several languages. |
| Independence | Depends entirely on routing. Easy to get wrong with one inbox. | Routing rules set at the vendor, so reports about executives can bypass them. |
| Records | Spreadsheet or ticketing system. Needs access controls and a log of changes. | Case management with an audit trail. |
| Cost | Staff time and existing tools. | A recurring fee to the vendor. |
| Setup | Days, if routing is decided first. | Typically a few weeks, including contract and configuration. |
A hybrid also works: a vendor handles intake and anonymity, while triage and investigation stay with a small internal group and outside counsel when needed. Whichever you choose, the routing and triage rules below are yours to write.
Route around the people it names
Routing decides whether the channel is independent of the people it might name. Write the rules down before launch:
- Every report goes to at least two people, for example the general counsel or HR lead and the audit committee chair. No single person can close or delete a case.
- Reports naming the CEO, CFO or a recipient go only to the audit committee or board chair, who decides who handles them.
- A conflict check comes first. Whoever triages a report confirms they are not named in it and do not manage anyone who is.
- Board-level visibility. The board or audit committee sees a log of all reports at each meeting, in summary form, including those closed.
Triage within two business days
Set a triage standard and measure against it. A workable one has four categories:
- Urgent. Ongoing financial loss, risk to safety, or evidence being destroyed. Act the same day.
- Potential violation of law or financial misconduct. Bribery, fraud, falsified records, sanctions, customs or procurement issues. Escalate to counsel within two business days and consider the 120-day window below.
- Policy and workplace concerns. Harassment, conflicts, expense abuse. Assign an investigator who is independent of the area.
- Questions. Answer them, and track the topics; they show where the code is unclear.
For each case, record the date received, the date acknowledged, the category, who was assigned, the scope of the investigation, the outcome and the date closed. That record is what lets you answer the DOJ's question about timing metrics.
Retaliation undoes everything
The ECCP asks whether the company has an anti-retaliation policy, whether it trains employees on both internal anti-retaliation policies and external whistleblower protections, and whether employees who reported internally are treated differently from others involved in misconduct who did not.
The DOJ pilot guidance adds two points. Retaliation reported to DOJ will be considered when it assesses whether a company cooperated or obstructed. And if a company impedes someone from communicating directly with DOJ, including by enforcing or threatening to enforce a confidentiality agreement, DOJ may weigh that against the company's cooperation credit and compliance program. Review your employment, separation and consulting agreements with counsel so that their confidentiality clauses do not appear to bar reports to the government.
The 120-day window
The DOJ Corporate Whistleblower Awards Pilot has been in effect since 1 August 2024 as a three-year program. As of November 2026, its guidance was last revised on 30 July 2026, and it covers eight subject areas, including foreign and domestic corruption, fraud against the United States, health care fraud, trade, tariff and customs fraud, and sanctions. DOJ's August 2026 fact sheet reports over 1,800 tips since launch.
Two 120-day rules matter to a company. An employee who reports internally first can still qualify for an award if they also report to DOJ within 120 days of the internal report. And a company that receives an internal whistleblower report and self-discloses to the Criminal Division within 120 days, before DOJ contacts it, remains eligible for the voluntary self-disclosure program even if the whistleblower has already gone to DOJ. Our article on DOJ's 2026 Corporate Enforcement Policy covers what self-disclosure can earn.
In practice, the clock starts when your channel receives the report, not when someone gets around to reading it. Whether to self-disclose is a legal decision for counsel and the board; this article is not legal advice. The channel's job is to make sure that decision is made in time.
Setup checklist
- Write a one-page speak-up policy: what to report, how, the promise of no retaliation, and what happens next.
- Choose intake: web form at minimum, plus phone if many employees lack regular computer access.
- Decide on anonymity and how you will ask anonymous reporters follow-up questions.
- Write routing rules, including the bypass for reports about executives and recipients.
- Name two primary recipients and a board-level backstop.
- Set triage categories and response times, and a log with the fields above.
- Add a step to triage: does this report fall in a DOJ pilot area, and has counsel been told? Record the date received as day one of 120.
- Agree in advance which outside counsel or investigator you would call.
- Review confidentiality clauses in employment, separation and consulting agreements.
- Publish the channel in the code, on the intranet, in onboarding and on posters at non-desk sites.
- Train managers on how to receive a report and what retaliation looks like.
- Test the channel twice a year by sending a test report and tracking it to closure.
- Report summary statistics to the board at each meeting.
Where to start
Send a test report through your current channel this week and see where it lands, how long acknowledgment takes and who could have deleted it. That one test usually shows the routing fix needed first. Then make the channel easy to find from the code itself, as described in a code of ethics employees actually read. To design the code, channel, triage and investigation protocol together, see Code of Conduct & Speak-Up Programs.