Essential Aspects of Vigilance Mechanism
Early detection and prevention of misconduct
Promotion of ethical conduct and compliance
Holding individuals accountable impartially
Strengthening risk management and controls
Role of Vigil Mechanism
Safeguarding Integrity Through Transparency, Accountability, and Ethical Oversight
Role of Vigilance Mechanism in Strengthening Corporate Governance
India's Companies Act, 2013 mandates a vigil mechanism under Section 177(9) for every listed company, financial institution, and organisation that has borrowed more than ₹50 crore from banks or public financial institutions. This is not a voluntary governance exercise — it is a legal requirement. The mechanism provides a structured, confidential channel through which directors, employees, vendors, and other stakeholders can report genuine concerns about fraud, unethical behaviour, or violations of the organisation's code of conduct — without fear of victimisation.
The role of the vigil mechanism goes beyond receiving complaints. It acts as an early warning system for the organisation. When functioning correctly, it surfaces misconduct before it escalates into regulatory action, financial loss, or reputational damage. According to the ACFE's 2024 Report to the Nations, 43% of corporate fraud is first detected through a whistleblower tip — more than through internal audits, management reviews, and surveillance combined. A well-implemented vigil mechanism is, therefore, one of the most cost-effective fraud prevention tools an Indian company can deploy.
Not every company in India is required to operate a vigil mechanism, but the criteria are broader than many boards assume. Rule 7(1) of the Companies (Meetings of Board and its Powers) Rules, 2014 makes it mandatory for every listed company regardless of size or sector, every company that accepts deposits from the public, and every company that has borrowed more than ₹50 crore from banks or public financial institutions — a threshold that catches a meaningful number of unlisted, privately held companies that assume the obligation only applies to listed entities. Where an Audit Committee is not statutorily required, Rule 7(3) requires the Board to nominate a director to take on the oversight role instead, so the absence of an Audit Committee is not an exemption from the underlying obligation.
Rule 7(4) requires the mechanism to provide for direct access to the Audit Committee chairperson — or the nominated director — in appropriate or exceptional cases, bypassing the normal reporting line entirely. In practice, this is the clause organisations most often fail to operationalise: a policy document that names the Audit Committee chairperson but provides no actual contact route separate from the general compliance inbox does not satisfy the requirement, and it is exactly the kind of gap that surfaces during a regulatory review. Rule 7(2) places ongoing oversight of the mechanism's functioning with the Audit Committee, including recusal by any member with a conflict of interest in a specific case, and Rule 7(5) gives the Audit Committee, or nominated director, authority to act — including reprimand — against anyone who repeatedly files frivolous complaints, which protects the system's credibility on both sides.
Under SEBI's Listing Obligations and Disclosure Requirements (LODR) Regulations 2015, listed entities must ensure their vigil mechanism includes direct access to the Chairperson of the Audit Committee for serious concerns. The Companies (Auditor's Report) Order, 2020 (CARO) further requires statutory auditors to verify and disclose how whistleblower complaints were handled — making gaps in the mechanism directly visible to regulators. For companies that treat the vigil mechanism as a checkbox rather than a functioning system, this creates significant audit and governance exposure.
EthicalView's managed vigil mechanism goes beyond policy. We provide the confidential reporting infrastructure, independent case management, and audit-ready documentation that Section 177 and CARO 2020 require. Our third-party model ensures the structural independence that internal mechanisms cannot offer — because when employees don't trust the system, they don't use it, and misconduct goes unreported. A vigil mechanism that works is one that employees believe in. We build those.
Between the moment a report is filed and the moment a case closes, a vigil mechanism has to do several things reliably: acknowledge receipt without exposing the reporter's identity, triage the concern to determine urgency and who should investigate, conduct that investigation with documented findings, decide on an outcome, and communicate that outcome back to the reporter where appropriate — all while maintaining a record that would satisfy a statutory auditor asking how the case was handled. Organisations that manage this process through informal email threads and verbal updates typically cannot reconstruct that trail when CARO 2020 disclosure requirements or an Audit Committee review calls for it, which is where a structured, independently managed case management system earns its value.
A vigil mechanism's effectiveness is ultimately measured by whether the people it is meant to protect actually use it. EthicalView's managed service is built to close every gap Rule 7 identifies — genuine anonymity, independent intake separate from the department under scrutiny, documented investigation workflows, and audit-ready reporting for the Audit Committee — so the mechanism functions as the early warning system the Companies Act intended, not a policy that exists only to be filed away until an auditor asks for it.