Who must have one
Section 177(9) applies to every listed company and to the classes of companies the Rules prescribe. Rule 7 of the Companies (Meetings of Board and its Powers) Rules, 2014 names two: companies that accept deposits from the public, and companies that have borrowed more than fifty crore rupees from banks and public financial institutions.
What it must do
- Let directors and employees report genuine concerns.
- Give adequate safeguards against victimisation of the people who use it (section 177(10)).
- Give direct access to the chairperson of the audit committee in appropriate or exceptional cases (section 177(10)).
Who oversees it (Rule 7)
A company that must have an audit committee oversees the vigil mechanism through that committee. A company that doesn't have one has its board nominate a director to play the audit committee's part, and concerns can be reported to that director. If a member of the committee has a conflict of interest in a case, they step away from it.
What to disclose
The company discloses that the vigil mechanism exists, and how it works, on its website if it has one and in the Board's report (proviso to section 177(10)).
Repeated frivolous complaints
Rule 7 lets the audit committee, or the nominated director, take suitable action, including a reprimand, against a director or employee who repeatedly makes frivolous complaints. That is about repeated bad faith, not about a concern that turned out to be wrong.
In practice
- A written policy that names the channels, who receives reports, and how the chair of the audit committee can be reached directly.
- A channel where people can report safely, including without giving their name.
- A rule that nobody named in a report sees it or decides on it.
- Records that show the safeguards worked: who saw what, when, and what was done.
- The policy on the website and the mechanism described in the Board's report.
This guide explains the law in plain words. It isn't legal advice: check your own facts with your lawyer.