Policy Register
Every policy type ยท Conduct

Whistleblowing policy

How a person raises a concern about wrongdoing, including about an AI system, how they are protected, and how the concern is handled.

How the register reads it

Also calledspeak-up policy, raising concerns
FamilyConduct
Document typePolicy. The regimes ask for the content, not the label; a line pasted as a standard, procedure, plan or schedule is placed here with the label noted.
Expected ownerLegal or the compliance officer.
Review cadenceAnnual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).
On the gap list whenISO 42001 is ticked and no line resolves to it (ISO 27001 requires it too, inside a parent document, so it does not list it separately).
TemplateWhistleblower and reporting policy.

Which standards require it, and what each expects it to contain

2 requiring clauses, 2 regimes

Shown on a register for the regimes you tick; with none ticked, ISO 27001 is applied. Requirement text drawn from a human-verified compliance corpus under licence: the corpus statement of each clause, not the instrument verbatim.

ISO/IEC 27001:2022

ISO 27001 6.8 Information security event reporting

Give people an easy, timely channel to report observed or suspected security events.

What the ISO 27002 guidance expects the document to say: Requires a mechanism through which personnel can report security events they have observed or suspect, using appropriate channels and without delay.

Evidence an auditor accepts: The defined reporting mechanism and channels, and evidence they are known to personnel and to relevant third parties; reporting records for the period, showing volume, source and the time between observation and report; evidence the channel is available at all times and does not depend on a system that may itself be affected
Common gap: no anonymous reporting option
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

ISO/IEC 42001:2023

ISO 42001 A.3.3 Reporting of concerns

A process shall be established to enable reporting of concerns about AI systems' development, deployment, or use.

Evidence an auditor accepts: Concern reporting procedure; whistleblower channel evidence; concern register
Common gap: Is the reporting channel actually used and concerns addressed?
Source: ISO/IEC 42001:2023

Do this for every document on your list

Paste the list and get this reading for every document at once, with the owner and cadence against each, the clauses quoted, and the documents the regimes expect that the list does not carry. Eight documents free, no account.

Build a register

Social media policy