Skip to main content

Accountability and conduct

Whistleblowing Policy

Al-Waris Foundation is committed to operating lawfully, ethically, transparently and in accordance with its charitable purposes.

Current version 2.0

1. Policy Statement

Al-Waris Foundation is committed to operating lawfully, ethically, transparently and in accordance with its charitable purposes.

People involved with the charity should be able to raise genuine concerns about serious wrongdoing without fear of inappropriate retaliation.

Al-Waris Foundation will:

  • take genuine concerns seriously;
  • provide appropriate reporting routes;
  • handle concerns as confidentially as reasonably possible;
  • protect people raising concerns from retaliation;
  • investigate or refer concerns appropriately;
  • take corrective action where wrongdoing is identified;
  • make external reports where required.

Whistleblowing must not be suppressed merely because a concern could cause embarrassment or reputational damage to the charity.

2. Purpose

This policy provides a framework for raising concerns about suspected serious wrongdoing connected with Al-Waris Foundation.

Its purposes are to:

  • encourage early reporting;
  • provide safe reporting routes;
  • protect the charity and its beneficiaries;
  • identify fraud, safeguarding failures and other misconduct;
  • support regulatory compliance;
  • protect individuals raising genuine concerns;
  • ensure concerns involving senior people can still be reported.

3. Scope

This policy may be used by:

  • trustees;
  • staff where applicable;
  • volunteers;
  • contractors;
  • consultants;
  • project workers;
  • interns;
  • people carrying out work on behalf of Al-Waris Foundation.

Other people, including beneficiaries, donors and members of the public, may normally use the Complaints Policy unless the nature of their information makes another reporting route more appropriate.

4. What Is Whistleblowing?

Whistleblowing generally involves raising information about suspected wrongdoing that affects others or the wider public interest rather than solely a personal grievance.

Concerns may relate to conduct that has:

  • happened;
  • is currently happening;
  • is likely to happen;
  • been deliberately concealed.

A person does not need absolute proof before raising a genuine concern.

They should have an honest and reasonable basis for raising it.

5. Examples of Whistleblowing Concerns

Concerns may include suspected:

  • fraud;
  • theft;
  • bribery;
  • corruption;
  • misuse of charitable funds;
  • diversion of donations;
  • false accounting;
  • money laundering;
  • terrorist financing;
  • sanctions breaches;
  • criminal offences;
  • serious safeguarding failures;
  • abuse or exploitation;
  • deliberate breaches of law;
  • serious health and safety risks;
  • significant data protection or cybersecurity misconduct;
  • serious environmental wrongdoing where relevant;
  • deliberate regulatory non-compliance;
  • unauthorised trustee benefit;
  • serious conflicts of interest being concealed;
  • deliberate falsification of project evidence;
  • fabricated beneficiaries or distributions;
  • deliberate misleading of donors;
  • deliberate misleading of regulators;
  • destruction or concealment of evidence;
  • retaliation against a whistleblower;
  • deliberate concealment of any of the above.

This list is not exhaustive.

6. Whistleblowing and Personal Grievances

Whistleblowing is different from an ordinary personal complaint.

For example:

  • dissatisfaction with a routine decision may be a complaint;
  • disagreement with another volunteer may be an interpersonal matter;
  • dissatisfaction with a service may fall under the Complaints Policy.

However, a personal complaint may also reveal wider wrongdoing.

The charity should consider the substance of the concern rather than rejecting it merely because it was initially submitted through the wrong procedure.

7. Safeguarding Concerns

Where information suggests that a child or adult may be at immediate or significant risk of harm, safeguarding procedures must take priority.

The concern should be reported promptly through the relevant safeguarding route.

Whistleblowing procedures must not delay:

  • emergency protection;
  • police involvement;
  • local-authority referrals;
  • other necessary safeguarding action.

See:

  • Safeguarding Children Policy;
  • Safeguarding Adults at Risk Policy.

8. Emergency Situations

Where there is an immediate danger to life or serious safety risk, appropriate emergency services should be contacted without waiting for the internal whistleblowing process.

Internal reporting should follow as soon as reasonably practicable.

9. Raising a Concern Internally

A whistleblowing concern should normally be raised with an appropriate authorised person.

Depending on the circumstances, this may be:

  • the Chair;
  • another trustee;
  • the Designated Safeguarding Lead where safeguarding is involved;
  • another person specifically authorised to receive whistleblowing concerns.

The charity should ensure that there is always an alternative route where the concern involves the person who would ordinarily receive it.

10. Concerns About the Chair

Where a concern relates to:

  • the Chair;
  • conduct authorised by the Chair;
  • a conflict involving the Chair;

the concern should be raised directly with another unconflicted trustee.

The Chair must not control the investigation into allegations concerning their own conduct.

Where necessary, the unconflicted trustee may seek:

  • independent professional advice;
  • regulatory guidance;
  • external investigation.

11. Concerns About Another Trustee

Where a concern concerns another trustee, it should be raised with:

  • the Chair, where unconflicted; or
  • another unconflicted trustee.

The trustee who is the subject of the concern must not determine the outcome of the investigation.

12. Concerns About the Whole Board

Where the concern involves:

  • all trustees;
  • a majority of trustees;
  • circumstances making internal reporting unsafe or ineffective;

the person raising the concern may need to approach an appropriate external body.

Depending on the subject matter, this could include:

  • Charity Commission;
  • police;
  • Information Commissioner's Office;
  • local authority safeguarding services;
  • another prescribed or competent authority.

13. How to Raise a Concern

A concern may normally be raised:

  • in writing;
  • by email;
  • verbally;
  • during a meeting with an appropriate person.

Written reports are preferable for significant matters because they provide a clear record.

However, a concern must not be ignored simply because it was raised verbally.

14. Information to Provide

Where possible, the person raising the concern should provide:

  • nature of the suspected wrongdoing;
  • people involved;
  • relevant dates;
  • locations;
  • how they became aware of the concern;
  • supporting evidence;
  • whether anyone may currently be at risk;
  • whether the matter has been raised previously.

A person should not delay reporting merely because they cannot provide every detail.

15. Evidence

Whistleblowers are not expected to conduct their own full investigation.

They should not:

  • unlawfully access systems;
  • impersonate others;
  • steal documents;
  • place themselves at unnecessary risk;
  • interfere with evidence;
  • confront suspected offenders where doing so may create danger.

Relevant evidence already legitimately available to the person may be provided with the report.

16. Anonymous Concerns

Anonymous whistleblowing concerns may be considered.

The charity should assess:

  • seriousness;
  • credibility;
  • specificity;
  • evidence available;
  • ability to verify the information;
  • potential risk to beneficiaries or charity assets.

Anonymous reporting may make investigation more difficult because follow-up questions cannot easily be asked.

However, credible anonymous safeguarding, fraud or serious-governance concerns must not automatically be dismissed.

17. Confidentiality

The identity of a whistleblower should be protected as far as reasonably practicable.

Information should normally be disclosed only to people who need it for:

  • investigation;
  • safeguarding;
  • legal advice;
  • governance;
  • regulatory reporting;
  • law enforcement.

Absolute confidentiality cannot be guaranteed.

Disclosure may be necessary where:

  • required by law;
  • necessary for safeguarding;
  • required by a regulator;
  • required in legal proceedings;
  • necessary for a fair investigation.

Where reasonably possible, the whistleblower should be informed before their identity is disclosed.

18. No Retaliation

Al-Waris Foundation will not tolerate retaliation against a person because they have raised a genuine concern.

Retaliation may include:

  • threats;
  • intimidation;
  • harassment;
  • bullying;
  • unfair removal from duties;
  • exclusion;
  • discrimination;
  • detrimental treatment;
  • attempts to damage reputation;
  • pressure to withdraw a concern.

A retaliation allegation should itself be investigated.

19. Protection Under Law

Certain workers who make qualifying disclosures may have statutory protection under whistleblowing law.

Whether statutory protection applies depends on:

  • the person's legal status;
  • nature of the disclosure;
  • recipient of the disclosure;
  • circumstances in which it was made.

This policy does not attempt to restrict or replace statutory rights.

A person may obtain independent legal advice where they are uncertain about their rights.

20. Volunteers and Trustees

Some people involved with Al-Waris Foundation, including volunteers or trustees, may not have the same statutory employment-law whistleblowing protections as qualifying workers.

Al-Waris Foundation nevertheless applies the anti-retaliation principles of this policy to trustees, volunteers and other people within its governance and operational framework.

This is an organisational commitment and does not create employment status where none otherwise exists.

21. Good-Faith Mistakes

A person will not be penalised merely because a genuinely raised concern turns out to be mistaken.

Whistleblowers are not required to prove wrongdoing before reporting it.

The key distinction is between:

  • an honestly raised concern; and
  • a knowingly false or malicious allegation.

22. Knowingly False Allegations

Knowingly making a deliberately false allegation for the purpose of harming another person may result in appropriate action.

However:

  • lack of evidence;
  • an investigation finding no wrongdoing;
  • a mistaken belief;

do not by themselves establish that an allegation was malicious.

The charity must avoid using allegations of "malice" to discourage legitimate reporting.

23. Initial Assessment

When a concern is received, the authorised recipient should assess:

  • what is alleged;
  • seriousness;
  • immediate safety risks;
  • safeguarding implications;
  • financial risks;
  • evidence preservation;
  • conflicts of interest;
  • whether external reporting is required;
  • who should investigate.

Immediate protective action may be taken before the full investigation begins.

24. Acknowledgement

Where contact details are available, Al-Waris Foundation should normally acknowledge a whistleblowing concern within 5 working days.

The acknowledgement should avoid making premature conclusions.

It may explain:

  • that the concern has been received;
  • who is handling it;
  • whether further information is needed;
  • what the person can reasonably expect next.

25. Investigation

Where an investigation is appropriate, it should be:

  • fair;
  • proportionate;
  • appropriately independent;
  • documented;
  • confidential;
  • focused on the issues raised.

The investigator should not have a material conflict of interest.

26. Independent Investigation

An external investigator or adviser should be considered where:

  • allegations concern senior trustees;
  • the Board lacks sufficient independence;
  • specialist expertise is required;
  • serious financial misconduct is alleged;
  • the allegations are particularly serious;
  • independence is necessary to maintain confidence in the process.

27. People Accused of Wrongdoing

A person accused of wrongdoing should normally be treated fairly.

Where appropriate, they should have an opportunity to respond to allegations.

However, disclosure may need to be delayed where necessary to:

  • protect a person from harm;
  • preserve evidence;
  • avoid prejudicing a police investigation;
  • comply with safeguarding advice;
  • protect the whistleblower.

An allegation is not proof of misconduct.

28. Investigation Records

Appropriate records should be maintained, which may include:

  • original concern;
  • acknowledgement;
  • evidence;
  • interviews;
  • risk assessments;
  • decisions;
  • referrals;
  • investigation findings;
  • corrective actions.

Access should be restricted.

29. Evidence Preservation

Where serious wrongdoing is suspected, reasonable steps should be taken to preserve relevant evidence.

This may include:

  • emails;
  • accounting records;
  • system logs;
  • project records;
  • invoices;
  • receipts;
  • photographs;
  • video;
  • messages;
  • access records.

Records must not be deliberately destroyed, altered or concealed.

30. Interim Protective Measures

While a concern is investigated, temporary measures may be necessary.

These may include:

  • suspending financial authority;
  • restricting system access;
  • pausing payments;
  • changing safeguarding duties;
  • securing records;
  • pausing a project;
  • temporarily removing a person from particular duties.

Interim measures are precautionary and do not necessarily mean misconduct has been established.

31. Fraud and Financial Misconduct

Suspected:

  • fraud;
  • theft;
  • false accounting;
  • bribery;
  • corruption;
  • misappropriation;

must be assessed under the Anti-Fraud, Bribery and Corruption Policy.

The charity should consider:

  • preservation of evidence;
  • bank or payment controls;
  • insurer notification where applicable;
  • police or Action Fraud;
  • Charity Commission reporting;
  • professional advice.

32. Safeguarding Whistleblowing

A safeguarding whistleblower may raise concerns about:

  • abuse;
  • unsafe practice;
  • failure to make referrals;
  • concealment of safeguarding incidents;
  • inappropriate beneficiary contact;
  • unsafe recruitment;
  • retaliation against someone reporting abuse.

Safeguarding action must not wait for the completion of an internal governance investigation.

33. Data Protection and Cybersecurity

Concerns involving:

  • unauthorised personal-data access;
  • deliberate data misuse;
  • concealment of a serious breach;
  • credential theft;
  • deliberate security bypass;

should also be considered under:

  • Data Protection and UK GDPR Policy;
  • Information Security and Cybersecurity Policy.

The Information Commissioner's Office may need to be notified where applicable.

34. Overseas Operations

Whistleblowing concerns may arise from overseas projects.

Examples include:

  • fabricated distributions;
  • false invoices;
  • contractor kickbacks;
  • diversion of aid;
  • beneficiary exploitation;
  • safeguarding abuse;
  • bribery;
  • sanctions concerns;
  • terrorist-financing concerns.

Overseas concerns should be investigated proportionately while considering:

  • local security;
  • evidence reliability;
  • legal environment;
  • risks to whistleblowers;
  • risks to beneficiaries.

35. Project Evidence

Anyone who becomes aware that project evidence may have been:

  • fabricated;
  • reused deceptively;
  • manipulated;
  • falsely attributed;
  • created for a project that did not occur;

should report the concern.

Photographs, videos, invoices and beneficiary information must not be knowingly falsified to satisfy donors or internal monitoring requirements.

36. Artificial Intelligence

AI-generated material must not be knowingly presented as genuine evidence of charitable activity.

A concern should be raised if AI-generated or manipulated content is being deliberately represented as:

  • an actual beneficiary;
  • genuine documentary photography;
  • proof of a completed distribution;
  • evidence of a completed project;
  • a genuine beneficiary statement.

Legitimate illustrative AI content is distinct from fraudulent project evidence where it is clearly used and represented appropriately.

37. Donor and Fundraising Misrepresentation

Concerns should be raised where there is suspected deliberate misrepresentation of:

  • donation totals;
  • fundraising targets;
  • beneficiaries;
  • project costs;
  • project completion;
  • restricted-fund use;
  • impact;
  • emergency circumstances.

Fundraising must not knowingly mislead donors.

38. Restricted Funds

A person should raise a concern where they reasonably believe restricted donations are being deliberately used for an unrelated purpose without lawful authority.

The concern should distinguish between:

  • genuine accounting or administrative error;
  • lawful reallocation where permitted;
  • deliberate misuse.

39. Conflicts of Interest

Concealment of a significant conflict of interest may constitute whistleblowing where it creates serious governance or financial risk.

Examples include undisclosed:

  • family relationships;
  • supplier interests;
  • financial interests;
  • related-party transactions;
  • personal benefits.

40. External Reporting

There may be circumstances where a concern should be reported outside Al-Waris Foundation.

The appropriate recipient depends on the subject.

Possible external bodies include:

  • Charity Commission;
  • police;
  • Action Fraud;
  • Information Commissioner's Office;
  • local authority safeguarding services;
  • HMRC;
  • other competent authorities.

The charity should not require internal reporting first where doing so would be inappropriate, unsafe or contrary to law.

41. Charity Commission

Serious concerns about charity governance or administration may fall within the Charity Commission's regulatory remit.

Examples may include:

  • serious misuse of charity funds;
  • serious trustee misconduct;
  • serious safeguarding governance failures;
  • significant unmanaged conflicts;
  • serious fraud;
  • deliberate regulatory deception.

Not every disagreement or minor procedural issue requires Charity Commission involvement.

42. Serious Incident Reporting

A whistleblowing disclosure may reveal a reportable serious incident.

The charity must assess this separately under the Serious Incident Reporting Policy.

A matter must not be withheld from the Charity Commission merely because an internal investigation is continuing where reporting is otherwise required.

43. Police and Criminal Matters

Where information suggests serious criminal conduct, the charity should consider whether law-enforcement involvement is necessary.

Immediate threats to life or safety should be reported through emergency services.

An internal investigation must not obstruct a police investigation.

44. Information Commissioner's Office

Where the concern involves serious misuse of personal information or data-protection failures, the charity should assess whether notification or other engagement with the Information Commissioner's Office is required.

45. Feedback to the Whistleblower

Where appropriate and lawful, the person raising the concern should receive an update.

The charity may be able to explain:

  • whether the concern was considered;
  • whether action was taken;
  • whether the matter has concluded.

The charity may be unable to disclose:

  • disciplinary details;
  • confidential personal information;
  • safeguarding information;
  • legally privileged advice;
  • details of an ongoing criminal investigation.

The whistleblower does not automatically have a right to the full investigation report.

46. Investigation Timescales

Whistleblowing investigations vary significantly in complexity.

Al-Waris Foundation will seek to deal with concerns without unreasonable delay.

Where possible, the whistleblower should receive an indication of progress if the investigation is prolonged.

The need for a thorough and fair investigation takes priority over an artificial deadline.

47. Outcome

Possible outcomes include:

  • no wrongdoing identified;
  • insufficient evidence to reach a conclusion;
  • procedural weakness identified;
  • misconduct established;
  • safeguarding action;
  • financial recovery;
  • disciplinary or governance action;
  • contract termination;
  • policy improvement;
  • regulatory referral;
  • criminal referral.

More than one outcome may apply.

48. Corrective Action

Where wrongdoing or control failures are identified, Al-Waris Foundation should consider corrective action including:

  • recovering funds;
  • improving financial controls;
  • changing access permissions;
  • updating policies;
  • retraining;
  • changing contractors;
  • strengthening safeguarding;
  • improving due diligence;
  • correcting public information;
  • notifying affected people where required.

49. Trustee Misconduct

Where serious misconduct by a trustee is established, the Board should consider appropriate action in accordance with:

  • Constitution;
  • charity law;
  • Trustee Code of Conduct.

This may include considering:

  • removal of delegated responsibilities;
  • restriction of access;
  • regulatory reporting;
  • removal from office where legally permitted;
  • legal action.

50. Conflicts During Investigation

Anyone involved in assessing or investigating a concern must declare relevant conflicts.

A conflicted person should not:

  • determine the allegations;
  • control evidence;
  • decide the outcome;

where doing so would compromise independence.

See the Conflict of Interest Policy.

51. Confidential Advice

A person considering whistleblowing may seek independent advice.

Depending on their circumstances, sources may include:

  • a solicitor;
  • a trade union where applicable;
  • an appropriate whistleblowing advice service;
  • a relevant regulator.

The charity will not require someone to waive statutory rights as a condition of raising a concern.

52. Settlement and Confidentiality Agreements

No agreement entered into by Al-Waris Foundation should knowingly be used to prevent a person from making a legally protected disclosure or reporting matters to a competent regulator or law-enforcement authority where the law permits such reporting.

53. Media Disclosures

Public or media disclosure may have different legal consequences from disclosure to the charity or an appropriate prescribed person.

Anyone considering public disclosure should consider obtaining independent advice.

This policy does not encourage unnecessary disclosure of:

  • confidential beneficiary information;
  • safeguarding information;
  • donor data;
  • personal data.

54. Record Retention

Whistleblowing records should be retained in accordance with the Records Retention and Disposal Policy.

Retention should reflect:

  • seriousness;
  • legal requirements;
  • safeguarding implications;
  • regulatory requirements;
  • ongoing risk.

Records should not be retained indefinitely without justification.

55. Data Protection

Personal data processed during whistleblowing must be handled in accordance with:

  • UK GDPR;
  • Data Protection Act 2018;
  • Data Protection and UK GDPR Policy.

Access should be restricted according to legitimate need.

Information must not be unnecessarily disclosed merely because an allegation has been made.

56. Monitoring

The Board should receive proportionate information concerning significant whistleblowing matters.

Where possible, reporting should be anonymised.

Board oversight may include:

  • number of concerns;
  • categories;
  • significant outcomes;
  • unresolved cases;
  • recurring themes;
  • retaliation allegations;
  • control improvements.

The Board does not require unnecessary identifiable case details to exercise oversight.

57. Responsibility

The Board of Trustees retains overall responsibility for ensuring Al-Waris Foundation maintains an effective whistleblowing framework.

Operational responsibility may be delegated.

The Board must ensure there is an alternative reporting route where a concern involves the Chair or another person ordinarily responsible for receiving concerns.

58. Awareness

Relevant trustees, volunteers, staff and other representatives should be informed that:

  • concerns can be raised;
  • retaliation is prohibited;
  • safeguarding concerns require prompt escalation;
  • concerns about senior individuals can be reported through alternative routes.

59. Related Al-Waris Foundation Policies

This policy should be read alongside:

  • Constitution;
  • Trustee Code of Conduct;
  • Trustee Terms of Reference;
  • Conflict of Interest Policy;
  • Complaints Policy;
  • Safeguarding Children Policy;
  • Safeguarding Adults at Risk Policy;
  • Serious Incident Reporting Policy;
  • Anti-Fraud, Bribery and Corruption Policy;
  • Sanctions and Terrorist Financing Policy;
  • Financial Controls and Reserves Policy;
  • Data Protection and UK GDPR Policy;
  • Information Security and Cybersecurity Policy;
  • Confidentiality Policy;
  • Overseas Operations and Partner Due Diligence Policy;
  • Fundraising Policy;
  • Records Retention and Disposal Policy.

60. Review

This policy will be reviewed:

  • at least annually;
  • following a significant whistleblowing case;
  • following an allegation of retaliation;
  • following a serious governance failure;
  • where an investigation identifies weaknesses in reporting arrangements;
  • following relevant changes in law or regulatory guidance.

61. Approval

Version: 2.0 Status: Approved Approved by: Board of Trustees Approval date: 25/08/2026 Next scheduled review: 24/08/2027

Essential cookies keep secure account and donation features working. With your permission, Google Analytics helps us understand how public pages are used. It is not loaded unless you accept.

Read our cookie information