Reporting wrongdoing at work: a log of your report and what followed

If you have raised a concern about misconduct inside your organization, keep a dated log with three parts: the report itself (what you raised, to whom, how and when), every response you received, and any later changes to your work, each written as a plain fact with a date. Keep copies of your own report and the replies, and describe other documents by title and date instead of copying them.

The log should not take confidential or personal data out of the organization, and it should not try to prove the underlying wrongdoing. Its job is to show clearly what you raised and what happened afterwards, so that a lawyer, union representative or other qualified reviewer can understand the sequence quickly.

People who raise concerns often try to build a file on the misconduct itself, collecting everything that seems to show it. That is usually the investigator's job, not yours, and it is where most people get into trouble by copying data they were not entitled to keep. A response log has a narrower purpose: it records your own actions and what was done in response.

Keep a short factual summary of the concern as you understood it on the date you raised it, in your own words. Then put your energy into the timeline of the report and its aftermath, which only you can record fully.

• Do not copy customer, patient, student or employee personal information to personal devices or accounts.
• Do not forward internal reports, financial data, contracts or source code to personal email, even if they seem central to the concern.
• Do not access systems, folders or mailboxes beyond what your role normally allows, to look for more information.
• Do describe relevant documents in your log by title, date, author's role and where they are stored, so they can be requested through proper channels.
• Do keep copies of your own report, your own messages and replies addressed to you, if workplace rules allow.
• Do read your organization's reporting or speak-up policy and note which channel it describes and what it says about confidentiality.

Whether a particular document may be shared, and with whom, depends on the law, your contract and your organization's policies. If you believe a document matters, list it and raise the question with a qualified reviewer before doing anything with it.

1. Write the date and time you made the report, with your time zone.
2. Name the channel: a meeting with your manager, an email to compliance, an ethics hotline, a web form, a union representative.
3. Identify the recipient by role, and anyone else copied or present.
4. Summarize what you reported in a few neutral sentences, as you said it at the time.
5. List what, if anything, you attached or referred to, by title and date.
6. Record any reference or case number, and save the confirmation screen or email.
7. Note what you were told about confidentiality, next steps and timing.
8. Write the note the same day and do not edit it later; add any corrections as dated additions.

If you raised the concern verbally first, write that conversation as its own entry, then record any written follow-up separately. Many reports start as a hallway conversation and only become formal weeks later; both dates can matter.

After a report, two streams of events tend to run in parallel. One is the formal process: acknowledgement, an interview, requests for information, updates, an outcome. The other is your everyday work, which may continue unchanged or may shift. Record both, each with its date.

• Acknowledgements, interview invitations and any notes you were given from interviews.
• Questions you asked about the process and the answers.
• Outcome or closure messages, and what they said about follow-up.
• Changes to your schedule, duties, reporting line, location, access or pay, with the date you learned of each.
• Performance feedback, warnings or reviews, including positive ones, so the record is balanced.
• Meetings you were removed from or newly added to, as observed facts.

When you follow up on your report, do it in writing and log it the same way: the date, who you asked by role, the question, and whether and when an answer came. A polite follow-up such as asking whether the review is still open, or whether anything more is needed from you, is easy to read later and shows that you stayed engaged with the process. If you are told something important in a phone call or corridor conversation, write a short dated note right afterwards, and consider confirming the key point by email.

• 2026-01-12, 10:15 ET. Raised concern verbally with my director in a one-on-one about invoices approved without the second sign-off described in the purchasing policy. Director said they would look into it.
• 2026-01-19, 16:40 ET. Sent email to the compliance mailbox summarizing the same concern. Referred to purchasing policy version 3 and to invoice batch dated December 2025 by title only, no attachments. Auto-reply received with reference number (R-031).
• 2026-02-02, 13:00 ET. Interview by video with an internal investigator and an HR advisor, 45 minutes. Told the matter is confidential and I would receive an update when the review ends. My notes R-032, written 14:10 ET.
• 2026-02-16. Informed by email that my quarterly vendor review duties move to another team member from March 1 (R-033). No reason stated in the email.
• 2026-03-20. Email from compliance: review completed and closed; no further details provided (R-034).

Notice what these entries leave out. They do not say the duties were moved because of the report, and they do not describe anyone's motives. They place events in order and let the dates speak. Whether a later change is connected to the report is a question for a qualified reviewer.

Protections for people who report wrongdoing depend on who employs you and what the concern is about. In Canada, the Government of Canada publishes an overview of the Public Servants Disclosure Protection Act, which applies to the federal public sector and describes disclosure to a supervisor, a senior officer for disclosure, or the Public Sector Integrity Commissioner. Provincial, territorial and private-sector employees are covered by different rules, if any.

In the United States, the Department of Labor's employment law guide on whistleblower and retaliation protections explains that OSHA enforces the whistleblower provisions of a range of federal laws, and that coverage and filing deadlines differ by statute. States have their own laws as well. Because time limits can be short and vary, people often find it useful to speak with a qualified reviewer early, with the log in hand.

• Which reporting channel did my organization's policy describe, and did I use it?
• Which documents am I allowed to keep, and how can the others be requested?
• Do any whistleblower or anti-retaliation rules apply to my employer or to this type of concern?
• Are there time limits I should know about, given the dates in my log?
• How should I respond if I am asked to sign a confidentiality or separation document?

Should I keep the log on a work computer? A personal device you control is generally safer for your own notes, since work access can end suddenly. Keep company data off it; the log should contain your account of events, not copies of internal files.

I reported anonymously. Can I still keep a log? Yes. Record the date, channel and any reference number, and keep it private. Note that anonymity can affect how a report is handled, which is worth asking about.

What if nothing seems to have happened after my report? Record that too, with dates: when you last heard, and any follow-up question you sent. A gap in responses is part of the sequence.

Can coworkers who saw the same thing add to my log? Keep your log to your own observations. If others raise concerns, they can keep their own records. Note coworkers only by role, and only where they were present for an event you describe.

A sensitive log benefits from being private and hard to alter quietly. SteadyFile is a recordkeeping tool you can open in your browser at app.steadyfile.com, on a personal phone or computer, with no account needed to start. Each report, interview and later change becomes a dated entry with people listed by role and records referenced by ID, like the R-numbers above. Documents you chose not to copy can still be listed in the records index by title and date, and open questions go on the gaps list. With an account, entries keep their creation time and visible edit history. You can export a chronological packet for a reviewer. Your employer has no access to it, and SteadyFile organizes your record without judging the concern.