The Foundation of Corporate Governance and Compliance
Governed by the Companies Act, 2013, and SEBI regulations.
Disclosures, CSR, and financial reporting are legally required.
Public sector undertakings follow additional governance norms.
Ensures ethical conduct, stakeholder protection, and compliance.
.jpg)
Governance Framework
Empowering Organizations With Clarity, Integrity, and Oversight
Understanding Governance Frameworks
A whistleblower framework is the system of policies, channels, and processes through which an organisation receives, protects, investigates, and resolves reports of misconduct. In India, it is legally mandated. SEBI's Listing Obligations and Disclosure Requirements Regulations, 2015 — specifically Regulation 22(2) — require all listed companies to establish a comprehensive vigil mechanism and whistleblower policy that protects individuals who raise concerns from any form of victimisation. The Companies Act, 2013 reinforces this under Section 177, extending the requirement to financial institutions and companies with significant public borrowings.
But having a policy document is not the same as having a framework that works. Deloitte's 2024 survey recorded a 75% increase in annual whistleblower complaints in India — while the 2024 Global Integrity Report found that 52% of employees still lack confidence that their concern will actually be resolved. The policy exists. The trust does not. A functional whistleblower framework closes that gap through five non-negotiable elements: genuine anonymity, independent intake, structured investigation, protection from retaliation, and audit-ready case documentation.
Governance oversight of the whistleblower framework does not sit with HR or a single compliance officer — the Companies Act, 2013 places it with the Audit Committee, or with a nominated director where an Audit Committee is not statutorily required. Rule 7 of the Companies (Meetings of Board and its Powers) Rules, 2014 sets out exactly what that oversight has to include: periodic review of how the mechanism is functioning, direct access for the Audit Committee chairperson in exceptional cases, safeguards against victimisation of anyone who uses it, and a check against misuse through action against directors or employees who repeatedly file frivolous complaints. Boards that treat this as a standing agenda item — rather than an annual formality — tend to catch gaps in the mechanism long before an auditor or regulator does.
Governance obligations extend beyond the mechanism itself into how it is disclosed. Section 177(10)'s proviso requires companies to publish details of the vigil mechanism on their website, where one exists, and in the Board's report — a requirement that is easy to satisfy on paper and surprisingly easy to get wrong in practice, since the disclosure has to reflect how the mechanism actually operates, not a generic template. The same governance discipline that produces a credible whistleblower framework tends to show up elsewhere in a company's compliance posture: CSR reporting, related-party transaction disclosures, and financial statement integrity all depend on the same underlying culture of people being willing to flag problems before they become material. Public sector undertakings face an additional layer of governance norms from the Department of Public Enterprises on top of the Companies Act and SEBI requirements, which makes an adaptable, well-documented framework even more important for that segment.
Genuine anonymity means the reporter's identity is technically separated from their submission — not just promised in a policy. Independent intake means the reporting channel is managed by a third party, not the same HR or legal team the reporter may be reporting about. Structured investigation means every complaint follows a documented triage and review process, not an informal discussion. Protection from retaliation must be enforceable, not just stated. And audit-ready documentation means every case is logged with an outcome that satisfies CARO 2020 disclosure requirements and can be presented to the Audit Committee and statutory auditor on demand.
EthicalView delivers all five. Our whistleblower framework service provides the confidential reporting infrastructure, independent case management, and complete compliance documentation that Indian organisations need to meet SEBI and Companies Act obligations — and, more importantly, to build the culture of trust that makes employees actually use the system. Because a whistleblower framework that employees don't trust is not a framework. It's a liability.
Because a whistleblower framework's real test is whether people use it, governance teams increasingly track a small set of operating metrics alongside the compliance checklist: how many reports are filed per year relative to headcount, how long cases take to close, what share of reports come through anonymous channels versus named ones, and what the outcome distribution looks like across substantiated, unsubstantiated, and still-open cases. A framework that receives zero reports year after year is not necessarily a sign of a clean organisation — more often, it is a sign that employees do not believe reporting will change anything. Tracking these metrics and reporting them to the Audit Committee turns the whistleblower framework from a static policy into a governance control that can actually be improved over time.
EthicalView's governance framework service is built around exactly this discipline — independent case intake, documented investigation workflows, and Board-ready reporting that gives Audit Committees the operating visibility Rule 7 and Regulation 22 expect, without requiring companies to build and staff that infrastructure themselves.