Stats
Actions
Tags
From grimoire
Audits organizational speak-up systems for reporting ethical violations, compliance breaches, and safety issues — including channel design, protection policies, and psychological safety norms.
How this skill is triggered — by the user, by Claude, or both
Slash command
/grimoire:design-speak-up-frameworkThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Design the channels, protections, and cultural norms that make it possible and expected for people to report wrongdoing — because without explicit design, fear of retaliation systematically suppresses the information that would have prevented the most serious organizational failures.
Design the channels, protections, and cultural norms that make it possible and expected for people to report wrongdoing — because without explicit design, fear of retaliation systematically suppresses the information that would have prevented the most serious organizational failures.
谷梁传 (Guliang Chi, ~5th–4th century BC):
讨贼之义 — The obligation to oppose wrongdoing.
Why best: The 谷梁传 contains repeated moral commentary on historical cases where those with standing remained neutral in the face of wrongdoing — and treats that neutrality as moral failure equivalent to complicity. The principle: having the knowledge and standing to report wrongdoing, and choosing silence to protect oneself, is not an ethically neutral position. This is not merely a moral claim; it is an institutional design insight — institutions in which witnessing wrongdoing creates a duty to report, rather than a risk to manage, have better integrity and fewer catastrophic failures than institutions where silence is the rational choice.
Sarbanes-Oxley Act §301 (2002): Enacted after the Enron, WorldCom, and Tyco accounting scandals — all of which involved employees who knew of the fraud but feared reporting it. SOX §301 requires all public companies to establish procedures for receiving and addressing complaints about accounting controls and auditing matters, including anonymous submission mechanisms. The explicit legislative finding: absent a structured speak-up mechanism, employees with knowledge of financial wrongdoing face career-ending consequences for disclosure, so they stay silent. SOX made the infrastructure for speak-up a legal requirement for all ~6,000 US public companies.
Dodd-Frank Act §§922–924 (2010): Established the SEC whistleblower program in response to the 2008 financial crisis, during which multiple employees at major financial institutions had knowledge of misconduct but stayed silent. Dodd-Frank provides financial rewards (10–30% of sanctions above $1M) and explicit anti-retaliation protections to whistleblowers. Since 2011: 50,000+ tips received; $1.3B+ in awards; multiple major enforcement actions triggered by employee disclosures. The explicit design rationale: financial incentive for disclosure and legal protection from retaliation must both exist simultaneously for reporting to occur at scale.
FCA Senior Managers & Certification Regime (SMCR, UK, 2016): UK Financial Conduct Authority's framework for individual accountability in financial services explicitly includes whistleblowing requirements: every firm must have a named "whistleblowers' champion" at board level; internal reporting channels must be established and published; firms must protect and support reporters. Applies to ~60,000 firms in the UK financial sector.
Amy Edmondson — "The Fearless Organization" (2018, Harvard Business School): Edmondson's 20+ years of research on psychological safety establishes the empirical foundation: when people fear negative consequences for speaking up (whether about strategic disagreement, mistakes, or wrongdoing), they don't speak up — and organizations lose access to critical information. Key finding: psychological safety does not mean absence of accountability; it means people believe they can raise concerns without being punished for doing so. Her research spans healthcare (hospitals with higher psychological safety have lower medication error rates), manufacturing (Toyota stop-the-line protocol), and financial services (higher psychological safety correlates with earlier detection of compliance problems). Adopted as a framework at Google (Project Aristotle), Pixar, and many healthcare systems.
Diane Vaughan — "The Challenger Launch Decision" (1996): Vaughan's definitive analysis of the 1986 Space Shuttle Challenger disaster identifies the proximate cause as suppression of safety concerns: engineers at Morton Thiokol knew the O-rings were at risk at low temperatures and attempted to delay the launch. The decision was reversed under organizational pressure, with some engineers choosing not to escalate further because they believed doing so would damage their careers. Vaughan's term "normalization of deviance" — the organizational process by which early warnings are discounted until catastrophe — is now standard vocabulary in safety culture research. Required reading in NASA, aerospace, nuclear, and healthcare safety programs.
Why distinct from apply-constructive-dissent: apply-constructive-dissent addresses strategic or decision-quality disagreement — "I think this strategy is wrong" or "this plan has flaws." The trigger is disagreement about quality. design-speak-up-framework addresses a fundamentally different trigger: witnessing or suspecting ethical violations, compliance breaches, safety issues, or misconduct. The stakes are different (compliance consequences, criminal liability, catastrophic safety events), the institutional requirements are different (legal protections, anonymous channels, formal investigation process), and the power dynamics are different (reporters are often junior to the wrongdoers).
Why distinct from design-incident-response: design-incident-response addresses operational system failures — production outages, process breakdowns, technical failures. design-speak-up-framework addresses human misconduct and ethical/compliance violations. These require different response processes, different investigation approaches, and different protections for reporters.
Adopted by: SOX §301 mandates speak-up infrastructure for all ~6,000 US public companies; Dodd-Frank §§922–924 established the SEC whistleblower program now applied across US financial markets; the FCA SMCR applies to ~60,000 UK financial firms; Amy Edmondson's psychological safety framework has been adopted at Google (Project Aristotle), Pixar, and hospital systems globally.
Impact: The SEC whistleblower program has received 50,000+ tips and distributed $1.3B+ in awards since 2011, triggering multiple major enforcement actions; Edmondson's research shows hospitals with higher psychological safety have measurably lower medication error rates, and organizations with higher psychological safety detect compliance problems earlier.
Distinguish speak-up categories by severity and type. A speak-up framework must handle different types of concerns with different channels and protections:
Design reporting channels that match the concern type. No single channel works for all concern types:
Establish and communicate non-retaliation protections. The legal framework (SOX, Dodd-Frank, Title VII, OSHA) provides baseline protections, but legal protection alone is insufficient. Design explicit institutional protections:
Create a formal investigation process. Reports that enter no process, or a process that reporters can't see, produce distrust and non-use of the channel. Design:
Train leaders to receive concerns. How leaders respond when someone raises a concern directly determines whether others will raise concerns later. Train all managers and leaders to:
Measure speak-up health. Use of speak-up channels is a health indicator, not a failure indicator. Establish metrics:
Financial services firm: Post-SOX compliance audit reveals the ethics hotline has received 3 reports in 2 years across 800 employees. Industry benchmark: 4–8 reports/year for this size. Investigation reveals: reporters learned that a 2019 report was traceable to a junior analyst who was subsequently excluded from a high-profile project. Redesign: switch to true third-party anonymous channel; conduct awareness campaign explaining the new protections; CEO publicly acknowledges that speaking up is valued. Reports normalize to 5/year within 18 months.
Healthcare organization: An OR nurse observes a surgeon leaving the OR during a procedure in a way that appears to violate protocol. She mentions it to her nurse manager, who says "I'd leave it alone." She doesn't escalate. Six months later, a patient outcome is linked to similar behavior. Post-incident review reveals the nurse's original observation was not documented. Redesign: speak-up training for all managers focused on receiving concerns; anonymous reporting channel for clinical concerns that bypasses unit managers; investigation process with timeline commitment.
Technology company: An engineer suspects a colleague is falsifying benchmark results in a competitive product evaluation. She's uncertain and doesn't want to damage the colleague's career over a suspicion. The framework provides: an "I have a concern, not a complaint" pathway that allows preliminary consultation with compliance without triggering a full investigation; an anonymous mechanism to report the suspicion; clear explanation of what will happen at each stage. She reports. Investigation confirms the falsification. The framework's non-accusation framing enabled reporting of a concern that would otherwise have been suppressed.
npx claudepluginhub jeffreytse/grimoire --plugin grimoireImplements GDPR-compliant whistleblowing systems per EU Directive 2019/1937, covering anonymous reporting channels, identity protection, retention limits, and access restrictions.
Designs and audits organizational documentation practices to establish institutional norms for recording events, failures, and decisions accurately without euphemism.
Rapid multi-framework ethical assessment for active incidents like data breaches, harmful outcomes, or policy failures. Walks through fact-finding, utilitarian, deontological, and care ethics lenses to map an immediate response.