Who this is for: Any employee, contractor, or insider considering reporting fraud, safety violations, financial misconduct, or illegal activity — whether to internal management, a government agency, or law enforcement. Complete this audit before you act. Each item covers a specific right, deadline, or protection the law provides.
How to use it: Check each item as you verify it applies to your situation. Click any item title for a detailed explanation. Your progress saves automatically — return anytime. Estimated time: 15–20 minutes.
Know Your Legal Framework
6 itemsIdentify which whistleblower law applies to your situation
Federal law varies by sector. The Whistleblower Protection Act (5 U.S.C. § 2302) covers federal employees. Sarbanes-Oxley (18 U.S.C. § 1514A) covers publicly traded companies. Dodd-Frank (15 U.S.C. § 78u-6) covers securities violations. The False Claims Act (31 U.S.C. § 3730) covers fraud against the government. State whistleblower statutes cover the rest. Knowing which law applies determines your protections and filing deadlines.
Confirm you qualify as a "protected whistleblower" under the law
Most federal protections cover current employees, former employees, applicants, and contractors. Dodd-Frank uniquely allows anonymous reporting and covers individuals who report to the SEC even if they didn't report internally first. The definition of "protected activity" includes reporting violations of securities laws, fraud, safety regulations, or gross mismanagement — but does NOT cover personal employment disputes.
Verify the statute of limitations for your specific claim type
Deadlines are strict and non-negotiable. SOX retaliation claims: 180 days to file with OSHA. Dodd-Frank SEC reports: 6 years or 3 years from discovery, whichever is shorter. False Claims Act qui tam suits: 6 years from the violation. State laws vary — some give as little as 30 days. Missing a deadline permanently bars your claim. Calendar it immediately.
Understand the difference between internal and external reporting
Internal reporting (to compliance, legal, or management) is required under some policies and may trigger additional protections. External reporting (to SEC, OSHA, DOJ, or state agencies) is protected under federal law regardless. Under Dodd-Frank, you can report directly to the SEC without first reporting internally and still receive full anti-retaliation protection. The False Claims Act requires filing under seal in federal court.
Check if your state has additional whistleblower protections
As of 2024, all 50 states have some form of whistleblower protection, but coverage varies dramatically. California (Labor Code § 1102.5) is among the strongest, covering reports of ANY legal violation. New York, New Jersey, and Illinois also provide broad protections. Some states protect only public employees. Check your state's labor department website for the specific statute — state claims can be filed simultaneously with federal claims.
Determine if a qui tam (False Claims Act) lawsuit applies
The False Claims Act (31 U.S.C. §§ 3729–3733) allows private citizens to file lawsuits on behalf of the government against entities defrauding federal programs. If successful, whistleblowers (called "relators") receive 15–30% of the recovered funds. Average awards exceed $3 million. The case is filed under seal — the employer doesn't know for 60+ days while DOJ investigates. You must have direct, independent knowledge of the fraud.
Anti-Retaliation Protections
5 itemsKnow the 11 forms of retaliation the law prohibits
Under the Whistleblower Protection Enhancement Act of 2012, prohibited retaliation includes: termination, demotion, suspension, reassignment, reduction in pay or hours, failure to promote, intimidation, harassment, blacklisting, unfavorable performance reviews tied to reporting, and threats of any of the above. Any adverse action that would discourage a reasonable person from reporting qualifies as retaliation under the "materially adverse action" standard.
Understand your right to reinstatement and back pay
If retaliation is proven, the law provides: full reinstatement to your former position with seniority, back pay with interest from the date of the adverse action, compensatory damages for emotional distress (up to $300,000 under WPA), attorney's fees and litigation costs, and in some cases punitive damages. SOX and Dodd-Frank allow front pay (future lost wages) if reinstatement isn't feasible. The burden of proof shifts to the employer after you establish a prima facie case.
Document any retaliation you've already experienced
Create a dated timeline of every adverse action: changed assignments, exclusion from meetings, negative reviews after reporting, hostile comments from supervisors, reduction in responsibilities. Save emails, texts, Slack messages, and performance reviews. Note witnesses present for verbal threats or intimidation. This documentation becomes critical evidence — courts assess whether the employer's stated reason for the adverse action is pretextual (a cover for retaliation).
Verify your employer's non-retaliation policy exists and is current
SOX Section 806 requires publicly traded companies to maintain formal whistleblower protection policies. Dodd-Frank requires SEC-regulated entities to have anti-retaliation procedures. Request a copy of your employer's policy in writing. If no policy exists, document that fact — it strengthens your position and may indicate a compliance violation itself. Federal contractors are subject to Executive Order 13658 requiring explicit non-retaliation clauses.
Confirm your confidentiality rights under federal law
The identity of SEC whistleblowers is strictly confidential under Dodd-Frank Section 21F(h)(2). The agency cannot disclose your identity except as required by law or in proceedings where the government is a party. OSHA complaints under SOX are kept confidential during investigation. However, if you file a lawsuit, your identity will eventually become part of the public record. Internal reports may or may not be kept confidential depending on your employer's policy — never assume anonymity unless explicitly guaranteed in writing.
Documentation & Evidence
5 itemsGather evidence you're legally entitled to possess
You may collect documents you encountered in the normal course of your work. You may NOT steal, hack, or access systems outside your authorized permissions. The Defend Trade Secrets Act (18 U.S.C. § 1836) provides immunity for disclosing trade secrets confidentially to an attorney or government official in a whistleblower complaint. Best practice: take photos of documents with your phone, note file names and locations, and record dates. Do not email company documents to personal accounts.
Create a secure, personal timeline of events
Write a chronological narrative: when you first discovered the misconduct, what you observed, who was involved, what you reported and to whom, and every response you received. Include specific dates, dollar amounts, project names, and people involved. Store this document outside of company systems — use a personal device, encrypted cloud storage, or printed copies in a secure location. This timeline becomes the backbone of any legal action.
Identify and protect potential witnesses
List colleagues who have firsthand knowledge of the misconduct or who may have been present during relevant conversations. Do NOT discuss your reporting plans with them through company email or company devices. Speak in person or through personal communication channels. Understand that witnesses may be reluctant to cooperate out of fear — their hesitation is itself evidence of a retaliatory culture. Document who you spoke with, when, and what they said.
Preserve all digital communications and records
Forward relevant emails to a personal account (if legally permissible in your jurisdiction). Screenshot Slack/Teams conversations. Save voicemails. Back up files to a personal drive. Use the "print to PDF" function for web-based communications. Companies routinely purge digital records during investigations — assume anything on company servers could disappear. Store copies in at least two secure locations. Include metadata (timestamps, sender info) when possible.
Understand what you can and cannot legally record
12 states require all-party consent to record conversations: California, Connecticut, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Oregon, Pennsylvania, Washington, and Delaware. In the remaining 38 states and D.C., one-party consent (yours) is sufficient. Federal wiretapping law (18 U.S.C. § 2511) follows one-party consent. Recording across state lines gets complex — consult an attorney before recording any conversation. Never record attorney-client privileged communications.
Filing & Reporting Process
5 itemsFile your complaint with the correct government agency
SEC violations → SEC Office of the Whistleblower (online submission). Financial fraud → FinCEN or CFPB. Safety violations → OSHA. Government contract fraud → DOJ Civil Division. Tax fraud → IRS Whistleblower Office (Form 211). Federal employee retaliation → Merit Systems Protection Board (MSPB) or OSC. Environmental violations → EPA. Healthcare fraud → HHS-OIG. Each agency has specific forms, procedures, and timelines. Filing with the wrong agency wastes time and may miss deadlines.
Understand the SEC whistleblower award program
Dodd-Frank Section 21F mandates awards of 10–30% of sanctions collected when the SEC recovers over $1 million. Since 2011, the SEC has awarded over $1.9 billion to whistleblowers. The largest single award: $279 million in 2023. You can submit tips anonymously if represented by an attorney. The SEC evaluates: significance of information, degree of assistance, and law enforcement interest. Awards are paid from the Investor Protection Fund — not from taxpayer money or the company's funds.
Consult a whistleblower attorney before filing
Most whistleblower attorneys work on contingency — they only get paid if you receive an award (typically 20–40% of your share). Initial consultations are almost always free. An attorney can: evaluate the strength of your claim, ensure proper filing procedures, protect your identity during investigation, negotiate with the government on your behalf, and preserve your rights under multiple overlapping statutes. Contact the National Whistleblower Center (whistleblowers.org) for attorney referrals.
Know the SEC's TCR (Tips, Complaints, and Referrals) submission process
Submit via the SEC's online TCR system at sec.gov/whistleblower. Required: your contact information (or your attorney's), a description of the securities violation, supporting documents, and how you learned of the violation. File Form TCR first, then Form WB-DEC (declaration under penalty of perjury). The SEC assigns a tracking number — save it. You can supplement your submission with additional information at any time. Response times vary: expect 6–24 months for initial evaluation.
File a retaliation complaint with OSHA if applicable
OSHA administers anti-retaliation provisions for 25+ federal whistleblower statutes, including SOX, the Surface Transportation Assistance Act, and the Pipeline Safety Improvement Act. File within the applicable deadline (typically 30–180 days depending on the statute) at osha.gov or by calling 1-800-321-OSHA. OSHA investigates and can order preliminary reinstatement within 60 days. If OSHA doesn't resolve it, you can file a complaint in federal district court.
Post-Reporting Safeguards
4 itemsMonitor for retaliation for at least 18 months after reporting
Retaliation often doesn't happen immediately — it appears weeks or months later as "performance issues," restructuring, or gradual exclusion. Document every change in your work conditions, assignments, or treatment. Courts recognize "temporal proximity" — adverse actions shortly after protected activity create an inference of retaliation. Continue documenting even after filing a complaint. The legal standard is whether a reasonable employee would be dissuaded from reporting by the adverse action.
Know your rights if your employer tries to enforce an NDA against you
The SEC Rule 21F-17(a) prohibits companies from using NDAs, severance agreements, or internal policies to prevent employees from communicating with the SEC. The SEC has brought enforcement actions against companies including KBR, BlueLinx Holdings, and NeuStar for restrictive NDAs. No agreement can legally prevent you from reporting securities violations to the government. Any NDA clause that purports to restrict whistleblower communications is void and unenforceable under federal law.
Understand your financial protection during the process
If terminated for whistleblowing, you may be entitled to: double back pay under SOX, front pay in lieu of reinstatement, compensatory damages up to $300,000 under the WPA, and attorney's fees. Interim earnings may reduce back pay, but the burden is on the employer to prove you failed to mitigate damages. File for unemployment benefits immediately — whistleblower termination is typically considered "good cause" leaving and won't disqualify you. Maintain an emergency fund if possible before reporting.
Connect with whistleblower support organizations
You're not alone. Key resources: National Whistleblower Center (whistleblowers.org) — legal support and advocacy. Government Accountability Project (whistleblower.org) — representation and policy reform. National Whistleblower Legal Defense & Education Fund — free legal consultations. Project On Government Oversight (pogo.org) — federal oversight and accountability. These organizations provide legal referrals, emotional support, and connect you with other whistleblowers. The psychological toll is real — seeking support is strength, not weakness.
All 25 Items Complete
You now know every legal guarantee the law provides for whistleblowers. You've verified your protections, documented your evidence, and identified the right agency. You're prepared.
Get Weekly Rights Briefings from SarahFrequently Asked Questions
Essential Resources
SEC Whistleblower Program
Official SEC guidance, submission forms, and award statistics. sec.gov/whistleblower
National Whistleblower Center
Free legal consultations and attorney referrals for all whistleblower cases. whistleblowers.org
OSHA Whistleblower Protection
File retaliation complaints and learn about 25+ protected statutes. osha.gov/whistleblower
Government Accountability Project
Legal representation and advocacy for whistleblowers since 1977. whistleblower.org
False Claims Act — 31 U.S.C. § 3730
Full text of the federal False Claims Act qui tam provisions and filing procedures.