Risk & Governance
Whistleblower and Vigil Mechanism for Group Companies
By ATTPL HOLDCO / ATTPL GROUP Editorial Team · · 3 min read
How business groups can set up an effective vigil mechanism: legal requirements, channels, investigation, anti-retaliation and reporting.
What the law requires
Most serious problems inside companies — fraud, harassment, safety shortcuts, bribery — are known to someone long before they become public. Whether that person speaks up depends on whether they trust the system. A vigil mechanism, or whistleblower policy, gives employees and partners a safe way to raise concerns, and gives leadership a chance to act early.
Under the Companies Act, 2013, listed companies and certain other classes of companies must establish a vigil mechanism for directors and employees to report genuine concerns, with safeguards against victimisation and direct access to the audit committee chair in appropriate cases. Listed companies also have obligations under SEBI listing regulations. Even where not mandatory, a vigil mechanism is good practice for any business group.
Designing reporting channels
- A dedicated email address and phone line managed independently.
- An option to report anonymously where practical.
- Escalation to the audit committee or a designated senior official.
- Access for employees, contractors and, where suitable, vendors.
- Clear guidance in local languages.
Investigation process
Each report should be logged, acknowledged and assessed. Credible concerns need a fair, documented investigation by someone independent of the matter. Findings and actions should be recorded, and the reporter informed of the outcome where appropriate. Our internal audit guide explains how audit teams can support investigations.
Protecting whistleblowers
Retaliation — transfers, demotions, harassment — destroys trust in the system. The policy should prohibit it clearly and leadership should act on any case. Confidentiality of identity must be protected. At the same time, the policy should discourage knowingly false complaints, without deterring good-faith reports.
Group-wide consistency
In a group, a common policy and central case log prevent issues from being buried at subsidiary level. Patterns across companies — repeated vendor complaints, say — become visible only centrally. Link the vigil mechanism to the group risk management framework and to related party transaction oversight.
Handling different types of concerns
Not every report is a whistleblower matter. Personal grievances about pay or promotion are usually better handled through HR processes, while complaints of sexual harassment must follow the separate procedure under the POSH law through the Internal Committee. Allegations of fraud, bribery, data misuse, safety violations or serious policy breaches belong in the vigil mechanism. The policy should explain these differences clearly and route each concern to the right process, so that nothing falls between the cracks.
Measuring effectiveness
- Number of reports received, by type and company.
- Time taken to acknowledge, investigate and close cases.
- Share of reports found to have substance.
- Any reported retaliation and how it was handled.
- Employee awareness from periodic surveys.
Very few reports in a large group may indicate low trust rather than an absence of problems.
Getting started in a mid-sized group
- Approve a short, clear policy at board level.
- Set up an independent email and phone channel.
- Nominate a senior, trusted person to receive reports.
- Train managers on how to respond to concerns.
- Report a summary to the audit committee every quarter.
A simple mechanism that people trust is better than a complex one that nobody uses.
Reporting and culture
- Report numbers, themes and outcomes to the audit committee regularly.
- Train managers to respond well when someone raises a concern.
- Communicate the policy at induction and periodically.
- Review the mechanism's effectiveness every year.
Policy drafting support is available from ATTPL Legal, and HR case records can be kept securely in ATTPL WorkforceOS. To discuss governance frameworks, contact ATTPL HOLDCO.
Frequently asked questions
Is a vigil mechanism mandatory?
It is mandatory for listed companies and certain other classes of companies under the Companies Act; it is good practice for all.
Can complaints be anonymous?
Many policies allow anonymous reports, though following up can be harder. Confidentiality of identity should always be protected.
Who oversees the vigil mechanism?
Typically the audit committee, or a director nominated by the board where there is no audit committee.
Should vendors be allowed to use the vigil mechanism?
Many groups extend reporting channels to vendors and partners, since they often see procurement-related misconduct first.
Sources and further reading
General information only. Legal requirements depend on company type and listing status; consult company secretarial and legal advisers.
