A Law No. 14,457 of 2022 It introduced significant changes for companies in preventing and combating sexual harassment and other forms of workplace violence.
Among the planned measures is the need to establish procedures for receiving and tracking complaints, investigating the facts, and, where applicable, imposing administrative sanctions, with the whistleblower's anonymity guaranteed.
However, compliance with the law should not be interpreted merely as the creation of a form or an email address for receiving complaints.
A truly effective structure must involve governance, processes, responsibilities, investigation, evidence, training, and monitoring.
In this article, you’ll learn what Law 14.457/2022 stipulates regarding whistleblower hotlines, who is required to comply with these measures, what the main requirements are, and how to turn this obligation into a more mature integrity framework.
What is Law No. 14,457 of 2022?
A Law No. 14,457, of September 21, 2022, launched the “Emprega + Mulheres” Program and established various measures related to the integration, retention, and protection of women in the labor market.
Among its provisions, the legislation established specific measures to Preventing and Combating Sexual Harassment and Other Forms of Violence in the Workplace.
This topic is covered in Chapter VII of the law.
Article 23 stipulates that companies with Internal Commission for the Prevention of Accidents and Harassment (Cipa) adopt certain measures aimed at creating a healthy and safe work environment.
Among these measures is the establishment of procedures for receiving and following up on complaints.
Therefore, the Whistleblower Hotline should be viewed as part of a broader set of measures for prevention, guidance, investigation, and resolution.
What does Law 14,457/2022 say about the Whistleblower Hotline?
Article 23, subsection II, establishes the need to establish procedures for:
- Receipt of complaints;
- Follow-up on complaints;
- Fact-finding;
- Imposition of administrative sanctions, where applicable;
- Protection of the whistleblower's anonymity.
These procedures must be incorporated into the framework for preventing and combating sexual harassment and other forms of workplace violence.
This means it's not enough for the company to simply say:
“We have a channel for reporting concerns.”
The most important question is:
“What happens after a complaint is received?”
This is precisely where many organizations need to make progress.
Who is required to comply with the provisions of Law 14.457/2022?
Article 23 of Law 14,457/2022 establishes measures for companies with Internal Commission for the Prevention of Accidents and Harassment (Cipa).
Therefore, the analysis of applicability must take into account the organization’s specific situation and its obligations regarding the establishment of CIPA.
In addition, other laws, regulations, and best practices in governance and compliance may require or recommend whistleblower mechanisms, depending on the industry and the organization’s risk profile.
For this reason, the implementation of a Whistleblower Hotline should not be considered in isolation.
It is important to assess the full range of regulatory obligations applicable to the company.
What steps does the company need to take?
Law No. 14,457 of 2022 does not deal solely with whistleblower hotlines.
Article 23 sets forth a series of measures that are intended to function in an integrated manner.
1. Create rules of conduct
The company must include rules of conduct related to sexual harassment and other forms of violence in its internal policies.
It's not enough to just create the document.
The content also needs to be widely communicated to employees.
In practice, this means that the organization must ensure that people know:
- What behaviors are inappropriate;
- What are the internal rules;
- How to file a complaint;
- Where to seek guidance;
- How the organization handles complaints.
2. Establish procedures for receiving complaints
The company needs to establish a structured process for receiving reports.
This process should take into account factors such as:
- Channel used;
- Confidentiality;
- Anonymity;
- Information security;
- Incident report;
- Classification;
- Data controllers.
A channel without a defined process can lead to a problematic situation: the company receives a complaint but does not know exactly who should handle it or what steps should be taken.
3. Follow up on complaints
The process does not end with receipt.
The company needs to have mechanisms in place to track the progress of incidents.
This may involve:
- Status of the complaint;
- Person responsible for the analysis;
- Due date;
- Stage of the investigation;
- Evidence collected;
- Decisions made;
- Action plan;
- Closing.
This follow-up is essential to ensure that complaints are not overlooked or left unaddressed.
4. Establish the facts
A complaint does not automatically constitute confirmation of an irregularity.
It is necessary to assess the facts and, when appropriate, conduct a proper investigation.
The organization shall establish criteria for determining:
- When an investigation will be necessary;
- Who will be able to drive it;
- What evidence should be collected;
- How the information will be protected;
- How the findings will be documented.
A well-organized investigative framework helps reduce arbitrary decisions and improves the traceability of the process.
5. Take action when necessary
If the investigation confirms inappropriate conduct, the company may need to take administrative or corrective measures, depending on the circumstances and applicable rules.
In addition to potential individual liability, it is important to analyze whether the incident revealed a structural flaw in the organization.
For example:
If an investigation reveals that a particular process repeatedly allows for inappropriate behavior, perhaps the problem lies not only in one person's conduct.
There may be a failure in:
- Control;
- Process;
- Supervision;
- Training;
- Domestic policy;
- Governance.
Anonymity on the Whistleblower Channel
One of the most important provisions of Article 23 of Law 14,457/2022 is the guarantee of the anonymity of the person filing the complaint in accordance with the procedure established by law.
The goal is to create conditions that allow a person to report an incident of violence or harassment without fear of undue exposure.
However, anonymity does not mean a lack of criteria.
A well-structured system should enable the organization to receive sufficient information to analyze the case.
Therefore, it is recommended that the process allow the complainant to provide information such as:
- What happened;
- When did it happen?;
- Where did it happen?;
- Who was involved;
- Those who witnessed it;
- What documents or evidence are available;
- Other relevant information.
The more structured the report is, the greater the organization's capacity for analysis tends to be.
Does a reporting channel need to be anonymous?
This is a common question.
In the specific context of Article 23 of Law 14,457/2022, the law stipulates that the procedures established for receiving and following up on complaints must ensure the anonymity of the person filing the complaint.
In addition, companies can implement confidentiality and identity protection measures as part of their integrity programs.
It is important to distinguish between:
| Concept | Meaning |
|---|---|
| Anonymity | The identity of the complainant is not known in this case. |
| Confidentiality | Identity may be disclosed to authorized individuals, but it must be protected. |
| Protection Against Retaliation | It seeks to prevent undue consequences for those who file a report. |
These concepts must be taken into account when defining the organization's whistleblowing channel model.
Does Law 14,457/2022 also require training?
Yes.
Article 23 also provides for the conduct of, at least every 12 months, including training, guidance, and awareness-raising initiatives for employees at all levels of the organization.
Topics include:
- Violence;
- Harassment;
- Equality;
- Diversity in the workplace.
This illustrates an important point:
A Whistleblower Hotline should not exist in isolation.
He needs to be part of an organizational culture that encourages awareness of the rules and the reporting of inappropriate situations.
The Whistleblower Hotline Does Not Replace Legal Procedures
Law No. 14,457 of 2022 itself establishes that the receipt of complaints does not replace the corresponding criminal proceedings when the conduct reported constitutes a crime under Brazilian law.
This is important because the corporate Whistleblower Channel has a function to receipt, tracking, and internal verification.
It does not replace the competent authorities or the applicable legal procedures.
Therefore, situations that may constitute crimes must be properly assessed by the organization and, when necessary, referred to the appropriate authorities.
What happens when a company sets up a channel just to comply with the law?
That is one of the main risks.
The company can create a page called “Whistleblower Channel,” provide a form, and consider the matter closed.
But imagine that a complaint is received.
Who receives it?
Who does the analysis?
Who is investigating?
What is the deadline?
Where is the evidence?
Who approves the final report?
How is the whistleblower protected?
What measures are being taken?
How does the organization demonstrate that the case was handled?
If there are no clear answers to these questions, there is likely a significant opportunity for improvement in the compliance framework.
How can the requirements of Law 14.457/2022 be transformed into corporate maturity?
The law can be viewed merely as an obligation.
But mature companies can use this structure to strengthen their governance.
The process can follow a cycle:
Report → Screening → Investigation → Evidence → Conclusion → Corrective Action → Monitoring
And there's a second layer:
Incident → Risk Identification → Control Assessment → Action Plan → Indicator → Continuous Improvement
This integration is important because a complaint can reveal a problem that goes far beyond that specific case.
It may indicate a structural vulnerability.
How to Integrate a Whistleblower Channel, Compliance, and Risk Management?
Imagine that a company receives several complaints regarding the behavior of its managers.
The first step is to investigate each incident.
But the organization can also identify a trend.
This trend may indicate a risk related to culture, leadership, or the work environment.
The company can then:
- Record the risk;
- Assess its likelihood and impact;
- Identify existing controls;
- Assess the effectiveness of these controls;
- Create an action plan;
- Assign responsibilities;
- Set deadlines;
- Monitor indicators.
As a result, the Whistleblower Channel is no longer just a tool for receiving reports.
It now generates insights for management.
Compliance Checklist for Law 14.457/2022
Use this checklist as a starting point to evaluate your company's structure:
| Item | Status |
|---|---|
| Are there internal policies regarding harassment and violence? | ☐ |
| Are the rules communicated to employees? | ☐ |
| Is there a formal reporting channel in place? | ☐ |
| Does the channel guarantee anonymity where applicable? | ☐ |
| Is there a formal procedure for receiving items? | ☐ |
| Is there an investigation procedure? | ☐ |
| Have specific people been assigned to be in charge? | ☐ |
| As evidências são registradas e protegidas? | ☐ |
| As ocorrências possuem acompanhamento? | ☐ |
| Existem critérios para medidas administrativas? | ☐ |
| São realizados treinamentos periódicos? | ☐ |
| Os indicadores são acompanhados? | ☐ |
| As denúncias podem gerar planos de ação? | ☐ |
| Os riscos identificados são monitorados? | ☐ |
Como a tecnologia pode ajudar?
Um dos desafios da gestão de denúncias é garantir que todas as etapas sejam registradas e acompanhadas.
Quando o processo depende exclusivamente de e-mails, planilhas e documentos espalhados, aumenta a dificuldade de manter rastreabilidade e consolidar informações.
A GRC platform can centralize:
- Denúncias;
- Investigações;
- Documents;
- Evidence;
- Risks;
- Controls;
- Nonconformities;
- Action plans;
- Metrics;
- Executive dashboards.
Isso permite que a organização acompanhe o processo de ponta a ponta.
Como a Triskle ajuda sua empresa?
A Triskle GRC foi desenvolvida para ajudar organizações a centralizar processos de governança, riscos e compliance em um único ambiente.
Na gestão do Canal de Denúncias, a plataforma pode apoiar a organização na estruturação e acompanhamento de processos relacionados a:
- Registro de ocorrências;
- Gestão de denúncias;
- Controle de informações;
- Evidence management;
- Action plans;
- Risk management;
- Internal controls;
- Indicadores de compliance;
- Visão executiva.
O principal ganho está em conectar o que aconteceu com o que precisa ser feito para evitar que aconteça novamente.
Assim, a empresa pode transformar uma obrigação relacionada à Lei 14.457/2022 em uma oportunidade para fortalecer sua cultura de integridade e sua maturidade corporativa.
Perguntas frequentes sobre a Lei 14.457/2022 e Canal de Denúncias
O que a Lei 14.457/2022 determina sobre Canal de Denúncias?
A lei estabelece, para as empresas abrangidas pelo artigo 23, a adoção de procedimentos para recebimento e acompanhamento de denúncias, apuração dos fatos e, quando aplicável, aplicação de sanções administrativas, garantindo o anonimato da pessoa denunciante.
A Lei 14.457/2022 obriga todas as empresas a terem Canal de Denúncias?
O artigo 23 estabelece essas medidas para empresas com Comissão Interna de Prevenção de Acidentes e de Assédio (Cipa). A aplicabilidade deve ser analisada considerando a situação específica da organização e as demais normas que possam incidir sobre sua atividade.
A denúncia precisa ser anônima?
No contexto do procedimento previsto no artigo 23 da Lei 14.457/2022, a legislação determina a garantia do anonimato da pessoa denunciante.
A empresa precisa investigar todas as denúncias?
Cada ocorrência deve ser analisada de acordo com critérios definidos pela organização. Quando houver elementos que justifiquem apuração, a empresa deve possuir procedimento adequado para investigação dos fatos.
A Lei 14.457/2022 exige treinamento?
Sim. O artigo 23 estabelece ações de capacitação, orientação e sensibilização dos empregados e empregadas, de todos os níveis hierárquicos, no mínimo a cada 12 meses, sobre violência, assédio, igualdade e diversidade.
O Canal de Denúncias substitui uma investigação criminal?
Não. A própria Lei 14.457/2022 estabelece que o recebimento de denúncias não substitui o procedimento penal correspondente quando a conduta denunciada se enquadrar em crime previsto na legislação.
O que uma empresa deve fazer depois de receber uma denúncia?
A organização deve possuir procedimentos para registrar, acompanhar, analisar e, quando necessário, apurar a ocorrência, preservar informações e adotar as medidas cabíveis.
Como demonstrar que a empresa possui um processo estruturado?
Além de políticas e procedimentos, a empresa deve conseguir demonstrar registros, evidências, responsabilidades, treinamentos, investigações, medidas adotadas e acompanhamento dos resultados.
A Lei 14.457/2022 trouxe um importante avanço na estrutura de prevenção e combate ao assédio sexual e a outras formas de violência no ambiente de trabalho.
Mas cumprir a legislação não deve significar simplesmente “ter um Canal de Denúncias”.
Uma estrutura madura precisa garantir que o canal esteja conectado a processos de recebimento, acompanhamento, investigação, evidências, responsabilidades e ações corretivas.
Mais importante ainda: as informações geradas pelas denúncias podem revelar riscos que precisam ser tratados pela organização.
Por isso, o Canal de Denúncias pode deixar de ser visto apenas como uma obrigação regulatória e passar a funcionar como um importante mecanismo de governança, integridade, prevenção e gestão de riscos.
Compliance não é apenas cumprir uma regra. É criar mecanismos para identificar problemas, responder a eles e melhorar continuamente a organização.
Se sua empresa ainda gerencia denúncias, evidências e planos de ação de forma descentralizada, existe uma oportunidade para aumentar sua maturidade corporativa.
© 2026 Triskle GRC. Developed by
Portuguese 
English 
Spanish