Vigil Mechanism Under Section 177(9)

A vigil mechanism is what the Companies Act, 2013 calls a whistle-blower channel. Section 177(9) requires every listed company to establish one so that directors and employees can report genuine concerns, and section 177(10) fixes two features the mechanism must have: protection against victimisation, and a route straight to the audit committee chairperson.

Which companies must establish a vigil mechanism?

Section 177(9) puts the obligation on every listed company or such class or classes of companies as may be prescribed, to establish a vigil mechanism for directors and employees to report genuine concerns in such manner as may be prescribed.

There is a precision point worth holding on to here. Act 1 of 2018, section 57, with effect from 7 May 2018, substituted "every listed public company" for "every listed company" in section 177(1), the audit-committee sub-section. It did not make the same change to section 177(9). So the audit committee obligation and the vigil mechanism obligation, though they live in the same section, are worded differently, and anything that describes both as applying to "every listed public company" has flattened that difference.

The prescribed classes come from rule 7(1) of the Companies (Meetings of Board and its Powers) Rules, 2014. As originally notified, it named every listed company plus:

• companies which accept deposits from the public; and
• companies which have borrowed money from banks and public financial institutions in excess of fifty crore rupees.

On the rules cited here. The rule text on this page comes from the copy of the Companies (Meetings of Board and its Powers) Rules, 2014 that thc.nic.in serves, and it is a notification text rather than a consolidation. Its body is the principal notification, G.S.R. 240(E) dated 31 March 2014, published in the Gazette of India, Extraordinary, Part II, Section 3, Sub-section (i), and made under sections 173, 175, 177, 178, 179, 184 to 189 and 191 read with section 469 of the Act. Bundled after it is a separate, later notification, G.S.R. 811(E) dated 3 November 2025, the Companies (Meetings of Board and its Powers) Amendment Rules, 2025, which substitutes sub-rule (2) of rule 11 and nothing else. The footer note on that 2025 notification records the principal rules as last amended by G.S.R. 409(E) dated 15 June 2021. So the rule text in the body is the 2014 text as originally notified, the amendments made between 2014 and June 2021 are not incorporated in it, and a rule quoted from it is not by itself evidence of the rule in force today. Check the amending notifications before relying on any rule text here for a filing. The section text on this page is the Companies Act, 2013 as consolidated on India Code, with each amendment footnote resolved on its own page.

What must the mechanism provide?

Section 177(10) states two mandatory features:

1. Adequate safeguards against victimisation of persons who use the mechanism.
2. Direct access to the chairperson of the Audit Committee in appropriate or exceptional cases.

Both are drafted as attributes of the mechanism rather than as good practice, so a channel that routes every report through management and offers no direct line to the committee chairperson has not met the sub-section. That second limb also explains why the provision sits inside section 177 at all: the whistle-blower route terminates at the audit committee. Audit committee under section 177 covers the committee's composition, and its majority of independent directors is what makes the direct-access route meaningful.

Rule 7, as originally notified, adds the operating detail:

Sub-rule 7(5) is the one that gets left out of summaries. The mechanism's protection against victimisation and its exposure to a reprimand for repeated frivolous complaints sit in the same rule, and a company's policy has to give effect to both.

Where is the vigil mechanism disclosed?

The proviso to section 177(10) requires the details of establishment of the mechanism to be disclosed on the company's website, if any, and in the Board's report.

That is a disclosure of the mechanism, not of the reports made through it. Nothing in section 177(9) or 177(10) requires a company to publish the number of concerns raised or their outcomes, so a reader of the Board's report should expect to find the policy and the access route rather than a complaints tally. A listed company's corporate governance report is the other place to look, and how to read a corporate governance report covers what it sets out.

How the vigil mechanism relates to fraud reporting

The vigil mechanism is an internal channel that reports upward to the audit committee. It sits alongside, and does not replace, the statutory duty on an auditor under section 143(12) to report a suspected fraud, which runs to the Central Government or to the Board or audit committee depending on the amount. Auditor fraud reporting under section 143 covers that route. One is a channel the company must build for its own people; the other is a duty the law puts on the auditor.

Where this sits in the disclosure picture

• Audit committee under section 177 covers the committee that oversees the mechanism and whose chairperson must be directly reachable.
• Independent director under section 149 covers the category that must form the audit committee's majority.
• Auditor fraud reporting under section 143 covers the auditor's separate statutory reporting duty.
• The nomination and remuneration committee covers the other committee in section 178, and the penalty sub-section that reaches section 177.
• Stakeholders relationship committee covers the committee that handles security-holder grievances rather than internal concerns.
• How to read a corporate governance report covers where a listed company affirms audit committee access.

Flock reports the filings themselves, each stamped with its date and linked back to the exchange or regulator that published it. What any of it means for you is your call to make.