A whistleblowing policy should explain who can report and about what, how to use the reporting channel, how anonymity and confidentiality are protected, who receives and assesses cases, and what feedback the whistleblower can expect.