Foreword

A patient has the ASF Public Complaints & Feedback Policy. An accredited organization has the self-reporting protections of the ASF Sentinel Event Policy. Until this document, the one person with no protected way to raise a concern was someone inside ASF itself — a staff member, a Council member, or a surveyor who notices something genuinely wrong with how ASF is operating, not with an organization ASF accredits. That is precisely the gap ISO 37002, the international standard for whistleblowing management systems, exists to close [1].

1. Purpose and Scope

This policy governs how an ASF Council member, Revision Panel member, certified surveyor, or ASF staff member reports a genuine concern about ASF's own conduct, decisions, or operations — distinct from a concern about an accredited organization (ASF Public Complaints & Feedback Policy) or a patient safety event at one (ASF Sentinel Event Policy). This policy addresses wrongdoing inside ASF itself: a Code of Conduct violation, financial impropriety, a genuine safety risk in ASF's own operations, or an attempt to conceal any of these.

2. Why This Protection Has to Be Real: The Evidence

A whistleblower policy that exists only on paper is not a genuine protection. Analysis across documented whistleblower cases finds that a majority of individuals who report a genuine concern — an estimated fifty-seven to sixty-seven percent — face retaliation of some kind, most commonly harassment, occurring in twenty-seven to thirty-seven percent of documented cases, or unjust termination, occurring in twenty to thirty percent [2]. In a meaningful minority of documented cases, whistleblowers reported facing threats far more serious than professional consequences [2].

This is precisely why real legal systems treat whistleblower retaliation as a matter of serious consequence, not an internal HR question: protections under laws such as the False Claims Act and comparable whistleblower statutes explicitly prohibit an employer from firing, demoting, or harassing someone for reporting genuine wrongdoing, and hold employers who retaliate anyway liable for real remedies including reinstatement and back pay [3–4].

3. What Can Be Reported

• A violation of the ASF Code of Conduct by any individual covered by it, regardless of seniority
• Financial impropriety, consistent with the integrity the ASF Financial Sustainability & Liability Management Policy requires
• A genuine attempt to influence an accreditation decision in violation of the ASF Independence & Non-Influence Statement
• A cover-up or suppression of a nonconformity that should have been reported under the ASF Internal Nonconformity & Corrective Action Procedure
• Any other genuine wrongdoing connected to ASF's own operations, not already governed by a more specific ASF process

4. How to Report

A report is submitted to ASF's designated whistleblower contact — a Council member with no involvement in the matter being reported. Where the concern involves the whistleblower contact themselves, or the Council as a whole, the report is submitted instead to an independent party outside ASF's own structure, consistent with ISO 37002's requirement that a reporting channel remain genuinely accessible even when the concern reaches the top of the organization [1].

A report may be made using the individual's name, or anonymously where the reporting channel used genuinely permits it. An anonymous report is investigated with the same seriousness as a named one, though an anonymous reporter cannot receive the specific follow-up protections available to someone whose identity ASF knows.

5. Protection Against Retaliation

No individual who reports a genuine concern in good faith under this policy is demoted, dismissed, excluded from future ASF activity, or otherwise disadvantaged for having done so — regardless of whether the report is ultimately substantiated. Good faith, not correctness, is the standard: a report that turns out to be mistaken, made honestly, is protected exactly as a report that turns out to be right.

This protection does not extend to a report made maliciously, or one the reporter knew to be false at the time it was made — the same good-faith distinction already drawn in the ASF Sentinel Event Policy's own self-reporting protections.

6. Confidentiality

A named reporter's identity is disclosed only to those genuinely necessary to investigate the report, and never to the individual the report concerns, except where the investigation process itself cannot proceed fairly without that disclosure — in which case the reporter is told this in advance, before the disclosure happens, not after.

7. Investigation

A report under this policy is investigated by the designated whistleblower contact, or the independent party under Section 4 where applicable, following the same root-cause and evidence-based discipline as the ASF Internal Nonconformity & Corrective Action Procedure. Where the investigation substantiates the concern, it is addressed through that same procedure, through the Code of Conduct's own enforcement provisions, or both. The reporter is told the outcome, at a level of detail consistent with the confidentiality owed to any other party involved.

References

1. International Organization for Standardization. ISO 37002:2021, Whistleblowing Management Systems — Guidelines. Geneva: ISO; 2021.
2. Insights for an AI Whistleblower Office from 30 Case Studies. Retaliation rates, forms, and reporter motivation among documented whistleblower cases. 2026.
3. National Law Review. Healthcare Whistleblower Retaliation FAQs — What Employees Need to Know. 2026.
4. American Institute of Healthcare Compliance. Whistleblower Protections in Healthcare Compliance. 2025.

Annex A — Whistleblower Report Record

☐ Named report

☐ Anonymous report

Date received: ______________________________

Nature of concern (Section 3): _____________________________________________

☐ Confirmed: designated contact has no involvement in the matter reported

Investigation

_______________________________________________________________________

Outcome

☐ Substantiated — referred to Nonconformity & Corrective Action Procedure

☐ Substantiated — referred to Code of Conduct enforcement

☐ Not substantiated

Reporter notified of outcome (date, if named report): ______________________________

Index

Anonymous Reporting, 4

Confidentiality, 6

False Claims Act (comparative), 2

Good Faith Standard, 5

Independent Party (Council conflict), 4

Retaliation (real statistics), 2, 5

Whistleblower Contact, 4

The most informed report ASF will ever receive about its own failures is likely to come from inside ASF. This policy exists so that report actually gets made — and so it survives contact with the real, documented risk that comes with making it.