That sounds like good policy, although there may be significant variation in what sounds awful to different people (specifically, "whom" is generally more popular outside the US). "Who" is probably the safer choice when in doubt, admittedly.