Code of Conduct and Whistleblower Program Design

Unused hotlines signal silence, not safety

A hotline that receives no reports is rarely a sign that nothing is wrong. More often, employees do not know it exists, do not trust what happens after they call, or watched a colleague who raised a concern get sidelined. ACFE's Occupational Fraud 2026 report finds that tips detect the largest share of frauds, so a channel nobody uses shuts off the most common way fraud comes to light.

The timing has also tightened. Under the DOJ's Corporate Whistleblower Awards Pilot, an employee who reports internally can also take the information to the Department. A company that receives an internal report must self-disclose as soon as reasonably practicable, and within 120 days at most, to stay eligible for the benefits of voluntary self-disclosure. That clock rewards a channel that routes serious reports to the right people within days, not at the next quarterly committee meeting.

Engraving of a lighthouse built from filing drawers, its magenta lamp casting a ruled beam over dark water. — A light people can find in the dark.

Code and channel built as one

Code of conduct redesign
A shorter code organized around real decisions employees face, written in plain language, with examples from your business and a clear route to ask or report.
Reporting channel design
Choice of channels (web, phone and named contacts), anonymity options, language coverage, and access for contractors and suppliers.
Triage rules
Who receives each type of report, severity levels, escalation to the audit committee or board chair, and response times.
Investigation protocol
Who investigates what, independence from the people involved, evidence handling, interviews, documentation and closing reports.
Anti-retaliation process
Commitments, follow-up on reporters' employment outcomes after a report, and consequences for anyone who retaliates.
Reporting to the board
Quarterly figures on volume, type, time to close and outcomes, grouped so that no reporter can be identified.

Documents, channel settings and trained triage

Deliverable	What it is	When
Triage and escalation matrix	Table of report types, severity, recipient, escalation route and response time	Week 4
Speak-up policy	Channels, anonymity, confidentiality, non-retaliation and what a reporter can expect at each stage	Week 5
Code of conduct	Plain-language code built around decision examples, ready for board approval and layout	Week 6
Investigation protocol	Step-by-step procedure with templates for intake, interview notes, findings and closure	Week 7
Channel configuration brief	Requirements for your hotline provider or internal system, with a test plan we run before launch	Week 8
Launch and training	Manager briefing, employee communication plan and training for the people who handle reports	Weeks 9 to 12

From current state to live channel

Weeks 1 to 2
Review
We review your current code, hotline data, past cases and policies, and interview HR, legal, finance and a sample of managers.
Weeks 3 to 6
Design
We draft the triage matrix, speak-up policy and code, and agree escalation routes with the board or audit committee chair.
Weeks 6 to 8
Build
We write the investigation protocol, specify or configure the channel with your provider, then test it end to end.
Weeks 9 to 12
Launch
We train report handlers and managers, support the launch communication and review the first weeks of reports with you.

History and people the design needs

Your current code, speak-up or whistleblower policy, and any hotline contract
Anonymized summaries of past reports and how each was resolved
Time with HR, legal counsel, the CFO and the audit committee or board chair
A sample of managers and employees for short interviews or a brief survey
Counsel's review of anti-retaliation and employment language before adoption

Is this the right fit?

A good fit

Companies whose hotline has received few or no reports
Organizations that handle concerns informally through HR or the CEO
Nonprofits answering the Form 990 question on a written whistleblower policy
Groups with EU entities of 50 or more workers, which must offer internal reporting channels
Companies preparing for investors, a listing or DOJ-style compliance questions

Not the right fit

Live investigations of a specific allegation; these need counsel and an investigator engaged through them
Companies that only want a hotline number; a hotline provider alone can supply that

Codes work when built around decisions

The typical code of conduct is organized by topic: gifts, conflicts, data, harassment. Employees do not meet topics. They meet decisions. A supplier offers tickets to a game. A customer asks for an invoice dated last quarter. A manager suggests holding an expense claim until next month. We organize the code around moments like these, each with a short rule, a realistic example and the name of who to ask. The approach is set out in a code of ethics employees actually read.

Triage decides what a report becomes

A report about a missing laptop and a report that the CFO is booking fictitious revenue should not follow the same path. The triage matrix sets severity levels and routes. An illustrative version:

Severity	Example	Goes to	First response
High	Financial reporting fraud, bribery, conduct by an executive	Audit committee chair and counsel	Within two business days
Medium	Expense abuse, undisclosed conflicts, policy breaches with financial impact	Compliance lead or CFO	Within five business days
Low	Workplace concerns without financial impact	HR	Within ten business days

Reports that involve anyone in the triage chain go around that person, never through them. We set your actual levels and response times with the board.

Investigations need a protocol first

Investigations tend to go wrong in a few familiar ways: the investigator reports to the person accused, evidence is collected without a record, or the reporter never hears back. The protocol settles who may investigate which kinds of report, how evidence is preserved, how interviews are recorded and what a closing report contains. For serious matters, counsel should direct the investigation. Each closed case ends with a short record: what was alleged, what was found, what action followed, and whether a control changed as a result. Those records feed the quarterly board report and the next risk assessment.

Retaliation is tracked, not assumed away

A non-retaliation promise needs follow-up. At three, six and twelve months after a report, the protocol checks the reporter's employment outcomes: pay changes, reviews, transfers and departures. A summary goes to the audit committee chair. Once the channel is live, an ethics and culture assessment can test whether employees trust it.

What people ask before hiring us

Do you run the hotline?

No. We design the channel and the process behind it, and help you choose and configure a provider or an internal system. We take no commissions or referral fees from hotline vendors, and we disclose any relationship with a vendor we recommend.

What does the 120-day window mean for us?

Under the DOJ's Corporate Whistleblower Awards Pilot, a company that receives an internal report and self-discloses to the Department within 120 days, and before the Department contacts it, can remain eligible for the benefits of voluntary self-disclosure. Your triage rules need to get a serious report in front of someone who can make that decision with counsel, well inside the window.

Can reports be anonymous?

Yes, and we recommend offering anonymity alongside named options. Anonymous channels work best when they allow two-way follow-up without revealing who the reporter is, so investigators can ask questions.

Is a code of conduct legally required?

Not for most private US companies. Public companies must disclose whether they have adopted a code of ethics for senior financial officers, and stock exchange listing rules require a code for directors, officers and employees. For everyone else, investors and funders ask about it, and DOJ's guidance treats it as part of a well-designed program.

Also in Compliance Documentation

Policies, procedures, codes of conduct and grant documentation written in plain language, matched to your systems, and checked against what the ledger shows.

Financial Policies & Procedures
A six-to-twelve-week project that writes or rewrites your financial policies and procedures around how your systems and people work, checks them against the ledger and gives every document an owner.
Grant & Uniform Guidance Compliance
An eight-to-twelve-week project that writes the policies 2 CFR 200 requires, fixes time-and-effort and subrecipient processes, and runs a mock single audit before the real one.

Tell us what you are seeing

A first conversation is a scoping call: what worries you, what you need to show, and to whom. You leave it with a view on where to start, whether or not you hire us.

Start a conversation

Writehello@financeethics.com

Call(307) 365-5252

Office7124 Commons Dr, Cheyenne, WY 82009

HoursMonday to Friday, 9:00 to 17:00 Mountain Time

Make reporting safe and worth doing

Unused hotlines signal silence, not safety

Code and channel built as one

Code of conduct redesign

Reporting channel design

Triage rules

Investigation protocol

Anti-retaliation process

Reporting to the board

Documents, channel settings and trained triage

From current state to live channel

Review

Design

Build

Launch

History and people the design needs

Is this the right fit?

A good fit

Not the right fit

Codes work when built around decisions

Triage decides what a report becomes

Investigations need a protocol first

Retaliation is tracked, not assumed away

What people ask before hiring us

Also in Compliance Documentation

Financial Policies & Procedures

Grant & Uniform Guidance Compliance

Related work and reading

Services

Articles and scenarios

Sectors

Tell us what you are seeing