Back to Details

whistleblower-compliance

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese
⚠️ EXPERIMENTAL — This skill is provided for educational and informational purposes only. It does NOT constitute legal advice. All responsibility for usage rests with the user. Consult qualified legal professionals before acting on any output.
⚠️ EXPERIMENTAL — 本技能仅用于教育和信息目的，不构成法律建议。使用责任完全由用户承担。根据输出采取行动前，请咨询合格的法律专业人士。

Whistleblower Compliance Skill

举报人合规技能

Overview

概述

Production-ready whistleblower compliance toolkit for auditing existing reporting systems and drafting compliant policies. Covers EU Directive 2019/1937, US SOX Section 806, US Dodd-Frank, and UK Public Interest Disclosure Act 1998. Operates in two modes: Mode A (Assessment) runs an 8-phase, 56-checkpoint audit of existing systems; Mode B (Drafting) generates jurisdiction-specific reporting policies.
可投入生产的举报人合规工具包，用于审计现有举报系统并起草合规政策。涵盖欧盟2019/1937号指令、美国SOX法案第806条、美国多德-弗兰克法案以及英国1998年公共利益披露法。支持两种模式：模式A（评估）对现有系统进行8阶段、56个检查点的审计；模式B（起草）生成特定司法管辖区的举报政策。

Table of Contents

目录

Tools

工具

1. Compliance Checker (
scripts/whistleblower_compliance_checker.py
)

1. 合规检查器 (
scripts/whistleblower_compliance_checker.py
)

Assess an existing whistleblower system against regulatory requirements. Takes organizational parameters and outputs a compliance score with priority-classified gaps.
bash
python scripts/whistleblower_compliance_checker.py \
  --jurisdiction EU --headcount 300 --sector financial \
  --channels internal,external --has-designated-person \
  --has-confidentiality --has-gdpr-measures --has-dissemination

python scripts/whistleblower_compliance_checker.py \
  --jurisdiction US --headcount 5000 --sector healthcare \
  --channels internal --json

python scripts/whistleblower_compliance_checker.py \
  --jurisdiction UK --headcount 50 --sector technology \
  --channels none
根据监管要求评估现有举报人系统。接收组织参数，输出带有优先级分类缺口的合规评分。
bash
python scripts/whistleblower_compliance_checker.py \
  --jurisdiction EU --headcount 300 --sector financial \
  --channels internal,external --has-designated-person \
  --has-confidentiality --has-gdpr-measures --has-dissemination

python scripts/whistleblower_compliance_checker.py \
  --jurisdiction US --headcount 5000 --sector healthcare \
  --channels internal --json

python scripts/whistleblower_compliance_checker.py \
  --jurisdiction UK --headcount 50 --sector technology \
  --channels none

2. Policy Scaffolder (
scripts/whistleblower_policy_scaffolder.py
)

2. 政策框架生成器 (
scripts/whistleblower_policy_scaffolder.py
)

Generate a whistleblower policy skeleton pre-populated with required sections per regulatory framework.
bash
python scripts/whistleblower_policy_scaffolder.py \
  --jurisdiction EU --org-type private --headcount 500 \
  --org-name "Acme Corp"

python scripts/whistleblower_policy_scaffolder.py \
  --jurisdiction US --org-type public --headcount 10000 \
  --org-name "MegaCorp Inc" --json

python scripts/whistleblower_policy_scaffolder.py \
  --jurisdiction UK --org-type nonprofit --headcount 100 \
  --org-name "CharityOrg" --output policy-draft.md
生成举报人政策框架，预先填充各监管框架要求的章节。
bash
python scripts/whistleblower_policy_scaffolder.py \
  --jurisdiction EU --org-type private --headcount 500 \
  --org-name "Acme Corp"

python scripts/whistleblower_policy_scaffolder.py \
  --jurisdiction US --org-type public --headcount 10000 \
  --org-name "MegaCorp Inc" --json

python scripts/whistleblower_policy_scaffolder.py \
  --jurisdiction UK --org-type nonprofit --headcount 100 \
  --org-name "CharityOrg" --output policy-draft.md

Reference Guides

参考指南

ReferencePurpose
references/regulatory_framework.md
Multi-jurisdiction whistleblower regulations, comparison matrix
references/assessment_checklist.md
8-phase, 56-checkpoint assessment with priority classifications
参考文档用途
references/regulatory_framework.md
多司法管辖区举报人法规及对比矩阵
references/assessment_checklist.md
8阶段、56个检查点的评估及优先级分类

Workflows

工作流程

Mode A: Assessment Workflow

模式A：评估工作流程

  1. Gather Parameters -- Collect jurisdiction, headcount, sector, and system description
  2. Run Compliance Checker -- Execute 
    whistleblower_compliance_checker.py
    with parameters
  3. Review Gaps -- Prioritize CRITICAL gaps first, then IMPORTANT, then IMPROVEMENT
  4. Cross-Reference Checklist -- Walk through 
    assessment_checklist.md
    for manual verification
  5. Generate Remediation Plan -- Address gaps by priority, set deadlines per regulatory timelines
  1. 收集参数 — 收集司法管辖区、员工人数、行业及系统描述
  2. 运行合规检查器 — 使用参数执行
    whistleblower_compliance_checker.py
  3. 审查缺口 — 优先处理CRITICAL（严重）缺口，其次是IMPORTANT（重要），最后是IMPROVEMENT（优化）
  4. 交叉参考检查清单 — 对照
    assessment_checklist.md
    进行手动验证
  5. 生成整改计划 — 按优先级处理缺口，根据监管时间线设定截止日期

Mode B: Drafting Workflow

模式B：起草工作流程

  1. Determine Jurisdiction -- Identify applicable regulations based on headquarters and operations
  2. Generate Scaffold -- Run 
    whistleblower_policy_scaffolder.py
    with organization details
  3. Customize Sections -- Replace placeholders with organization-specific information
  4. Legal Review -- Route draft through legal counsel for jurisdiction-specific validation
  5. Approval & Publication -- Obtain board/management approval and disseminate to all personnel
  1. 确定司法管辖区 — 根据总部及运营地点确定适用法规
  2. 生成框架 — 使用组织详情运行
    whistleblower_policy_scaffolder.py
  3. 自定义章节 — 用组织特定信息替换占位符
  4. 法律审查 — 将草案提交法律顾问进行特定司法管辖区的验证
  5. 批准与发布 — 获得董事会/管理层批准并向所有员工发布

8-Phase Assessment Framework

8阶段评估框架

PhaseFocusCheckpoints
1. ApplicabilityRegulatory scope determination3
2. Reception ChannelReporting channel adequacy5
3. Designated PersonsPersonnel and independence7
4. Verification/ProcessingInvestigation procedures8
5. ConfidentialityIdentity and data protection9
6. Dissemination/InformationAwareness and accessibility10
7. Data Protection/GDPRPrivacy compliance12
8. Sector-SpecificIndustry requirements6
Total60
阶段重点检查点数量
1. 适用性确定监管范围3
2. 接收渠道举报渠道充分性5
3. 指定人员人员配置与独立性7
4. 核实/处理调查流程8
5. 保密性身份与数据保护9
6. 传播/信息认知度与可访问性10
7. 数据保护/GDPR隐私合规12
8. 特定行业行业要求6
总计60

Three Reporting Channels

三种举报渠道

ChannelWhen UsedKey Requirements
InternalFirst preference; report to organizationAcknowledge within 7 days; feedback within 3 months
External (Regulatory)When internal fails or is inappropriateReport to competent authority; same protections apply
Public DisclosureLast resort; imminent danger or retaliationProtected only if internal/external channels exhausted
渠道使用场景核心要求
内部渠道首选；向组织举报7天内确认收到；3个月内反馈
外部（监管）渠道内部渠道失效或不适用时向主管部门举报；适用相同保护措施
公开披露最后手段；存在紧急危险或报复风险仅在内部/外部渠道均已用尽时受保护

Whistleblower Protections

举报人保护措施

ProtectionDescription
Civil immunityNo liability for breach of confidentiality obligations
Criminal immunityNo criminal liability for acquiring reported information
Prohibited retaliationDismissal, demotion, harassment, blacklisting, discrimination
Burden of proof reversalEmployer must prove action was not retaliatory
Interim reliefProvisional protection during investigation
Legal aid accessAccess to legal counsel and support
保护措施说明
民事豁免权不因违反保密义务承担责任
刑事豁免权不因获取举报信息承担刑事责任
禁止报复禁止解雇、降职、骚扰、列入黑名单、歧视等行为
举证责任倒置雇主必须证明其行为并非报复性的
临时救济调查期间提供临时保护
法律援助获得法律顾问及支持的权利

Priority Classification

优先级分类

PriorityDefinitionExample
CRITICALLegal non-compliance; immediate regulatory riskNo reporting channel exists; no confidentiality measures
IMPORTANTSignificant gap reducing system effectivenessAcknowledgment timeline exceeds 7 days; no designated person
IMPROVEMENTEnhancement opportunity; not currently non-compliantTraining frequency below best practice; limited channel types
优先级定义示例
CRITICAL（严重）不符合法律规定；存在即时监管风险无举报渠道；无保密措施
IMPORTANT（重要）显著缺口降低系统有效性确认时间超过7天；无指定人员
IMPROVEMENT（优化）提升机会；目前不违反合规要求培训频率低于最佳实践；渠道类型有限

Troubleshooting

故障排除

ProblemCauseSolution
Checker reports all CRITICALNo system parameters providedProvide accurate 
--channels
, 
--has-designated-person
, and other flags
Wrong jurisdiction requirementsMulti-jurisdiction entity using single jurisdictionRun checker separately per jurisdiction; use strictest requirements
Policy scaffold missing sectionsJurisdiction flag incorrectVerify 
--jurisdiction
matches EU, US, or UK
Headcount threshold confusionEU directive has different thresholds by entity typePrivate sector: 50+ employees; public sector: all municipalities
Sector-specific gaps not flaggedGeneric sector value usedUse specific sector: 
financial
, 
healthcare
, 
defense
, 
nuclear
GDPR checks fail for US entityUS entities may still need GDPR complianceIf processing EU citizen data, add 
--has-gdpr-measures
Timeline requirements unclearDifferent jurisdictions have different timelinesEU: 7-day ack, 3-month feedback; SOX: 180-day filing deadline
Policy output too genericMinimal parameters providedAdd 
--org-name
, 
--org-type
, and 
--headcount
for specificity
问题原因解决方案
检查器报告所有缺口为CRITICAL未提供系统参数提供准确的
--channels
、
--has-designated-person
及其他标志
适用错误的司法管辖区要求多司法管辖区实体使用单一司法管辖区参数针对每个司法管辖区单独运行检查器；采用最严格的要求
政策框架缺失章节司法管辖区标志错误确认
--jurisdiction
为EU、US或UK
员工人数阈值混淆欧盟指令针对不同实体类型有不同阈值私营部门：50名以上员工；公共部门：所有市政机构
未标记特定行业缺口使用了通用行业值使用特定行业：
financial
、
healthcare
、
defense
、
nuclear
美国实体的GDPR检查失败美国实体可能仍需符合GDPR要求若处理欧盟公民数据，添加
--has-gdpr-measures
标志
时间线要求不明确不同司法管辖区有不同时间线欧盟：7天确认，3个月反馈；SOX：180天申报截止日期
政策输出过于通用提供的参数极少添加
--org-name
、
--org-type
和
--headcount
以提高针对性

Success Criteria

成功标准

  • Compliance Coverage: Assessment covers 100% of applicable regulatory requirements for specified jurisdiction
  • Gap Identification: All CRITICAL and IMPORTANT gaps identified with clear remediation guidance
  • Policy Completeness: Generated policies include all mandatory sections per applicable regulation
  • Timeline Compliance: Policies reflect correct acknowledgment (7 days) and feedback (3 months) timelines
  • Audit Readiness: Assessment output sufficient for regulatory audit preparation and evidence gathering
  • 合规覆盖范围：评估涵盖指定司法管辖区的所有适用监管要求
  • 缺口识别：识别所有CRITICAL和IMPORTANT缺口，并提供明确的整改指导
  • 政策完整性：生成的政策包含适用法规要求的所有强制性章节
  • 时间线合规：政策反映正确的确认（7天）和反馈（3个月）时间线
  • 审计就绪：评估输出足以支持监管审计准备和证据收集

Scope & Limitations

范围与限制

This skill covers:
  • Compliance assessment against EU Directive 2019/1937, US SOX/Dodd-Frank, UK PIDA
  • Policy scaffolding with jurisdiction-specific mandatory sections
  • Gap analysis with priority classification and remediation guidance
  • Multi-sector considerations (financial, healthcare, defense, nuclear, transport)
This skill does NOT cover:
  • Actual whistleblower case management or investigation procedures
  • Legal advice or attorney-client privileged analysis
  • Real-time regulatory monitoring or automatic updates when laws change
  • Whistleblower hotline software implementation or vendor selection
  • Cross-border reporting coordination between multiple regulators
本技能涵盖：
  • 针对欧盟2019/1937号指令、美国SOX/多德-弗兰克法案、英国PIDA的合规评估
  • 带有特定司法管辖区强制性章节的政策框架生成
  • 带有优先级分类和整改指导的缺口分析
  • 多行业考量（金融、医疗、国防、核能、交通）
本技能不涵盖：
  • 实际举报人案件管理或调查流程
  • 法律建议或律师-客户特权分析
  • 实时监管监控或法律变更时的自动更新
  • 举报热线软件实施或供应商选择
  • 多个监管机构之间的跨境举报协调

Anti-Patterns

反模式

Anti-PatternWhy It FailsBetter Approach
Copy-pasting policy from another jurisdictionRegulations differ materially; EU requires 7-day ack, SOX has 180-day filingRun scaffolder with correct jurisdiction; customize per local requirements
Treating all gaps as equal priorityWastes resources on improvements while CRITICAL gaps remainAddress CRITICAL first, IMPORTANT second, IMPROVEMENT last
Single assessment for multi-jurisdiction orgEach jurisdiction has unique requirements and thresholdsRun separate assessments per jurisdiction; merge into unified policy
Skipping sector-specific phaseRegulated sectors (financial, healthcare) have additional requirementsAlways complete Phase 8 for regulated industries
No periodic reassessmentRegulations evolve; transposition deadlines passSchedule annual reassessment; monitor legislative changes
反模式失败原因更佳方案
复制粘贴其他司法管辖区的政策法规存在实质性差异；欧盟要求7天确认，SOX有180天申报截止日期使用正确的司法管辖区运行框架生成器；根据当地要求自定义
将所有缺口视为同等优先级在CRITICAL缺口仍存在时浪费资源在优化项上先处理CRITICAL，再处理IMPORTANT，最后处理IMPROVEMENT
对多司法管辖区组织进行单一评估每个司法管辖区有独特的要求和阈值针对每个司法管辖区单独运行评估；合并为统一政策
跳过特定行业阶段受监管行业（金融、医疗）有额外要求对于受监管行业，始终完成第8阶段
不进行定期重新评估法规不断演变；转换截止日期已过安排年度重新评估；监控立法变化

Tool Reference

工具参考

scripts/whistleblower_compliance_checker.py

scripts/whistleblower_compliance_checker.py

Assess whistleblower system compliance against regulatory requirements.
usage: whistleblower_compliance_checker.py [-h] [--json]
                                           --jurisdiction {EU,US,UK}
                                           --headcount HEADCOUNT
                                           --sector SECTOR
                                           [--channels CHANNELS]
                                           [--has-designated-person]
                                           [--has-confidentiality]
                                           [--has-gdpr-measures]
                                           [--has-dissemination]
                                           [--has-acknowledgment-timeline]
                                           [--has-feedback-timeline]

options:
  -h, --help            Show help message and exit
  --json                Output in JSON format
  --jurisdiction        Regulatory jurisdiction: EU, US, or UK
  --headcount           Number of employees in the organization
  --sector              Industry sector (financial, healthcare, technology, etc.)
  --channels            Comma-separated channel types: internal, external, none
  --has-designated-person  Designated person(s) appointed for handling reports
  --has-confidentiality    Confidentiality measures in place
  --has-gdpr-measures      GDPR/data protection measures implemented
  --has-dissemination      Policy disseminated to all personnel
  --has-acknowledgment-timeline  7-day acknowledgment timeline met
  --has-feedback-timeline  3-month feedback timeline met
根据监管要求评估举报人系统合规性。
usage: whistleblower_compliance_checker.py [-h] [--json]
                                           --jurisdiction {EU,US,UK}
                                           --headcount HEADCOUNT
                                           --sector SECTOR
                                           [--channels CHANNELS]
                                           [--has-designated-person]
                                           [--has-confidentiality]
                                           [--has-gdpr-measures]
                                           [--has-dissemination]
                                           [--has-acknowledgment-timeline]
                                           [--has-feedback-timeline]

options:
  -h, --help            Show help message and exit
  --json                Output in JSON format
  --jurisdiction        Regulatory jurisdiction: EU, US, or UK
  --headcount           Number of employees in the organization
  --sector              Industry sector (financial, healthcare, technology, etc.)
  --channels            Comma-separated channel types: internal, external, none
  --has-designated-person  Designated person(s) appointed for handling reports
  --has-confidentiality    Confidentiality measures in place
  --has-gdpr-measures      GDPR/data protection measures implemented
  --has-dissemination      Policy disseminated to all personnel
  --has-acknowledgment-timeline  7-day acknowledgment timeline met
  --has-feedback-timeline  3-month feedback timeline met

scripts/whistleblower_policy_scaffolder.py

scripts/whistleblower_policy_scaffolder.py

Generate jurisdiction-specific whistleblower policy skeleton.
usage: whistleblower_policy_scaffolder.py [-h] [--json]
                                          --jurisdiction {EU,US,UK}
                                          --org-type {public,private,nonprofit}
                                          --headcount HEADCOUNT
                                          [--org-name ORG_NAME]
                                          [--output OUTPUT]

options:
  -h, --help            Show help message and exit
  --json                Output in JSON format
  --jurisdiction        Regulatory jurisdiction: EU, US, or UK
  --org-type            Organization type
  --headcount           Number of employees
  --org-name            Organization name (used in policy template)
  --output              Write policy to file instead of stdout
生成特定司法管辖区的举报人政策框架。
usage: whistleblower_policy_scaffolder.py [-h] [--json]
                                          --jurisdiction {EU,US,UK}
                                          --org-type {public,private,nonprofit}
                                          --headcount HEADCOUNT
                                          [--org-name ORG_NAME]
                                          [--output OUTPUT]

options:
  -h, --help            Show help message and exit
  --json                Output in JSON format
  --jurisdiction        Regulatory jurisdiction: EU, US, or UK
  --org-type            Organization type
  --headcount           Number of employees
  --org-name            Organization name (used in policy template)
  --output              Write policy to file instead of stdout