Whistleblower Compliance

#!/usr/bin/env python3
"""
Whistleblower Compliance Checker

Assesses an existing whistleblower system against regulatory requirements
for EU Directive 2019/1937, US SOX/Dodd-Frank, and UK PIDA.

Usage:
    python whistleblower_compliance_checker.py --jurisdiction EU --headcount 300 --sector financial
    python whistleblower_compliance_checker.py --jurisdiction US --headcount 5000 --sector healthcare --json
    python whistleblower_compliance_checker.py --jurisdiction UK --headcount 50 --sector technology --channels internal,external
"""

import argparse
import json
import sys
from datetime import datetime
from typing import Any, Dict, List, Optional, Tuple


# Priority levels
CRITICAL = "CRITICAL"
IMPORTANT = "IMPORTANT"
IMPROVEMENT = "IMPROVEMENT"


# Jurisdiction-specific requirements
REQUIREMENTS: Dict[str, Dict[str, Any]] = {
    "EU": {
        "name": "EU Directive 2019/1937",
        "headcount_threshold": 50,
        "public_sector_all": True,
        "acknowledgment_days": 7,
        "feedback_months": 3,
        "requires_internal_channel": True,
        "requires_confidentiality": True,
        "requires_gdpr": True,
        "requires_designated_person": True,
        "requires_dissemination": True,
        "regulated_sectors": ["financial", "transport", "nuclear", "defense", "healthcare",
                              "environment", "food_safety", "public_procurement"],
    },
    "US": {
        "name": "SOX Section 806 / Dodd-Frank",
        "headcount_threshold": 0,
        "public_sector_all": False,
        "acknowledgment_days": None,
        "feedback_months": None,
        "requires_internal_channel": True,
        "requires_confidentiality": True,
        "requires_gdpr": False,
        "requires_designated_person": True,
        "requires_dissemination": True,
        "filing_deadline_days": 180,
        "regulated_sectors": ["financial", "healthcare", "defense", "energy"],
    },
    "UK": {
        "name": "Public Interest Disclosure Act 1998",
        "headcount_threshold": 0,
        "public_sector_all": True,
        "acknowledgment_days": None,
        "feedback_months": None,
        "requires_internal_channel": True,
        "requires_confidentiality": True,
        "requires_gdpr": True,
        "requires_designated_person": True,
        "requires_dissemination": True,
        "regulated_sectors": ["financial", "healthcare", "nuclear", "defense"],
    },
}

# Sector-specific additional checks
SECTOR_CHECKS: Dict[str, List[str]] = {
    "financial": [
        "Anti-money laundering reporting integration",
        "Financial regulator notification procedures",
        "Market abuse reporting channel separation",
    ],
    "healthcare": [
        "Patient safety reporting integration",
        "Clinical governance alignment",
        "Professional body notification procedures",
    ],
    "defense": [
        "Security clearance considerations for designated persons",
        "Classified information handling procedures",
    ],
    "nuclear": [
        "Nuclear safety authority notification procedures",
        "Radiation safety incident integration",
    ],
}


def build_gap(phase: str, checkpoint: str, priority: str, detail: str) -> Dict[str, str]:
    """Build a structured gap finding."""
    return {
        "phase": phase,
        "checkpoint": checkpoint,
        "priority": priority,
        "detail": detail,
    }


def assess_applicability(
    jurisdiction: str, headcount: int, sector: str, reqs: Dict[str, Any]
) -> Tuple[List[Dict], int, int]:
    """Phase 1: Assess applicability (3 checkpoints)."""
    gaps: List[Dict] = []
    passed = 0
    total = 3

    # Check 1: Headcount threshold
    if headcount >= reqs["headcount_threshold"] or reqs["public_sector_all"]:
        passed += 1
    else:
        gaps.append(build_gap(
            "1. Applicability", "Headcount threshold", IMPROVEMENT,
            f"Organization has {headcount} employees; threshold is {reqs['headcount_threshold']}. "
            "Voluntary adoption still recommended."
        ))

    # Check 2: Jurisdiction applicability
    passed += 1  # Always applicable if user specified jurisdiction

    # Check 3: Sector determination
    if sector in reqs.get("regulated_sectors", []):
        passed += 1
    else:
        passed += 1  # Non-regulated sectors still pass, just no extra requirements

    return gaps, passed, total


def assess_reception_channel(
    channels: List[str], reqs: Dict[str, Any]
) -> Tuple[List[Dict], int, int]:
    """Phase 2: Assess reception channels (5 checkpoints)."""
    gaps: List[Dict] = []
    passed = 0
    total = 5

    has_internal = "internal" in channels
    has_external = "external" in channels
    has_any = has_internal or has_external

    # Check 1: System exists
    if has_any:
        passed += 1
    else:
        gaps.append(build_gap(
            "2. Reception Channel", "System existence", CRITICAL,
            "No whistleblower reporting channel exists. Mandatory under applicable regulation."
        ))

    # Check 2: Internal channel
    if has_internal:
        passed += 1
    else:
        gaps.append(build_gap(
            "2. Reception Channel", "Internal channel", CRITICAL if reqs["requires_internal_channel"] else IMPORTANT,
            "No internal reporting channel. Internal channels are the preferred first point of contact."
        ))

    # Check 3: External channel awareness
    if has_external:
        passed += 1
    else:
        gaps.append(build_gap(
            "2. Reception Channel", "External channel", IMPORTANT,
            "No external reporting channel or awareness of regulatory authority reporting options."
        ))

    # Check 4: Written/oral/in-person options
    if has_internal:
        passed += 1  # Assume basic channel supports at least one mode
    else:
        gaps.append(build_gap(
            "2. Reception Channel", "Multiple report modes", IMPROVEMENT,
            "Best practice: offer written, oral, and in-person reporting options."
        ))

    # Check 5: Anonymous reporting option
    if has_any:
        passed += 1  # Score as pass but flag improvement
        gaps.append(build_gap(
            "2. Reception Channel", "Anonymous reporting", IMPROVEMENT,
            "Consider enabling anonymous reporting to increase reporter confidence."
        ))
    else:
        total -= 1  # Skip if no channels at all

    return gaps, passed, total


def assess_designated_persons(has_designated: bool, reqs: Dict[str, Any]) -> Tuple[List[Dict], int, int]:
    """Phase 3: Assess designated persons (7 checkpoints)."""
    gaps: List[Dict] = []
    passed = 0
    total = 7

    if has_designated:
        passed += 4  # Existence, appointment, training baseline, contact info
        # Flag remaining items as improvements
        gaps.append(build_gap(
            "3. Designated Persons", "Independence verification", IMPORTANT,
            "Verify designated person(s) have no conflicts of interest and report independently."
        ))
        gaps.append(build_gap(
            "3. Designated Persons", "Backup designation", IMPROVEMENT,
            "Ensure backup designated person is appointed for absence/conflict scenarios."
        ))
        gaps.append(build_gap(
            "3. Designated Persons", "Specialized training", IMPROVEMENT,
            "Confirm designated persons receive annual training on investigation procedures."
        ))
    else:
        gaps.append(build_gap(
            "3. Designated Persons", "Person appointed", CRITICAL,
            "No designated person appointed for receiving and processing whistleblower reports."
        ))
        passed += 0

    return gaps, passed, total


def assess_verification_processing(
    has_ack_timeline: bool, has_feedback_timeline: bool, reqs: Dict[str, Any]
) -> Tuple[List[Dict], int, int]:
    """Phase 4: Assess verification and processing (8 checkpoints)."""
    gaps: List[Dict] = []
    passed = 0
    total = 8

    # Acknowledgment timeline
    if reqs.get("acknowledgment_days"):
        if has_ack_timeline:
            passed += 1
        else:
            gaps.append(build_gap(
                "4. Verification/Processing", "Acknowledgment timeline",
                CRITICAL,
                f"Reports must be acknowledged within {reqs['acknowledgment_days']} days."
            ))
    else:
        passed += 1  # Not required in this jurisdiction

    # Feedback timeline
    if reqs.get("feedback_months"):
        if has_feedback_timeline:
            passed += 1
        else:
            gaps.append(build_gap(
                "4. Verification/Processing", "Feedback timeline",
                CRITICAL,
                f"Feedback must be provided within {reqs['feedback_months']} months."
            ))
    else:
        passed += 1

    # Standard process checks (scored generously with improvement flags)
    passed += 3  # Triage process, investigation procedure, documentation
    gaps.append(build_gap(
        "4. Verification/Processing", "Written investigation procedure", IMPORTANT,
        "Ensure formal written investigation procedure exists with defined steps."
    ))
    gaps.append(build_gap(
        "4. Verification/Processing", "Case tracking system", IMPROVEMENT,
        "Implement case tracking with unique identifiers and audit trail."
    ))
    gaps.append(build_gap(
        "4. Verification/Processing", "Outcome communication", IMPORTANT,
        "Document and communicate investigation outcomes to the reporter."
    ))

    return gaps, passed, total


def assess_confidentiality(has_confidentiality: bool) -> Tuple[List[Dict], int, int]:
    """Phase 5: Assess confidentiality measures (9 checkpoints)."""
    gaps: List[Dict] = []
    passed = 0
    total = 9

    if has_confidentiality:
        passed += 5
        gaps.append(build_gap(
            "5. Confidentiality", "Access controls", IMPORTANT,
            "Verify only designated persons can access reporter identity information."
        ))
        gaps.append(build_gap(
            "5. Confidentiality", "Secure communication channel", IMPORTANT,
            "Ensure reporting channel uses encrypted/secure communication."
        ))
        gaps.append(build_gap(
            "5. Confidentiality", "Consent for identity disclosure", IMPROVEMENT,
            "Document process for obtaining reporter consent before identity disclosure."
        ))
        gaps.append(build_gap(
            "5. Confidentiality", "Penalty for breach", IMPROVEMENT,
            "Define disciplinary consequences for unauthorized identity disclosure."
        ))
    else:
        gaps.append(build_gap(
            "5. Confidentiality", "Confidentiality measures", CRITICAL,
            "No confidentiality measures in place. Reporter identity protection is mandatory."
        ))

    return gaps, passed, total


def assess_dissemination(has_dissemination: bool) -> Tuple[List[Dict], int, int]:
    """Phase 6: Assess dissemination and information (10 checkpoints)."""
    gaps: List[Dict] = []
    passed = 0
    total = 10

    if has_dissemination:
        passed += 5
        gaps.append(build_gap(
            "6. Dissemination", "Employee training", IMPORTANT,
            "All employees should receive training on whistleblower procedures."
        ))
        gaps.append(build_gap(
            "6. Dissemination", "Contractor/vendor coverage", IMPORTANT,
            "Extend whistleblower information to contractors and business partners."
        ))
        gaps.append(build_gap(
            "6. Dissemination", "Regular reminders", IMPROVEMENT,
            "Schedule periodic reminders about reporting channels and protections."
        ))
        gaps.append(build_gap(
            "6. Dissemination", "Multilingual availability", IMPROVEMENT,
            "Provide policy in all languages used by the workforce."
        ))
        gaps.append(build_gap(
            "6. Dissemination", "Website/intranet publication", IMPROVEMENT,
            "Publish policy on company intranet and/or public website."
        ))
    else:
        gaps.append(build_gap(
            "6. Dissemination", "Policy dissemination", CRITICAL,
            "Whistleblower policy not disseminated to personnel. Awareness is mandatory."
        ))

    return gaps, passed, total


def assess_data_protection(has_gdpr: bool, reqs: Dict[str, Any]) -> Tuple[List[Dict], int, int]:
    """Phase 7: Assess data protection/GDPR (12 checkpoints)."""
    gaps: List[Dict] = []
    passed = 0
    total = 12

    if not reqs["requires_gdpr"]:
        # GDPR not applicable but basic data protection still relevant
        total = 6
        if has_gdpr:
            passed += 4
        else:
            passed += 2
            gaps.append(build_gap(
                "7. Data Protection", "Data protection measures", IMPORTANT,
                "Implement basic data protection for whistleblower report data."
            ))
        gaps.append(build_gap(
            "7. Data Protection", "Retention policy", IMPORTANT,
            "Define data retention period for whistleblower reports and investigation files."
        ))
        gaps.append(build_gap(
            "7. Data Protection", "Secure storage", IMPROVEMENT,
            "Ensure whistleblower data is stored securely with access controls."
        ))
    else:
        if has_gdpr:
            passed += 7
            gaps.append(build_gap(
                "7. Data Protection", "DPIA completion", IMPORTANT,
                "Complete Data Protection Impact Assessment for whistleblower processing."
            ))
            gaps.append(build_gap(
                "7. Data Protection", "Legal basis documentation", IMPORTANT,
                "Document legal basis for processing under Art. 6 GDPR."
            ))
            gaps.append(build_gap(
                "7. Data Protection", "Data subject rights", IMPROVEMENT,
                "Define procedures for handling data subject rights in whistleblower context."
            ))
            gaps.append(build_gap(
                "7. Data Protection", "Cross-border transfer", IMPROVEMENT,
                "Address cross-border data transfer requirements if applicable."
            ))
            gaps.append(build_gap(
                "7. Data Protection", "Retention schedule", IMPROVEMENT,
                "Implement automated retention and deletion schedule."
            ))
        else:
            gaps.append(build_gap(
                "7. Data Protection", "GDPR compliance", CRITICAL,
                "No GDPR measures for whistleblower data processing. Mandatory under EU/UK regulation."
            ))

    return gaps, passed, total


def assess_sector_specific(sector: str, reqs: Dict[str, Any]) -> Tuple[List[Dict], int, int]:
    """Phase 8: Assess sector-specific requirements (6 checkpoints)."""
    gaps: List[Dict] = []
    passed = 0
    checks = SECTOR_CHECKS.get(sector, [])
    total = max(len(checks), 2)

    if not checks:
        # Non-regulated sector: basic checks only
        passed += 2
        return gaps, passed, total

    for check in checks:
        gaps.append(build_gap(
            "8. Sector-Specific", check, IMPORTANT,
            f"Verify sector-specific requirement: {check}"
        ))

    passed += max(0, total - len(checks))
    return gaps, passed, total


def run_assessment(args: argparse.Namespace) -> Dict[str, Any]:
    """Run the full compliance assessment."""
    jurisdiction = args.jurisdiction
    headcount = args.headcount
    sector = args.sector
    channels = [c.strip() for c in args.channels.split(",")] if args.channels else []
    reqs = REQUIREMENTS[jurisdiction]

    all_gaps: List[Dict] = []
    total_passed = 0
    total_checks = 0

    # Run all 8 phases
    phases = [
        ("1. Applicability", assess_applicability(jurisdiction, headcount, sector, reqs)),
        ("2. Reception Channel", assess_reception_channel(channels, reqs)),
        ("3. Designated Persons", assess_designated_persons(args.has_designated_person, reqs)),
        ("4. Verification/Processing", assess_verification_processing(
            args.has_acknowledgment_timeline, args.has_feedback_timeline, reqs)),
        ("5. Confidentiality", assess_confidentiality(args.has_confidentiality)),
        ("6. Dissemination", assess_dissemination(args.has_dissemination)),
        ("7. Data Protection", assess_data_protection(args.has_gdpr_measures, reqs)),
        ("8. Sector-Specific", assess_sector_specific(sector, reqs)),
    ]

    phase_results = []
    for phase_name, (gaps, passed, total) in phases:
        all_gaps.extend(gaps)
        total_passed += passed
        total_checks += total
        pct = round((passed / total) * 100, 1) if total > 0 else 100.0
        phase_results.append({
            "phase": phase_name,
            "passed": passed,
            "total": total,
            "score_pct": pct,
        })

    overall_score = round((total_passed / total_checks) * 100, 1) if total_checks > 0 else 0.0

    critical_count = sum(1 for g in all_gaps if g["priority"] == CRITICAL)
    important_count = sum(1 for g in all_gaps if g["priority"] == IMPORTANT)
    improvement_count = sum(1 for g in all_gaps if g["priority"] == IMPROVEMENT)

    return {
        "assessment_date": datetime.now().strftime("%Y-%m-%d"),
        "jurisdiction": jurisdiction,
        "regulation": reqs["name"],
        "headcount": headcount,
        "sector": sector,
        "channels": channels,
        "overall_score_pct": overall_score,
        "total_passed": total_passed,
        "total_checks": total_checks,
        "gap_summary": {
            "critical": critical_count,
            "important": important_count,
            "improvement": improvement_count,
            "total": len(all_gaps),
        },
        "phase_results": phase_results,
        "gaps": all_gaps,
    }


def format_text(result: Dict[str, Any]) -> str:
    """Format assessment result as human-readable text."""
    lines = []
    lines.append("=" * 70)
    lines.append("WHISTLEBLOWER COMPLIANCE ASSESSMENT REPORT")
    lines.append("=" * 70)
    lines.append(f"Date:          {result['assessment_date']}")
    lines.append(f"Jurisdiction:  {result['jurisdiction']} ({result['regulation']})")
    lines.append(f"Headcount:     {result['headcount']}")
    lines.append(f"Sector:        {result['sector']}")
    lines.append(f"Channels:      {', '.join(result['channels']) or 'None'}")
    lines.append("")
    lines.append(f"OVERALL SCORE: {result['overall_score_pct']}% "
                 f"({result['total_passed']}/{result['total_checks']} checks passed)")
    lines.append("")

    # Phase breakdown
    lines.append("-" * 70)
    lines.append("PHASE BREAKDOWN")
    lines.append("-" * 70)
    lines.append(f"{'Phase':<35} {'Score':>10} {'Passed':>10}")
    lines.append("-" * 70)
    for p in result["phase_results"]:
        lines.append(f"{p['phase']:<35} {p['score_pct']:>9.1f}% {p['passed']:>4}/{p['total']:<4}")

    # Gap summary
    lines.append("")
    lines.append("-" * 70)
    lines.append("GAP SUMMARY")
    lines.append("-" * 70)
    gs = result["gap_summary"]
    lines.append(f"  CRITICAL:    {gs['critical']}")
    lines.append(f"  IMPORTANT:   {gs['important']}")
    lines.append(f"  IMPROVEMENT: {gs['improvement']}")
    lines.append(f"  TOTAL:       {gs['total']}")

    # Detailed gaps by priority
    for priority in [CRITICAL, IMPORTANT, IMPROVEMENT]:
        priority_gaps = [g for g in result["gaps"] if g["priority"] == priority]
        if priority_gaps:
            lines.append("")
            lines.append(f"--- {priority} GAPS ---")
            for g in priority_gaps:
                lines.append(f"  [{g['phase']}] {g['checkpoint']}")
                lines.append(f"    {g['detail']}")

    lines.append("")
    lines.append("=" * 70)
    return "\n".join(lines)


def main() -> None:
    parser = argparse.ArgumentParser(
        description="Assess whistleblower system compliance against regulatory requirements."
    )
    parser.add_argument("--json", action="store_true", help="Output in JSON format")
    parser.add_argument("--jurisdiction", required=True, choices=["EU", "US", "UK"],
                        help="Regulatory jurisdiction")
    parser.add_argument("--headcount", required=True, type=int,
                        help="Number of employees")
    parser.add_argument("--sector", required=True,
                        help="Industry sector (financial, healthcare, technology, etc.)")
    parser.add_argument("--channels", default="none",
                        help="Comma-separated channel types: internal, external, none")
    parser.add_argument("--has-designated-person", action="store_true",
                        help="Designated person appointed")
    parser.add_argument("--has-confidentiality", action="store_true",
                        help="Confidentiality measures in place")
    parser.add_argument("--has-gdpr-measures", action="store_true",
                        help="GDPR/data protection measures implemented")
    parser.add_argument("--has-dissemination", action="store_true",
                        help="Policy disseminated to personnel")
    parser.add_argument("--has-acknowledgment-timeline", action="store_true",
                        help="7-day acknowledgment timeline met")
    parser.add_argument("--has-feedback-timeline", action="store_true",
                        help="3-month feedback timeline met")

    args = parser.parse_args()

    try:
        result = run_assessment(args)
        if args.json:
            print(json.dumps(result, indent=2))
        else:
            print(format_text(result))
    except Exception as e:
        print(f"Error: {e}", file=sys.stderr)
        sys.exit(1)


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
Whistleblower Policy Scaffolder

Generates a whistleblower policy skeleton pre-populated with required sections
per regulatory framework (EU Directive 2019/1937, US SOX/Dodd-Frank, UK PIDA).

Usage:
    python whistleblower_policy_scaffolder.py --jurisdiction EU --org-type private --headcount 500 --org-name "Acme Corp"
    python whistleblower_policy_scaffolder.py --jurisdiction US --org-type public --headcount 10000 --json
    python whistleblower_policy_scaffolder.py --jurisdiction UK --org-type nonprofit --headcount 100 --output policy.md
"""

import argparse
import json
import sys
from datetime import datetime
from typing import Any, Dict, List, Optional


# Section definitions per jurisdiction
COMMON_SECTIONS = [
    "Purpose and Scope",
    "Definitions",
    "Who Can Report",
    "What Can Be Reported",
    "Reporting Channels",
    "How to Make a Report",
    "Handling of Reports",
    "Confidentiality",
    "Protections Against Retaliation",
    "Record Keeping and Data Protection",
    "Review and Updates",
]

JURISDICTION_SECTIONS: Dict[str, List[str]] = {
    "EU": [
        "Internal Reporting Channel",
        "External Reporting to Competent Authority",
        "Public Disclosure Conditions",
        "Acknowledgment and Feedback Timelines",
        "Designated Person(s)",
        "GDPR and Data Protection Compliance",
        "Cross-Border Reporting",
        "National Transposition Specifics",
    ],
    "US": [
        "SOX Section 806 Compliance",
        "Dodd-Frank Whistleblower Provisions",
        "SEC Reporting and Bounty Program",
        "OSHA Complaint Process",
        "Filing Deadlines",
        "Audit Committee Oversight",
        "Anti-Retaliation Provisions",
    ],
    "UK": [
        "Qualifying Disclosures",
        "Prescribed Persons",
        "Employment Tribunal Rights",
        "Public Interest Test",
        "Reasonable Belief Standard",
        "GDPR UK and Data Protection Act 2018",
        "Disclosure to Legal Advisors",
    ],
}

SECTOR_SECTIONS: Dict[str, List[str]] = {
    "financial": ["Financial Regulatory Reporting", "Anti-Money Laundering Integration"],
    "healthcare": ["Patient Safety Reporting", "Clinical Governance Alignment"],
    "defense": ["Classified Information Handling", "Security Clearance Considerations"],
    "nuclear": ["Nuclear Safety Authority Notification", "Radiation Safety Integration"],
    "technology": ["Cybersecurity Incident Reporting Integration"],
}


def build_section_content(section: str, org_name: str, jurisdiction: str,
                          org_type: str, headcount: int) -> str:
    """Generate placeholder content for a policy section."""
    placeholders: Dict[str, str] = {
        "Purpose and Scope": (
            f"This policy establishes the framework for reporting suspected wrongdoing "
            f"at {org_name}. It applies to all employees, contractors, consultants, "
            f"temporary workers, and business partners.\n\n"
            f"[CUSTOMIZE: Define specific scope based on organizational structure and "
            f"geographic operations.]"
        ),
        "Definitions": (
            "For the purposes of this policy:\n\n"
            "- **Whistleblower/Reporter**: Any person who reports information about "
            "breaches acquired in a work-related context.\n"
            "- **Report**: A disclosure of information about suspected wrongdoing.\n"
            "- **Retaliation**: Any direct or indirect act or omission that causes or "
            "may cause unjustified detriment to the reporter.\n"
            "- **Designated Person**: The individual(s) responsible for receiving and "
            "following up on reports.\n"
            "- **Breach**: Acts or omissions that are unlawful or defeat the object "
            "or purpose of applicable rules.\n\n"
            "[CUSTOMIZE: Add organization-specific definitions as needed.]"
        ),
        "Who Can Report": (
            "The following persons are entitled to protection under this policy:\n\n"
            "- Current and former employees\n"
            "- Job applicants and candidates\n"
            "- Contractors, subcontractors, and suppliers\n"
            "- Shareholders and members of management bodies\n"
            "- Volunteers and unpaid trainees\n"
            "- Persons assisting the reporter (facilitators)\n"
            "- Third parties connected with the reporter\n\n"
            "[CUSTOMIZE: Adjust based on applicable jurisdiction and organizational structure.]"
        ),
        "What Can Be Reported": (
            "This policy covers reports of suspected breaches including:\n\n"
            "- Fraud, corruption, and bribery\n"
            "- Financial irregularities and accounting manipulation\n"
            "- Health and safety violations\n"
            "- Environmental offenses\n"
            "- Data protection and privacy breaches\n"
            "- Discrimination and harassment\n"
            "- Competition law violations\n"
            "- Tax evasion and avoidance\n"
            "- Product safety and compliance failures\n"
            "- Obstruction of justice or regulatory proceedings\n\n"
            "[CUSTOMIZE: Add sector-specific reportable matters.]"
        ),
        "Reporting Channels": (
            f"## Internal Reporting Channel\n\n"
            f"{org_name} provides the following internal reporting channels:\n\n"
            f"- **Online portal**: [INSERT URL]\n"
            f"- **Email**: [INSERT DEDICATED EMAIL]\n"
            f"- **Phone/Hotline**: [INSERT NUMBER]\n"
            f"- **In person**: By appointment with [INSERT DESIGNATED PERSON]\n"
            f"- **Written submission**: Marked 'Confidential' to [INSERT ADDRESS]\n\n"
            f"Reports may be submitted anonymously where permitted by law.\n\n"
            f"[CUSTOMIZE: Specify available channels and contact details.]"
        ),
        "How to Make a Report": (
            "When making a report, include as much of the following as possible:\n\n"
            "1. Description of the suspected breach or wrongdoing\n"
            "2. Names of persons involved (if known)\n"
            "3. Dates and locations of the events\n"
            "4. Any evidence or documentation supporting the report\n"
            "5. Whether the matter has been reported elsewhere\n\n"
            "Reports do not need to be proven. A reasonable belief that the "
            "information is true at the time of reporting is sufficient."
        ),
        "Handling of Reports": (
            "Upon receipt of a report, the following process applies:\n\n"
            "1. **Acknowledgment**: The reporter receives written acknowledgment "
            f"{'within 7 calendar days' if jurisdiction == 'EU' else 'promptly'}.\n"
            "2. **Initial Assessment**: The designated person assesses whether the "
            "report falls within scope and determines next steps.\n"
            "3. **Investigation**: An impartial investigation is conducted by "
            "qualified personnel with no conflict of interest.\n"
            "4. **Feedback**: The reporter is informed of the outcome "
            f"{'within 3 months of acknowledgment' if jurisdiction == 'EU' else 'as soon as practicable'}.\n"
            "5. **Closure**: The investigation is closed with documented findings "
            "and any corrective actions.\n\n"
            "[CUSTOMIZE: Define specific investigation procedures and escalation paths.]"
        ),
        "Confidentiality": (
            "The identity of the reporter shall not be disclosed to anyone beyond "
            "authorized staff without the explicit consent of the reporter, unless "
            "required by law in the context of judicial proceedings.\n\n"
            "Confidentiality measures include:\n\n"
            "- Access restricted to designated person(s) only\n"
            "- Secure storage of all report documentation\n"
            "- Anonymization of information shared for investigation purposes\n"
            "- Disciplinary action for unauthorized disclosure\n\n"
            "[CUSTOMIZE: Specify technical and organizational confidentiality measures.]"
        ),
        "Protections Against Retaliation": (
            "Retaliation against a reporter is strictly prohibited. Prohibited forms "
            "of retaliation include, but are not limited to:\n\n"
            "- Dismissal, suspension, or demotion\n"
            "- Reduction in duties, salary, or benefits\n"
            "- Harassment, intimidation, or bullying\n"
            "- Negative performance references or evaluations\n"
            "- Blacklisting within the industry\n"
            "- Early termination of contract or license\n"
            "- Psychiatric or medical referrals\n\n"
            f"{'The burden of proof in retaliation claims rests with the employer. ' if jurisdiction == 'EU' else ''}"
            f"{'Reporters may seek compensatory damages through employment tribunal proceedings. ' if jurisdiction == 'UK' else ''}"
            f"{'Reporters may file complaints with OSHA within 180 days and may be eligible for SEC bounty awards. ' if jurisdiction == 'US' else ''}\n\n"
            "[CUSTOMIZE: Specify organizational anti-retaliation procedures and remedies.]"
        ),
        "Record Keeping and Data Protection": (
            "All reports and related documentation shall be retained in accordance "
            "with applicable data protection laws and organizational retention policies.\n\n"
            "- Reports retained for the duration of the investigation plus [INSERT PERIOD]\n"
            "- Personal data processed only for investigation purposes\n"
            "- Data subjects informed of processing (except where it would compromise the investigation)\n"
            f"{'- Data Protection Impact Assessment completed for whistleblower processing' if jurisdiction in ['EU', 'UK'] else ''}\n"
            f"{'- Processing based on Art. 6(1)(c) GDPR (legal obligation) or Art. 6(1)(e) (public interest)' if jurisdiction in ['EU', 'UK'] else ''}\n\n"
            "[CUSTOMIZE: Specify retention periods, legal basis, and technical measures.]"
        ),
        "Review and Updates": (
            f"This policy shall be reviewed [annually/biannually] by {org_name}'s "
            "legal department and updated to reflect changes in applicable law, "
            "regulatory guidance, and organizational structure.\n\n"
            "- Last reviewed: [INSERT DATE]\n"
            "- Next review due: [INSERT DATE]\n"
            "- Policy owner: [INSERT NAME/TITLE]\n"
            "- Approved by: [INSERT NAME/TITLE/BOARD]\n\n"
            "[CUSTOMIZE: Specify review frequency and approval workflow.]"
        ),
        "Internal Reporting Channel": (
            "In accordance with EU Directive 2019/1937, this organization maintains "
            "internal reporting channels that are secure, ensure confidentiality, and "
            "allow written, oral, and in-person reporting.\n\n"
            "[CUSTOMIZE: Describe channel implementation details.]"
        ),
        "External Reporting to Competent Authority": (
            "Reporters may report directly to the competent national authority if:\n\n"
            "- Internal reporting would be ineffective\n"
            "- There is risk of retaliation\n"
            "- There is an imminent or manifest danger to the public interest\n\n"
            "Competent authority: [INSERT NATIONAL AUTHORITY]\n\n"
            "[CUSTOMIZE: Identify the relevant national competent authority.]"
        ),
        "Public Disclosure Conditions": (
            "Public disclosure is protected only when:\n\n"
            "1. The reporter first reported internally and/or externally but no "
            "appropriate action was taken within prescribed timelines; or\n"
            "2. There is an imminent or manifest danger to the public interest; or\n"
            "3. External reporting would risk retaliation or destruction of evidence.\n\n"
            "[CUSTOMIZE: Clarify organizational position on public disclosure.]"
        ),
        "Acknowledgment and Feedback Timelines": (
            "- **Acknowledgment**: Within 7 calendar days of receipt\n"
            "- **Feedback**: Within 3 months from date of acknowledgment\n"
            "- Feedback includes: confirmation of receipt, status of follow-up, "
            "and planned or taken actions (without compromising the investigation)\n\n"
            "[CUSTOMIZE: Specify internal workflow to meet these mandatory timelines.]"
        ),
        "Designated Person(s)": (
            "The following person(s) are designated to receive and follow up on reports:\n\n"
            "- Primary: [INSERT NAME, TITLE, CONTACT]\n"
            "- Alternate: [INSERT NAME, TITLE, CONTACT]\n\n"
            "Designated persons are selected for their independence, competence, "
            "and absence of conflicts of interest.\n\n"
            "[CUSTOMIZE: Appoint designated persons and define their mandate.]"
        ),
    }

    return placeholders.get(section, f"[CUSTOMIZE: Complete this section for {org_name}.]\n")


def generate_policy(args: argparse.Namespace) -> Dict[str, Any]:
    """Generate the full policy scaffold."""
    jurisdiction = args.jurisdiction
    org_type = args.org_type
    headcount = args.headcount
    org_name = args.org_name or "[ORGANIZATION NAME]"
    sector = getattr(args, "sector", "general")

    # Build section list
    all_sections = list(COMMON_SECTIONS)
    all_sections.extend(JURISDICTION_SECTIONS.get(jurisdiction, []))

    sector_extras = SECTOR_SECTIONS.get(sector, [])
    if sector_extras:
        all_sections.extend(sector_extras)

    # Generate policy document
    policy_lines = []
    policy_lines.append(f"# {org_name} Whistleblower Policy")
    policy_lines.append("")
    policy_lines.append(f"**Effective Date:** [INSERT DATE]")
    policy_lines.append(f"**Version:** 1.0")
    policy_lines.append(f"**Jurisdiction:** {jurisdiction}")
    policy_lines.append(f"**Organization Type:** {org_type.title()}")
    policy_lines.append(f"**Applicable Regulation:** "
                        f"{'EU Directive 2019/1937' if jurisdiction == 'EU' else ''}"
                        f"{'SOX Section 806 / Dodd-Frank' if jurisdiction == 'US' else ''}"
                        f"{'Public Interest Disclosure Act 1998' if jurisdiction == 'UK' else ''}")
    policy_lines.append(f"**Approved By:** [INSERT NAME/TITLE]")
    policy_lines.append("")
    policy_lines.append("---")
    policy_lines.append("")

    # Table of contents
    policy_lines.append("## Table of Contents")
    policy_lines.append("")
    for i, section in enumerate(all_sections, 1):
        anchor = section.lower().replace(" ", "-").replace("/", "").replace("(", "").replace(")", "")
        policy_lines.append(f"{i}. [{section}](#{anchor})")
    policy_lines.append("")
    policy_lines.append("---")
    policy_lines.append("")

    # Sections
    sections_data = []
    for i, section in enumerate(all_sections, 1):
        content = build_section_content(section, org_name, jurisdiction, org_type, headcount)
        policy_lines.append(f"## {i}. {section}")
        policy_lines.append("")
        policy_lines.append(content)
        policy_lines.append("")
        sections_data.append({"number": i, "title": section, "has_content": True})

    policy_lines.append("---")
    policy_lines.append("")
    policy_lines.append(f"*Policy generated on {datetime.now().strftime('%Y-%m-%d')} "
                        f"for {org_name}. This is a template requiring legal review "
                        f"and customization before adoption.*")

    policy_text = "\n".join(policy_lines)

    return {
        "generated_date": datetime.now().strftime("%Y-%m-%d"),
        "jurisdiction": jurisdiction,
        "org_name": org_name,
        "org_type": org_type,
        "headcount": headcount,
        "total_sections": len(all_sections),
        "sections": sections_data,
        "policy_text": policy_text,
    }


def main() -> None:
    parser = argparse.ArgumentParser(
        description="Generate a whistleblower policy skeleton based on jurisdiction and org type."
    )
    parser.add_argument("--json", action="store_true", help="Output in JSON format")
    parser.add_argument("--jurisdiction", required=True, choices=["EU", "US", "UK"],
                        help="Regulatory jurisdiction")
    parser.add_argument("--org-type", required=True, choices=["public", "private", "nonprofit"],
                        help="Organization type")
    parser.add_argument("--headcount", required=True, type=int,
                        help="Number of employees")
    parser.add_argument("--org-name", default=None,
                        help="Organization name for policy template")
    parser.add_argument("--sector", default="general",
                        help="Industry sector for additional sections")
    parser.add_argument("--output", default=None,
                        help="Write policy to file instead of stdout")

    args = parser.parse_args()

    try:
        result = generate_policy(args)

        if args.output:
            with open(args.output, "w") as f:
                f.write(result["policy_text"])
            print(f"Policy written to {args.output} ({result['total_sections']} sections)")
        elif args.json:
            print(json.dumps(result, indent=2))
        else:
            print(result["policy_text"])
    except Exception as e:
        print(f"Error: {e}", file=sys.stderr)
        sys.exit(1)


if __name__ == "__main__":
    main()