Vigil Mechanism: Does It Actually Reach the Audit Committee?

Section 177 requires listed companies, public-deposit companies, and companies with qualifying bank or financial-institution borrowings to establish a vigil mechanism for directors and employees to report genuine concerns. The mechanism must include safeguards against victimisation and, in appropriate or exceptional cases, provide direct access to the Chairperson of the Audit Committee.

A policy and reporting email address are not enough. The real test is whether a genuine concern can be raised safely, confidentially, and without being filtered through the management layer against which the concern may be directed.

The Audit Committee should periodically test reporting channels, direct-access arrangements, confidentiality controls, retaliation safeguards, investigation protocols, documentation, and closure practices. It should receive periodic reporting that helps it identify repeated allegations, delayed investigations, unresolved issues, and patterns by business unit or seniority.

Not every complaint requires a forensic investigation, but every complaint should be logged and assessed under an objective protocol. A functioning vigil mechanism is both a legal requirement and an early-warning system for fraud, financial-reporting, conduct, and governance risk.