The Whistleblowing Response Playbook: 7 Scenarios & a 120-Day Clock

A concern reaches a manager before it reaches compliance. What that manager does next decides whether the case gets handled, escalated and documented — or quietly absorbed.

This playbook covers seven situations compliance teams meet again and again. For each one, it gives the response tier, the first actions, the signals that mean escalate now, the mistake most organizations make and a question to put to leadership.

It opens with the deadline most teams don’t know is running: 120 days from an internal report to self-disclose to the DOJ. Fourteen pages, for the compliance lead who owns the outcome but isn’t in the room for the first conversation.

What’s inside:

• Seven scenarios, from harassment and policy bypassing to retaliation, conflicts of interest and data privacy, each with first actions and escalation triggers.
• The two 120-day windows that decide how much time you actually have and which one applies to your case.
• How to separate a Tier 1 concern from a Tier 2 one, using the triage criteria in ISO 37002.
• What retaliation looks like when it isn’t a termination and why most teams miss it.
• The six signs a reporting system is quietly weakening, starting with the one that looks like good news.