Procedure
Whistleblower and Incident Reporting Procedure
This procedure defines the channels, protections, investigation processes, and reporting obligations for whistleblower disclosures and internal incident reporting. It ensures that concerns about misconduct, legal violations, ethical breaches, security incidents, or regulatory non-compliance are reported safely, investigated thoroughly, and resolved appropriately.
- Type
- Procedure
- Version
- 1.0.22
- Date
- 2026-11-01
- Owner
- Chief Compliance Officer
- Approving authority
- Chief Information Officer
- Classification
- Public
- Confidentiality
- Public
- Category
- Governance
- Review frequency
- Annual and upon material legal or regulatory change
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- Purpose
- Scope
- Roles and responsibilities
- 1. Reporting channels
- 2. Whistleblower protections
- 3. Incident reporting
- 4. Investigation process
- 5. Regulatory notification obligations
- 6. Programme effectiveness review
- Framework alignment
Frameworks it maps to
- ISO 37001:2025
- ISO 37301:2021
- EU Whistleblowing Directive (2019/1937)
- GDPR (2018)
- ISO/IEC 27001:2022
- ISO/IEC 27002:2022
- ISO/IEC 27035-1:2023
- ISO/IEC 42001:2023
- ISO/IEC 27701:2025
- Council of Europe Recommendation CM/Rec(2015)5 (adopted 1 April 2015)
- UK GDPR (consolidated text retrieved 29 September 2026)
- Data (Use and Access) Act 2025 (as enacted)
- S.I. 2026/1015 (made 10 September 2026)
- Quebec CQLR c. P-39.1, as amended by Law 25 (consolidated text updated to 1 April 2026)
- Regulation (EU) 2026/1744 (8 July 2026)
- DORA (Regulation (EU) 2022/2554, 14 December 2022)
- Commission Delegated Regulation (EU) 2025/301 (23 October 2024)
Related documents
- Human Capital and Ethical Conduct Frameworkgovernance
- Enterprise Governance and Risk Management Policyrisk
- Legal and Regulatory Compliance Policycompliance
- Security Disciplinary Process Proceduresecurity
Next
All Documents