Reviewing a whistleblower mechanism as part of an audit means testing whether it actually functions, not just whether the policy document exists. That means confirming complaints are logged completely, each one was genuinely investigated rather than closed on the say of the person it concerned, the outcome was reported to those with oversight, and the whole process protected the complainant from retaliation. A policy with no complaints in three years needs the same scrutiny as one with many — the absence of complaints is not, by itself, evidence of a clean organization.
What the mechanism is supposed to do
A vigil or whistleblower mechanism exists to give employees, directors and sometimes external stakeholders a channel to report suspected fraud or unethical conduct without going through the normal reporting line — because the normal reporting line is often exactly where the problem sits. A review of the mechanism is a review of whether that channel is real: whether someone who used it would actually be heard, protected, and would see something happen as a result, rather than whether a policy document describing the channel exists in the compliance folder.
Checks that go beyond the policy document
| Area | What to actually test | What a document review alone misses |
|---|---|---|
| Channel accessibility | Confirm the reporting channel named in the policy actually works — the email address is monitored, the hotline is live, the portal is reachable — by testing it, not by reading that it exists | A channel listed in the policy that was quietly discontinued, or that routes to an inbox nobody checks |
| Complaint logging | Obtain the full log of complaints received and reconcile it against any independent source — an ombudsperson's own records, the committee minutes, IT logs of the reporting portal | A log maintained by the same function a complaint might be about, with no independent check on its completeness |
| Investigation independence | Confirm who investigated each complaint, and whether that person had any reporting relationship to, or was named in, the complaint itself | A complaint against a department head investigated by that department head's own direct report |
| Investigation substance | Review the actual investigation file — interviews conducted, evidence gathered, a documented conclusion — for a sample of complaints | A complaint marked 'closed — no merit found' with no record of what was actually looked into |
| Timeliness | Compare the date raised to the date closed against any timeline the policy itself commits to | A complaint left open for a year with no activity, which the log alone would not show unless dates are checked |
| Escalation and reporting | Confirm complaints of a certain severity were actually reported to the audit committee or board, not just handled and closed within management | A serious complaint resolved quietly at a level below where the policy requires it to be escalated |
| Anti-retaliation | Check whether any complainant identified in a complaint subsequently faced an adverse HR action, and whether that was reviewed for a retaliation link | No visibility into HR actions at all, which leaves retaliation protection as a promise on paper |
Testing whether complaints were actually investigated and closed
- 01Obtain the complete population of complaints for the periodNot a summary prepared by the function responsible for handling them. Cross-check the population against any secondary source available — an external ombudsperson, IT logs, audit committee minutes referencing specific matters.
- 02Select a sample across severity levels, not only the serious onesA pattern of minor complaints dismissed too quickly is itself informative about how seriously the mechanism is taken, and reviewing only the headline cases misses it.
- 03For each selected complaint, trace the full lifecycleDate received, who it was assigned to, what was done, who was spoken to, what evidence was reviewed, the conclusion reached, and who approved closing it.
- 04Assess whether the conclusion is actually supported by what the file shows was doneA thin investigation file attached to a confident conclusion is a finding in its own right, independent of whether the conclusion happens to be correct.
- 05Check whether closed complaints were reported upward in summary, even where individually resolved at a lower levelAn audit committee needs to see the pattern across complaints, not just the serious individual cases, to assess whether the mechanism as a whole is functioning.
Treat a complete absence of complaints over a long period as something to investigate, not something to accept at face value. It can mean a genuinely clean organization, or it can mean employees have learned, correctly or not, that using the channel achieves nothing or carries risk. Checking employee awareness of the mechanism — whether it was actually communicated, not just published — is a reasonable way to tell the two apart.
The conceptual link to fraud reporting elsewhere in the audit
A statutory auditor separately has reporting obligations when fraud is identified or suspected during an audit, including matters that may need to be reported under provisions dealing with fraud reporting such as those referenced in CARO-related requirements. The whistleblower mechanism review and that fraud-reporting obligation are conceptually connected even though they sit in different parts of the engagement: a complaint logged through the vigil mechanism that was never properly investigated is exactly the kind of matter that, if it points to actual or suspected fraud of the relevant magnitude, may itself need to be factored into the auditor's own reporting consideration, separate from being a governance finding about the mechanism itself.
Regulatory requirement
The specific thresholds, forms and timelines for an auditor's fraud reporting obligations, and the exact requirements governing vigil mechanisms for different classes of company, are set out in company law and related rules that are amended periodically. Confirm the current requirements before relying on a general statement of either in a file.
What the review should leave in the file
- The complaint population obtained, with its source and how completeness was assessed.
- The sample tested, by severity, with the lifecycle testing performed on each.
- An assessment of investigator independence for each sampled complaint.
- Any complaint where the investigation, escalation, or closure fell short of the policy's own commitments, and what was done about it.
- A view on whether the overall pattern suggests the mechanism is genuinely trusted and used, or quietly avoided.
How we think about this
Reconciling a complaint log against secondary sources and checking dates against policy timelines is mechanical cross-checking that should never depend on someone remembering to do it by hand each cycle. The judgement that has to stay with the auditor is reading an actual investigation file and deciding whether what was done was proportionate to what was alleged — that is not something a system can score for you.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Internal audit & IFCFraud risk assessment: building it into the audit planThe fraud triangle applied practically rather than as theory, why management override is a presumed risk on every engagement, and what journal entry testing is actually looking for.
- Internal audit & IFCInternal audit checklist for CA firms taking on the mandateHow to scope a new internal audit mandate: the risk-based plan, coverage across the year rather than one visit, typical areas covered, and the reporting rhythm an audit committee expects.
- Internal audit & IFCInternal audit vs statutory audit: what actually differsWhere internal audit and statutory audit genuinely differ — objective, reporting line, independence, and timing — and where coordinating the two saves real work on both sides.
- CARO & Companies ActCARO whistleblower and fraud reporting clausesThe auditor's reporting responsibility on fraud noticed and whistle-blower complaints received, and how to document the enquiry behind it.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.