Whistleblower protection is not one law but a set of overlapping federal and state regimes, each with its own covered conduct, procedure and deadline. Two features are common to most.
Protection does not depend on being correct. An employee who reports conduct they reasonably believe to be unlawful is generally protected from retaliation even if the belief turns out to be mistaken. The employer that investigates the report and then disciplines the reporter is exposed regardless of what the investigation found.
Deadlines are short and vary. Some regimes require an administrative filing within months rather than years, and filing in the wrong forum can forfeit the claim. This is the single most important practical point for an employee considering their options.
Awards. Several regimes provide monetary awards to individuals whose original information leads to a successful enforcement action, which changes the incentive structure considerably and means an internal report may also be an external one.
For employers, the implications are procedural. Route reports through a defined channel. Investigate them properly and document that. Separate the decision-makers who handle discipline from those who received the report where possible. And treat any adverse action against a reporter as requiring a documented, independent justification prepared in advance.