Picture a part-time bookkeeper at a twelve-person organization who notices that the executive director’s reimbursements have doubled and the receipts have gotten thinner. There is no HR department. The board meets quarterly and has never met the bookkeeper. The only person the bookkeeper reports to is the executive director. So the bookkeeper says nothing, and leaves eight months later for a job with fewer questions in it. A year after that, Form 990 line 13 asks whether there is a written whistleblower policy. No.
This is the nonprofit whistleblower policy we would want that board to adopt, and most of it is a reporting path: who a report goes to, who it goes to instead when it concerns that person, and what happens in the six steps after. The article covers what Form 990 line 13 asks and the three elements the instructions require, which laws actually protect a nonprofit whistleblower (Sarbanes-Oxley’s civil remedy is not one of them), the statutory checklist New York wrote for organizations that must have a policy, and the federal award rule that makes the policy mandatory reading. The template, a one-page report form, and an intake log are at the end, no email required. A whistleblower policy is not a hotline. It is a promise about what happens to the person who speaks first.
Key Takeaways
Line 13 of Form 990 Part VI reads: “Did the organization have a written whistleblower policy?” It sits in Section B, which the form introduces as requesting “information about policies not required by the Internal Revenue Code,” between the conflict of interest questions on line 12 and the document retention question on line 14. The instructions define the policy in one sentence with three parts: it “encourages staff and volunteers to come forward with credible information on illegal practices or violations of adopted policies of the organization, specifies that the organization will protect the individual from retaliation, and identifies those staff or board members or outside parties to whom such information can be reported.” Encourage, protect, name. A policy that says “we do not tolerate retaliation” and stops there has one element of three.
Element 1 · Encourage
“encourages staff and volunteers to come forward with credible information on illegal practices or violations of adopted policies of the organization”
What to report, and the standard
Illegal conduct, fraud, misuse of assets, and violations of the policies the board has adopted: conflict of interest, retention, financial controls, harassment. The standard is good faith and credible information, not certainty. Volunteers are named, not just staff.
Element 2 · Protect
“specifies that the organization will protect the individual from retaliation”
A stated promise, with consequences
The policy says what retaliation includes, says that whoever retaliates is subject to discipline up to removal, and says that retaliation is itself reportable under the same procedure. The laws in the next section give the promise teeth the policy cannot give on its own.
Element 3 · Name
“identifies those staff or board members or outside parties to whom such information can be reported”
A person, an alternate, and an outside door
A named Compliance Officer, a named alternate for reports about that person or the executive director, and at least one channel that does not run through the office, such as a confidential mailbox the board chair opens.
The same paragraph of the instructions carries the sentence that explains why the question exists: “while the federal Sarbanes-Oxley legislation generally doesn’t pertain to tax-exempt organizations, it does impose criminal liability on tax-exempt as well as other organizations for (1) retaliation against whistleblowers that report federal offenses, and (2) destruction of records with the intent to obstruct a federal investigation. See 18 U.S.C. sections 1513(e) and 1519.” The IRS’s own governance paper, written for the 2008 redesign of the form, says the Service “encourages the board of directors to adopt an effective policy for handling employee complaints and to establish procedures for employees to report in confidence any suspected financial impropriety or misuse of the charity’s resources,” and mentions line 13 in the same sentence as line 5, which on the current form asks whether the organization became aware during the year of a significant diversion of its assets. (The 2008 paper says “material” and places line 5 in Section B; on the form the word is “significant” and the line sits in Section A.)
Three mechanics. The policy has to be adopted by the board, or by a committee the board delegated the authority to, by the end of the tax year, and it is the filing organization’s own policy that counts: a subsidiary answers “Yes” only if its own board adopted the parent’s policy. Form 990-EZ has no governance section, so line 13 never appears on it. And a detail worth knowing before drafting: if the whistleblower policy is written into the bylaws, later changes to it are reportable on Part VI line 4 as a significant change to the organizing documents, while a stand-alone policy changed by board resolution is not. Keep it stand-alone.
Start with the law that gets named and misread. Sarbanes-Oxley’s civil whistleblower remedy, section 806 (18 U.S.C. 1514A), is captioned “Whistleblower Protection for Employees of Publicly Traded Companies” and applies to companies with securities registered under the Exchange Act or required to file reports under it. A community organization with a $900,000 budget is not one. The two Sarbanes-Oxley sections that do reach every organization are the criminal ones the Form 990 instructions cite: 18 U.S.C. 1513(e), which punishes anyone who “knowingly, with the intent to retaliate, takes any action harmful to any person, including interference with the lawful employment or livelihood of any person, for providing to a law enforcement officer any truthful information relating to the commission or possible commission of any Federal offense,” with up to ten years, and 1519 on destroying records, with up to twenty. Below them sits a stack of civil protections that apply to nonprofit employers as employers.
| Law | Who it covers | What it protects, and the numbers |
|---|---|---|
| Sarbanes-Oxley 806, 18 U.S.C. 1514A | Employees of publicly traded companies | Not a typical nonprofit. Useful only as a drafting model for internal reporting channels. |
| 18 U.S.C. 1513(e) criminal | Any person, any organization | Retaliation for giving truthful information about a federal offense to law enforcement. Up to 10 years. |
| 41 U.S.C. 4712 and 2 CFR 200.217 federal award | Employees of federal grantees and subgrantees | Disclosures of gross mismanagement, gross waste, abuse of authority, danger to health or safety, or a violation of law related to the award, made to listed persons including an internal official responsible for investigating misconduct. Complaint to the agency Inspector General within 3 years; reinstatement, back pay, and fees; rights not waivable; written notice to employees required. |
| OSH Act 11(c); FLSA 215(a)(3) | Employees of any employer | Safety complaints, with 30 days to file with the Secretary of Labor; wage and hour complaints and testimony. |
| Title VII; ADA; ADEA | Employers with 15, 15, and 20 or more employees | Opposing discrimination or taking part in a charge, investigation, or proceeding. Bona fide private membership clubs exempt under 501(c) are outside Title VII’s and the ADA’s definition of employer. |
| False Claims Act 3730(h) | Employees, contractors, and agents | Efforts to stop false claims on federal funds. Reinstatement, two times back pay, interest, and fees; 3 years to sue. |
| New York Labor Law 740; N-PCL 715-b | Any employer with one or more employees; the policy mandate at 20 or more employees and over $1 million in revenue | Disclosures of what the employee reasonably believes is illegal or a danger to public health or safety, with a good-faith attempt to notify a supervisor first before going to a public body, except in listed situations; 2 years to sue; civil penalty up to $10,000; posted notice required. |
| California Labor Code 1102.5 and 1102.8 | All employers, no size threshold | Reports to a government or law enforcement agency, to a person with authority over the employee, or to another employee with authority to investigate, discover, or correct the violation; no rule or policy may prevent them. Civil penalty up to $10,000 per employee per violation; once the protected disclosure is shown to be a contributing factor, the employer must prove by clear and convincing evidence that it would have acted the same way (1102.6); posted notice in type larger than 14 point. |
The federal award row is the one to read twice. Under 41 U.S.C. 4712, an employee of a grantee or subgrantee “may not be discharged, demoted, or otherwise discriminated against as a reprisal” for disclosing what the employee reasonably believes is gross mismanagement of the grant, a gross waste of federal funds, an abuse of authority, a substantial and specific danger to public health or safety, or a violation of law related to the grant. The list of people a protected disclosure can go to includes Congress, an Inspector General, the GAO, the agency’s grant official, law enforcement, a court, and, in paragraph (G), “a management official or other employee of the … grantee, subgrantee … who has the responsibility to investigate, discover, or address misconduct.” That last item is the reason the template names a Compliance Officer with that responsibility: a report to a person on that list can qualify as a protected disclosure, depending on what is disclosed and on the reporter’s reasonable belief. The rights “may not be waived by any agreement, policy, form, or condition of employment,” and the 2024 revision of the Uniform Guidance added 2 CFR 200.217, which applies to federal awards issued on or after October 1, 2024 and restates the protection and requires that “the recipient and subrecipient must inform their employees in writing of employee whistleblower rights and protections under 41 U.S.C. 4712.” A federal award turns the policy from good practice into a written-notice obligation.
The third element is the one that fails in practice, and it fails for a structural reason: in a small organization every line of authority runs through the executive director, and the executive director is the person most reports would be about. The fix is not a hotline vendor. It is three names in the policy. A Compliance Officer who is not an employee, usually the Treasurer or another director, receives reports. The Board Chair (or the Audit Committee Chair, where one exists) receives reports about the Compliance Officer, the executive director, or a director. And one channel exists that does not pass through the office at all, such as mail addressed to the Chair at the organization’s mailing address marked confidential, so that a report can be made without anyone on staff seeing it arrive. New York’s Charities Bureau suggests the same division: the Audit Committee Chair for financial matters and the head of HR for personnel matters, and it recommends that the procedures “provide for an anonymous reporting option.”
Volunteer-run, or one to three staff
Report to the Board Chair
Alternate: the Treasurer or Secretary, for a report about the Chair.
Anonymous: mail to the Chair, marked confidential.
Outside: the state attorney general’s charities office; for a federal award, the agency Inspector General.
Four to nineteen staff, an ED and a board
Report to a named Compliance Officer
Who: a director who is not an employee, often the Treasurer, named in the policy by title.
If it concerns the ED or a director: straight to the Board Chair.
Anonymous: an outside intake line, or a confidential mailbox the Chair opens.
Twenty or more staff, an audit committee
A designated administrator, reporting to the committee
Financial matters: the Audit Committee Chair. Personnel matters: the head of HR.
New York: at this size, with over $1 million in revenue, the policy is required and must contain four provisions.
Employee-directors sit out deliberations about the policy.
Confidentiality is promised “to the extent consistent with a thorough investigation and with legal requirements,” which is the honest formulation and the one the template uses; New York’s statute requires “procedures for preserving the confidentiality of reported information.” An investigation may need to reveal enough for the subject to respond; the law may require disclosure; a court may order it. The policy says so, and it says the reporting person’s identity is not disclosed without consent except in those cases. Anonymous reports are accepted and investigated to the extent the details allow; a report with dates, amounts, and names gets acted on whether or not it is signed. Outside service providers are on the list of people who may report, because the bookkeeper in the opening paragraph is one of them, and the policy tells a manager who receives a report to pass it on rather than investigate it alone.
Three governance policies, one questionnaire.
Every full Form 990 we prepare asks lines 12, 13, and 14 in the IRS’s words before the return is drafted. Form 990 preparation from $1,500 per return, with a fixed quote before work begins.
See 990 pricing →Three files. The policy is eleven sections in an editable Word document: purpose, who is covered, what to report, how to report, confidentiality, no retaliation, handling a report, reporting to the board, records, distribution and acknowledgment, and review, with an adoption block and editing notes for Form 990, New York, California, federal awards, and other states and funders that you delete before the vote. The second document is a one-page report form that a reporting person may use or ignore, followed by an intake log for the Compliance Officer. The PDF holds both for the board packet.
Nonprofit whistleblower policy template
No email required
Whistleblower Policy (editable Word)
Eleven sections, bracketed titles for the Compliance Officer and alternate, recusal and confidentiality clauses, board adoption block, editing notes.
Report Form and Intake Log (editable Word)
A one-page optional report form with an anonymous option, and the log the Compliance Officer keeps: date, method, summary, assigned to, acknowledgment, steps, outcome, board report.
Policy, form, and log pack (PDF)
All three in one file for reading, printing, and the board packet. Template only, not legal advice.
Six edits, then the vote. One: the organization’s name and the two titles in section 4, the Compliance Officer and the alternate. Pick people, not roles that do not exist yet. Two: the anonymous channel in section 4: a mailing address the Chair controls, an outside intake service, or both. Three: the acknowledgment window in section 7 (the template says five business days) and who reviews financial versus personnel matters. Four: the board reporting cadence in section 8, and whether reports go to the full board or an audit committee. Five: the distribution method in section 10: handbook, onboarding, website, office posting. Six: delete the editing notes that do not apply, and if the organization has a federal award, keep the bracketed notice in section 2 and give it to every employee in writing at onboarding.
A statutory checklist
New York N-PCL 715-b: four provisions the policy must contain
The statute applies to New York corporations with twenty or more employees and more than $1 million in prior-year revenue, but its list is a concrete statutory statement of what a complete policy contains, and a policy already adopted under another federal, state, or local law that is “substantially consistent” with it is deemed to comply. The template maps to it on the right. Have New York counsel confirm the adopted version.
Reporting procedures, including procedures for preserving confidentiality. Sections 4 and 5.
A designated employee, officer, or director who administers the policy and reports to the board or an authorized committee, with directors who are employees recused from deliberations about its administration. Sections 7 and 8.
The person who is the subject of a complaint does not take part in board or committee deliberations or the vote, though the board may ask them to present information or answer questions first. Section 7.
A copy distributed to all directors, officers, key persons, employees, and volunteers who provide substantial services, which posting on the website or at the office can satisfy. Section 10.
Then adopt it by motion, in the minutes, before the end of the tax year you want to answer “Yes” for, and distribute it the way New York’s Charities Bureau describes as best practice: to each person at orientation, with a signed acknowledgment, and posted where everyone can find it. The acknowledgments go in the governance file next to the conflict of interest disclosure statements. If the board adopts all three policies in this series at one meeting, the whistleblower policy is the one to read aloud, because its promise is made to the people in the room and to the ones who are not.
A policy that names a person and then leaves that person to improvise has not solved the problem, it has moved it. Section 7 of the template is a procedure the Compliance Officer can follow without training, and it is deliberately short.
Step 1
Acknowledge
Within five business days, where the reporting person is known. Silence after a report is easily read as retaliation.
Step 2
Log it
Date, method, summary, category, assigned to. The intake log is a restricted file, and it is what the annual board report is written from.
Step 3
Assess and investigate
Does it describe conduct in section 3? Who should look: the Compliance Officer, the Treasurer for financial matters, counsel, the accountant, or an outside investigator.
Step 4
Recuse the subject
The person the report is about may answer questions before deliberations begin, then leaves the deliberation and the vote. Employee-directors sit out decisions about administering the policy.
Step 5
Decide and correct
Findings and corrective action documented. The reporting person, if known, is told the matter is closed and, where appropriate, the outcome. Outside reports to agencies, funders, or insurers decided with counsel.
Step 6
Report to the board
At least annually on the general type and resolution of reports, without names. Immediately to the Chair for anything involving the ED, a director, or a possible diversion of assets.
Two of those steps come straight from New York’s statute and belong in every policy regardless of state. The recusal in step 4 is 715-b(b)(3): the subject of a complaint may be asked “to present information as background or answer questions at a committee or board meeting prior to the commencement of deliberations or voting,” and then is not present for the rest. The employee-director rule is in (b)(2). Both exist for the same reason the conflict of interest policy sends the interested director out of the room: the decision has to be made by people with nothing at stake in it. The records rule in section 9 points to the document retention policy: investigation files are kept seven years after closure in restricted files and never destroyed while a related matter is pending, which is where 18 U.S.C. 1519 comes back in.
New YorkThe policy is required by statute above a size threshold
Under N-PCL 715-b, “the board of every corporation that has twenty or more employees and in the prior fiscal year had annual revenue in excess of one million dollars shall adopt, and oversee the implementation of, and compliance with, a whistleblower policy to protect from retaliation persons who report suspected improper conduct.” The protected persons are directors, officers, key persons, employees, and volunteers who report in good faith conduct “that is illegal, fraudulent or in violation of any adopted policy of the corporation.” The four required provisions are in the checklist above. The section came in with the Nonprofit Revitalization Act of 2013, was amended in 2016 (effective May 27, 2017, per the Attorney General’s guidance) to add the board-oversight duty, the recusal of the complaint’s subject, and the employee-director rule, and again in 2019 to add key persons. The Charities Bureau’s 2015 guidance predates the last two amendments but still holds on the practical points: smaller nonprofits “should consider adopting such policies,” the procedures “should provide for an anonymous reporting option,” and distribution can be satisfied by posting on the website.
Separately, Labor Law 740 protects any employee of any employer with one or more employees who discloses, to a supervisor or a public body, an activity the employee “reasonably believes is in violation of law, rule or regulation” or a danger to public health or safety, generally after a good-faith attempt to notify a supervisor, with exceptions for imminent danger, likely destruction of evidence, harm to a minor, physical harm, or a supervisor who already knows and will not act. A civil action must be brought within two years; relief can include a civil penalty of up to $10,000; and “every employer shall inform employees of their protections, rights and obligations under this section, by posting a notice thereof.”
CaliforniaNo policy mandate, strong protection, a posting duty
No California statute requires a nonprofit to adopt a whistleblower policy; the Nonprofit Integrity Act’s governance mandate (Government Code 12586(e)) requires an audit and an audit committee at $2 million in revenue and says nothing about one. What California regulates is the retaliation. Labor Code 1102.5 forbids any employer, with no size threshold, from adopting “any rule, regulation, or policy preventing an employee from disclosing information to a government or law enforcement agency, to a person with authority over the employee, or to another employee who has authority to investigate, discover, or correct the violation or noncompliance,” and forbids retaliation for such disclosures or for the employer’s belief that the employee may make one, “regardless of whether disclosing the information is part of the employee’s job duties.” The penalty is up to $10,000 per employee per violation; under 1102.6, once the employee shows by a preponderance of the evidence that the protected disclosure was a contributing factor, the employer must prove by clear and convincing evidence that it would have acted the same way anyway; and the Attorney General runs a hotline under 1102.7 that holds the caller’s identity in confidence during the initial review of the call. Labor Code 1102.8 requires every employer to display, in lettering larger than 14-point type, a list of employees’ whistleblower rights including that hotline number. The Attorney General’s Guide for Charities lists whistleblower protection among the personnel policies a charity should have and says the organization “should encourage and protect those who come forward with evidence of wrongdoing.”
Federal awardsA written notice, and a policy that cannot waive anything
If the organization is a recipient or subrecipient of a federal grant, 2 CFR 200.217 applies by its own terms to both, and the terms of the award flow down to subawards. Inform every employee in writing of the rights under 41 U.S.C. 4712, name the internal official responsible for investigating misconduct so that a report to that person is on the statute’s list of protected recipients, and do not include any language purporting to limit those rights; the statute says they “may not be waived by any agreement, policy, form, or condition of employment.” A complaint under 4712 goes to the agency’s Inspector General within three years of the reprisal, and the remedies include reinstatement with back pay and the complainant’s costs and fees.
Every full Form 990 we prepare starts with a questionnaire, and the governance section asks line 13 in the IRS’s words, right after the conflict of interest questions and right before document retention. The answer has to be true as of the end of the tax year, so a policy adopted in April for a December year is a “No” on that return and a “Yes” on the next, and the late adoption can be described on Schedule O. The same questionnaire asks the Section A line 5 question about a significant diversion of assets, and a board that has a working reporting path is the board that can answer it from a log rather than from memory.
An outside bookkeeper sees the transactions, and the template’s section 4 tells anyone in that position where a report goes. For organizations whose books we keep, the monthly close and the one-page board report are the routine version of the same idea: the numbers reach the board every month through a door that does not run through one person’s desk. Form 990 preparation is priced per return, from $1,500 for the full form and from $500 for a 990-EZ, and bookkeeping starts at $300 a month, with a fixed quote before work begins; the pricing page shows the rest. The rest of the governance file is covered in its own guides: internal controls for the signals a report usually describes, the treasurer’s role in receiving them, audit requirements for the auditor’s own fraud questions, and grant-ready accounting for the federal award side.
Lines 12, 13, and 14, answered from a file.
Our Form 990 preparation asks the three governance questions before the return is drafted, and our bookkeeping puts the numbers in front of the board every month.
Common questions from boards adopting a nonprofit whistleblower policy for the first time.
Not by federal tax law; Form 990 Part VI line 13 asks about a policy the Code does not require. New York requires one for corporations with twenty or more employees and more than $1 million in prior-year revenue, under N-PCL 715-b. California does not require a policy, but Labor Code 1102.5 protects reporting employees at every employer and 1102.8 requires a posted notice. Federal anti-retaliation laws apply to nonprofit employers whether or not a policy exists, and a federal award adds a written-notice duty under 2 CFR 200.217.
Only two provisions do, and both are criminal. Section 1107 (18 U.S.C. 1513(e)) makes it a crime, punishable by up to ten years, to retaliate against a person for giving truthful information about a federal offense to law enforcement, and section 802 (18 U.S.C. 1519) punishes destroying records to obstruct a federal matter with up to twenty years. The civil whistleblower remedy in section 806 (18 U.S.C. 1514A) is limited to publicly traded companies and their subsidiaries and does not reach a typical nonprofit.
Yes. No law prohibits it, New York’s statute requires procedures for preserving the confidentiality of reported information, and New York’s Charities Bureau recommends that the procedures provide an anonymous reporting option. The template accepts anonymous reports through a channel the board chair controls, such as a confidential mailbox or an outside intake line, and investigates them to the extent the details allow. A report with dates, amounts, and names is acted on whether or not it is signed.
A director who is not an employee, usually the Treasurer, named in the policy as the Compliance Officer, with the Board Chair as the alternate for any report about the Compliance Officer, the executive director, or a director. Add one channel that does not pass through the office, such as mail to the Chair marked confidential. Outside the organization, the state attorney general’s charities office takes complaints about charities, and for a federal award the agency’s Inspector General takes reprisal complaints under 41 U.S.C. 4712.
Three things. Employees of a grantee or subgrantee are protected by 41 U.S.C. 4712 for disclosures of gross mismanagement, waste, abuse, danger, or violations related to the award, and those rights cannot be waived by any policy or form. Under 2 CFR 200.217, which applies to federal awards issued on or after October 1, 2024, the organization must inform its employees of those rights in writing. And naming an internal official with responsibility to investigate misconduct, as the template does, puts that person on the statute’s list of recipients, so an internal report can qualify as a protected disclosure.
GivingArc provides bookkeeping, Form 990 preparation, and nonprofit-specialized accounting for small and mid-size 501(c)(3) organizations across the US. The policy, report form, and intake log above are templates and are not legal advice; anti-retaliation laws vary by state and by employer size, and a policy cannot expand or limit the rights those laws give. Have counsel in your state review them before adoption. Sources checked September 2026. Reviewed by Min Kim, CPA.
