Ethics hotline and policy management is the part of a GRC platform that handles people's behaviour: the code of conduct, the policies staff must accept, the training on them, and a confidential channel to report wrongdoing. The channel is often called a whistle-blower hotline or a speak-up line.
A code of conduct is the company's written rulebook for behaviour. It covers bribes, gifts from suppliers, conflicts of interest, harassment and the misuse of company data. Policy management sends each policy to the right staff, asks each person to confirm that they have read it, and records the date. When a policy changes, it sends the new version and asks again.
The hotline lets an employee, or a supplier, report a problem without fear of punishment. The report can come by phone, through a web form or through an app, and the person can stay anonymous. In India, the Companies Act requires listed companies to set up such a channel. The Act calls it a vigil mechanism. SEBI's listing rules also require a whistle-blower policy.
Imagine a pharmaceutical company in Hyderabad. An employee in the purchase team notices that one packaging supplier always wins the order, though its price is 12% higher than the others. She suspects that her manager receives gifts from this supplier. She files an anonymous report through the web form. The system gives her a case number and a password. With these, she can read the investigator's questions and answer them later, without revealing her name. The case goes to the ethics committee, not to her manager. The system records each step of the investigation with its date. So the audit committee of the board can later check how the case was handled.
The same system tracks training on the code. Each year, every employee must complete a short course and a quiz. The list of current employees comes from the HR system. Courses on phishing and passwords belong to security awareness training instead.
All of this goes into the GRC platform. Each case becomes a finding with an owner and a deadline. Patterns across many cases show the board where the risks are. For example, many reports about gifts in one region point to a weak purchase control there.
Complaints of sexual harassment at work follow a separate route in India. They go to the company's Internal Committee, which the POSH Act requires.
The hotline is different from employee compliance monitoring. Monitoring software watches staff activity automatically. The hotline waits for a person to report what they have seen.