Quick Answer
Every listed company and prescribed class of companies must establish a vigil mechanism under Companies Act, 2013, Section 177(9). When a whistleblower complaint is received, the Audit Committee must ensure independent investigation — preferably by an external forensic firm — with anti-victimisation safeguards per Section 177(10). For listed companies, SEBI LODR Regulation 22 adds disclosure and review requirements. At Virtual Auditor, whistleblower investigations are led by CA V. Viswanathan (FCA, ACS, CFE, IBBI/RV/03/2019/12333) using ACFE-standard investigation methodology. We produce reports that are admissible before NCLT, SEBI, and civil/criminal courts.
Definition — Vigil Mechanism (Whistle Blower Policy): A structured channel through which directors, employees, and stakeholders can report concerns about unethical behaviour, actual or suspected fraud, or violation of the company’s code of conduct or legal provisions. The mechanism must provide for confidentiality, protection against retaliation, and direct access to the chairperson of the Audit Committee. Mandated by Section 177(9) of the Companies Act, 2013 and SEBI LODR Regulation 22 for listed companies.
Definition — Whistleblower Investigation: A forensic examination triggered by a whistleblower complaint, conducted independently (typically by an external CFE/forensic firm), following evidence preservation protocols and structured interview techniques. The investigation produces a factual report for the Audit Committee with findings, evidence, and recommendations for remedial action or legal proceedings.
Section 177(9) states: “Every listed company or such class or classes of companies, as may be prescribed, shall establish a vigil mechanism for directors and employees to report genuine concerns in such manner as may be prescribed.”
Section 177(10) states: “The vigil mechanism under sub-section (9) shall provide for adequate safeguards against victimisation of persons who use such mechanism and make provision for direct access to the chairperson of the Audit Committee in appropriate or exceptional cases.”
Rule 7 of the Companies (Meetings of Board and its Powers) Rules, 2014 prescribes the following classes of companies that must establish a vigil mechanism:
SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015, Regulation 22 provides:
SEBI (Prohibition of Insider Trading) Regulations, 2015, Regulation 7A (inserted via amendment in 2020) establishes a separate informant mechanism specifically for reporting insider trading violations. Key features:
Expert Insight — CA V. Viswanathan, CFE
The single most common failure in whistleblower complaint handling is assigning the investigation to the internal audit team. When the complaint involves senior management — which it frequently does — internal audit lacks independence. Even when it does not involve management, internal auditors may have working relationships with the accused that compromise objectivity. An external CFE-qualified forensic investigator brings both independence and specialised fraud examination skills that most internal audit teams do not possess. The Audit Committee should insist on external investigation for any complaint involving amounts above ₹10 lakh or allegations against management personnel.
Based on our experience across 100+ whistleblower investigations, complaints typically fall into these categories:
At Virtual Auditor, we follow a structured investigation process aligned with ACFE standards:
We follow the ACFE interview methodology, which structures interviews in a specific sequence:
All interviews are documented contemporaneously. Where legally permissible and with consent, audio recording is used.
For companies setting up or reviewing their vigil mechanism, we recommend the following structure based on statutory requirements and best practice:
Expert Insight — CA V. Viswanathan, CFE
In our experience reviewing vigil mechanism policies across listed and unlisted companies, the most common failures are: (1) The policy exists on paper but employees do not know about it — no training, no communication, no visibility. (2) Complaints are routed to HR or the company secretary who reports to the MD — destroying independence when the complaint involves senior management. (3) Investigation is conducted by internal audit with no forensic training — leading to inadequate evidence gathering. (4) No feedback is given to the complainant — discouraging future reporting. (5) The Audit Committee treats the annual review as a formality rather than a substantive governance exercise.
This Act was passed by Parliament in 2014 but has not been brought into force as of March 2026. It was designed to protect whistleblowers who disclose corruption and misuse of power by public servants. Key features (not yet operative):
In the absence of a comprehensive whistleblower protection law for the private sector, protection comes from:
The most common and highest-value complaints. Investigation approach:
For listed companies, insider trading complaints require specific expertise in SEBI regulations:
| Service | Scope | Starts From |
|---|---|---|
| Complaint Assessment & Scoping | Preliminary review, risk assessment, investigation plan | ₹50,000 |
| Single-Issue Investigation | One complaint, data analytics + interviews + report | ₹1,50,000 |
| Comprehensive Forensic Investigation | Multi-allegation, multiple periods, full evidence gathering | ₹3,00,000 |
| Vigil Mechanism Policy Design | Policy drafting + governance structure + training | ₹75,000 |
| Expert Witness Testimony | NCLT / SEBI / civil court / criminal court | Separate engagement |
For a custom quote, visit Virtual Auditor Pricing or call +91 99622 60333.
Summary
Companies Act Section 177(9) mandates a vigil mechanism for listed companies and companies with borrowings exceeding ₹50 crore. Section 177(10) requires anti-victimisation safeguards and direct Audit Committee access. SEBI LODR Regulation 22 adds disclosure and annual review requirements for listed companies. Independent external investigation by a CFE-qualified forensic firm is best practice for all significant complaints. At Virtual Auditor, whistleblower investigations are led by CA V. Viswanathan (FCA, ACS, CFE, IBBI/RV/03/2019/12333). Reports are structured for legal admissibility. Related reading: Employee Fraud in Indian SMEs: Detection & Prevention.
Under Section 177(9) of the Companies Act, 2013, every listed company and every company that accepts deposits from the public or has borrowed money from banks and public financial institutions in excess of ₹50 crore must establish a vigil mechanism. Rule 7 of the Companies (Meetings of Board and its Powers) Rules, 2014, prescribes these classes.
Under Section 177(10), the vigil mechanism must provide for direct access to the chairperson of the Audit Committee in appropriate or exceptional cases. The Audit Committee oversees the mechanism, reviews complaints, decides on investigation, and monitors remedial action. For listed companies, SEBI LODR Regulation 22(2) requires the Audit Committee to review the functioning of the whistle blower mechanism at least once a year.
Yes. SEBI (Prohibition of Insider Trading) Regulations, 2015, Regulation 7A (inserted in 2020) established an informant mechanism where individuals can report insider trading violations to SEBI and receive financial rewards of up to ₹1 crore. Separately, SEBI LODR Regulation 22 mandates that listed companies establish a vigil mechanism and disclose it on their website.
The Whistleblowers Protection Act, 2014, was enacted by Parliament but has not been brought into force as of 2026. In the private sector, protection is provided through the Companies Act Section 177(10) requirement for anti-victimisation safeguards, through individual company vigil mechanism policies, and through general labour law protections against wrongful termination.
Best practice is to engage an independent external investigator — typically a forensic accounting firm with CFE credentials. The investigation should follow ACFE methodology: evidence preservation, document review, data analytics, structured interviews, and a legally admissible report. The Audit Committee should oversee the investigation. Contact Virtual Auditor at +91 99622 60333.
Non-compliance with Section 177(9) is a violation of the Companies Act. The Registrar of Companies can issue a notice. For listed companies, SEBI can impose penalties under Section 23A of the SEBI Act and take enforcement action for violation of LODR Regulation 22. Absence of a vigil mechanism may also be treated as a corporate governance failure in any subsequent litigation.
Virtual Auditor — AI-Powered CA & IBBI Registered Valuer Firm
Valuer: V. VISWANATHAN, FCA, ACS, CFE, IBBI/RV/03/2019/12333
Chennai (HQ): G-131, Phase III, Spencer Plaza, Anna Salai, Chennai 600002
Bangalore: 7th Floor, Mahalakshmi Chambers, 29, MG Road, Bangalore 560001
Mumbai: Workafella, Goregaon West, Mumbai 400062
Phone: +91 99622 60333 | Email: support@virtualauditor.in
Book a Consultation
Companies required to have a vigil mechanism include every listed company, companies that accept deposits from the public, and companies that have borrowed money from banks or public financial institutions exceeding fifty crore rupees.
The Audit Committee must ensure an independent investigation is conducted, preferably by an external forensic firm, and provide safeguards against the victimisation of the whistleblower. Additionally, for listed companies, the Committee is required to review the mechanism's functioning at least annually under SEBI regulations.
Yes, under the SEBI (Prohibition of Insider Trading) Regulations, 2015, informants can receive a financial reward of up to one crore rupees if their original information leads to the disgorgement of at least five crore rupees in insider trading violations.
Internal audit teams often lack the necessary independence, especially if senior management is involved, or they may have compromised objectivity due to existing working relationships. An external CFE-qualified forensic investigator brings both the required independence and specialized fraud examination skills to the process.
Poor investigations can lead to significant regulatory risks, personal liability for Audit Committee members, litigation risks from wrongful termination claims, severe reputational damage from leaked complaints, and the continuation of fraudulent activities due to inadequate findings.