A nonprofit may have a whistleblower policy in its employee handbook and still make it nearly impossible for someone to report a serious concern.
Employees may be instructed to report misconduct to the same manager involved in the complaint. Volunteers may not know whether the policy applies to them. Board members may receive vague summaries without enough information to provide oversight. People who raise concerns may be isolated, criticized or quietly removed from important work.
The organization technically has a policy, but it does not have a dependable reporting system.
Build More Than One Reporting Path
A credible process should explain who may report, what kinds of concerns belong in the process and where reports can be submitted.
It should address concerns involving:
- Financial misconduct
- Misuse of charitable assets
- Conflicts of interest
- Grant or contract violations
- Safety problems
- Harassment or discrimination
- Retaliation
- Falsified records
- Violations of organizational policy
- Conduct involving senior leadership or board members
The IRS instructions for Form 990 describe a whistleblower policy as one that encourages staff and volunteers to provide credible information about illegal practices or policy violations, protects reporters from retaliation and identifies the people or outside parties who can receive reports. The form also asks filing organizations whether they maintain such a policy. (IRS)
Reporting options might include a supervisor, HR representative, executive director, board officer or independent outside service. There must be an alternative when the normal recipient is involved in the allegation.
Explain What Happens After a Report
People are less likely to raise concerns when the process disappears behind closed doors.
The organization should document:
- Who acknowledges the report
- Who determines the appropriate reviewer
- How conflicts of interest are handled
- How evidence is preserved
- What confidentiality can and cannot be promised
- When legal or professional help is required
- How findings are communicated
- Who approves corrective action
- How retaliation concerns are reported
- Where the final record is retained
The National Council of Nonprofits recommends whistleblower protections that allow employees, board members and others to raise concerns internally without fear of retaliation. It also notes that many nonprofits now apply these policies beyond financial matters to broader operational and ethical concerns. (National Council of Nonprofits)
A reporting process should be fair to both the person raising the concern and anyone accused of wrongdoing. An allegation is not automatically a proven fact.
Separate General Guidance From Case Records
SharePoint should serve as the organized knowledge source for the approved whistleblower policy, reporting instructions, role assignments, blank forms and investigation procedures.
Copilot Studio provides the conversational layer. Through Maisy, an authorized employee could ask:
- Where can I report a concern?
- What should I do when my supervisor is involved?
- Does the policy cover volunteers?
- Who reviews allegations involving the executive director?
- How do I report possible retaliation?
- What information should I preserve?
This helps the nonprofit retain institutional knowledge about the reporting process without exposing confidential allegations.
Completed complaints, witness statements, legal advice, investigation notes and disciplinary records should remain in restricted systems or tightly controlled SharePoint locations. Maisy should not identify whistleblowers, summarize active allegations for general users or decide whether misconduct occurred.
Protect People From Retaliation
Retaliation may include termination, demotion, reduced hours, exclusion, intimidation or other adverse treatment. Different federal and state protections apply depending on what was reported, so legal review may be necessary.
OSHA administers multiple federal whistleblower statutes, including protections related to workplace safety and other regulated activities. Its complaint guidance makes clear that protected reporting and retaliation questions depend on the applicable law and circumstances. (OSHA)
A nonprofit should train managers not to punish, isolate or pressure someone merely because that person used an approved reporting channel.
How Maisy Helps
Pixeldust begins by identifying reporting paths, repeated questions, conflicts in existing policies, board responsibilities, permission requirements and areas where the process depends on one person.
Pixeldust then organizes approved guidance in SharePoint, assigns content owners and configures Maisy through Copilot Studio. Testing uses realistic questions involving anonymous reports, conflicts of interest, senior leadership and retaliation.
This helps the nonprofit retain institutional knowledge about complaint handling while keeping investigations, credibility decisions, disciplinary action and legal interpretation with qualified human authorities.
