How to set up a complaints and feedback mechanism (CFM)

A complaints and feedback mechanism is the way the people you serve, your staff and your partners tell you what is going wrong, and the way you answer. This guide covers the design, the channels, the handling of sensitive complaints, the data protection side, and what to ask of a system that records it all.

The short answer

A complaints and feedback mechanism (CFM, also written FCRM for feedback, complaints and response mechanism) is a set of channels, rules and people that lets anyone raise a concern, gets it to the right place, and closes the loop with an answer. Build it with the communities you serve, run sensitive complaints such as sexual exploitation and abuse on a separate, confidential track, and measure how many you receive, how fast you respond and what you change. Keep the records locked down: complaints are personal data and often sensitive.

What a CFM is

People use several words for the same idea: complaints and feedback mechanism, feedback mechanism, community feedback mechanism, and FCRM. They all describe a system with three parts: ways to raise something, a process that handles it, and a response to the person who raised it.

It deals with more than complaints. Most of what arrives is feedback in the wider sense:

Questions and requests for information, such as who is eligible and when the next distribution is.
Suggestions and praise.
Complaints about the quality, timing or fairness of the assistance.
Sensitive complaints: sexual exploitation and abuse, harassment, fraud, corruption, threats and other misconduct by staff, volunteers or partners.

The last group needs different rules from the rest, which is why a good CFM has two tracks. The first part of this guide covers the common design. The section on sensitive complaints covers the second track.

Why you need one

Accountability to the people you serve is a core idea of humanitarian and development work. The Core Humanitarian Standard, published by the CHS Alliance, dedicates one of its nine commitments, Commitment 5, to complaints: communities and people affected by crisis should have safe and responsive ways to complain. Many donors and partners now ask to see how you meet it, and the humanitarian sector’s rules against sexual exploitation and abuse of the people we serve require organisations to have a way to receive reports. The Secretary-General’s Bulletin ST/SGB/2003/13, Special measures for protection from sexual exploitation and sexual abuse, issued on 9 October 2003, set the UN’s standard for it, and many agencies and funders have written it into their own agreements.

It also works as an early warning system. A pattern of the same complaint, from the same village or about the same partner, tells you about a problem long before an audit does.

Design it with the people who will use it

The most common failure is a mechanism designed in an office that nobody uses. Ask the people it is for how they would raise a concern, who they would trust to receive it, and what would stop them. Ask separately with women, men, girls, boys, older people, people with disabilities and minority groups, because their answers differ. Then offer more than one channel.

Face to face, with a trained staff member or volunteer: Works well for: People with low literacy or little access to phones; trust built over time. Watch for: The person receiving may be the person complained about; record it in writing straight away
Suggestion or complaints box: Works well for: Anonymous, low-tech feedback in a fixed site. Watch for: Boxes need emptying on a schedule, and women and children may not feel safe using a box in the open
Phone line or hotline: Works well for: Wide reach, questions and complaints, people who cannot travel. Watch for: Cost of calls, opening hours, languages, and who answers outside them
Messaging apps and SMS: Works well for: Places where people already use WhatsApp or text. Watch for: Data protection of the messaging provider, and a phone number is personal data
Web form or QR code: Works well for: Staff, partners and connected communities; QR codes on posters and distribution points. Watch for: Excludes people without a phone or data; test it on a cheap handset
Community committees and focal points: Works well for: Reaching people who would not call. Watch for: They need training, a way to pass on sensitive reports, and protection from pressure

Whatever you choose, tell people it exists, what it is for, what happens after they use it and how long you will take to respond. A mechanism nobody knows about is a mechanism nobody uses.

Sensitive complaints need their own track

Reports of sexual exploitation and abuse, harassment, fraud or threats should not go through the same path as questions about the distribution date. The usual good practice:

Front-line staff and focal points receive the report and write down what the person chose to say. They do not investigate, question the person for detail or try to resolve it.
The report goes straight to a trained person, such as the safeguarding or PSEA focal point, within the time you have set. It does not pass through the programme manager if the complaint may involve them.
The person who raised it is told what will happen next, and offered support when the report concerns harm to them, with their consent.
The case is investigated by people who are independent of the matter, with access to the file limited to those who need it.
Outcomes are reported to donors and the board in anonymised form.

If you work with partners, agree in the partnership agreement who receives which reports, and who informs the donor. Staff and partners need a way to raise a concern as well, and it has to protect them from retaliation.

Eight steps to set one up

Decide what the mechanism covers: which programmes, which countries, and who can use it (communities, staff, partners, suppliers).
Consult the people it is for on channels, languages, who receives, and what would make them afraid to use it.
Choose channels, and make sure at least one needs no phone and no literacy.
Define categories and routing: what is feedback, what is a complaint, what is sensitive, and who handles each. Write it in one page that every receiver can follow.
Set response commitments: how soon you acknowledge, how soon you respond, and when the person hears back if it takes longer. Publish them.
Train the people who receive: listening, writing down what was said, not investigating, confidentiality, where to send sensitive reports.
Tell people it exists: posters, announcements, a line at registration and distribution, in the languages and forms they use.
Review: how many came in, by which channel and category, how fast you responded, what changed. Present it to management and back to communities.

Handling what comes in

Give every item a reference, a date, a channel, a category, an owner and a status. A simple routing table helps everyone know what happens next:

Question or request for information: Who handles it: The programme team or the receiver. Typical response: Answer directly and record that it was answered
Suggestion or praise: Who handles it: The programme team. Typical response: Thank the person, record it, feed it into reviews
Complaint about the programme: Who handles it: The programme manager, with the MEAL team. Typical response: Investigate, decide, explain, correct if justified
Sensitive complaint (sexual exploitation and abuse, harassment, threats): Who handles it: The safeguarding or PSEA focal point only. Typical response: Confidential track with survivor-centred support
Fraud or corruption: Who handles it: The designated senior person or the audit function. Typical response: Investigation with access limited to need-to-know

Close the loop. Tell the person what you found and what you did, even when the answer is no, and record that you did. People stop using a mechanism that never answers.

Data protection

A complaint is personal data about the person who made it, and often about other people too. Sensitive complaints can contain health data, information about abuse, or details that put someone at risk if they leak. Three rules follow.

Collect only what you need to handle the case. Anonymous reporting is valid, and you must be able to handle a report without a name.
Restrict access. Sensitive cases should be visible only to named people, with a record of who opened them.
Decide how long you keep records, and delete them when that period ends.

A mechanism that holds this kind of information about vulnerable people is likely to need a data protection impact assessment before it starts. Read our guide to DPIAs for NGOs, which comes with a template. If your organisation is not sure who should sign this off, read does an NGO need a DPO?

What to measure

Track a few things consistently, and report them back to management and to communities:

How many items came in, by channel and by category.
How many were acknowledged and closed within the commitments you published.
Who is using the mechanism, by sex, age and location where you collect it, and who is not.
The most common themes, and what you changed because of them.
Whether people are satisfied with the response, asked at closure.

Low numbers do not prove all is well. They can mean people do not know about the mechanism, do not trust it or cannot reach it. Compare them with the size of the programme and with what staff hear informally.

What a system should do

A spreadsheet and a shared inbox can work for a small programme. They stop working when sensitive cases arrive, when several teams share the mechanism, or when a donor asks you to show how each case was handled. Look for a system that can:

Receive reports from several channels (web form, phone line recorded by a focal point, QR code) into one register, anonymously if the person wants.
Work offline for field staff and sync later.
Route by category, and keep sensitive cases visible to named people only, with an access log.
Track every case from receipt to closure, with owners, deadlines and reminders.
Hold support plans and referrals for people who have been harmed.
Produce anonymised reports for donors and the board, and link themes to the programme’s results.
Let you set retention periods and delete on time.

Relief One’s Safeguarding and Complaints module is built around those points: a confidential channel open to staff, partners and communities, restricted case files with a full access log, and an investigation workflow. Feedback from communities also feeds the MEAL module, next to the indicators it affects.

Mistakes we see

One channel, usually a hotline or an email address, that excludes the people most at risk.
A mechanism that is launched with a poster and then never mentioned again.
Sensitive complaints handled by the manager the complaint is about.
No response commitment, so cases sit open.
Recording complaints in a notebook or a shared spreadsheet that anyone in the office can open.
Counting complaints without ever showing what changed.

Questions and answers

What does CFM stand for?

Complaints and feedback mechanism. The same thing is also called FCRM (feedback, complaints and response mechanism), community feedback mechanism or accountability mechanism.

What is the difference between feedback and a complaint?

Feedback covers suggestions, questions, requests and praise. A complaint says something went wrong or someone is dissatisfied. Both go in one mechanism, because people do not always know which one they have, and you should handle both.

Do we need a separate channel for sexual exploitation and abuse?

You need a separate track, with its own routing, confidentiality and trained receivers, even when people can raise it through the same entry points as other concerns.

Can people complain anonymously?

Yes, and a good mechanism allows it. You should be able to act on an anonymous report, and you should tell people that giving contact details lets you reply to them.

How fast should we respond?

Set response times that you can meet, for acknowledging and for answering, and publish them. The right figures depend on your context and on your donors’ requirements, so we do not give a single number.

Is a complaints mechanism personal data under the GDPR?

Yes. A complaint identifies the person who made it, and often others, and can include special category data. Apply data minimisation, restrict access and consider a data protection impact assessment.

See a confidential case from report to closure

Book a demo of Relief One. We show how a report comes in, who sees it and how it is closed, and the safeguarding module in full.

Book a demo

Keep reading

Safeguarding and Complaints module: A confidential channel and restricted case files in Relief One.
MEAL module: Where community feedback sits next to your indicators.
DPIA for NGOs, with a template: Assess the risk before you launch a mechanism that holds sensitive data.
Case study: a data protection directive for child protection case management: Work for Terre des hommes.

This guide is general information, not legal or technical advice. Reviewed on 11 November 2026 by the team at Relief Applications.