Edmund Burke's famous 18th-century dictum encapsulates why compliance efforts cannot rely on written policies or codes of conduct alone. After all, Enron had policies on paper forbidding the practices that brought down the company. Without people willing to report violations of law or codes of conduct, compliance efforts inevitably will be frustrated.
The thesis of this article is that the new civil and criminal whistleblower provisions of Sarbanes-Oxley, coupled with growing acceptance of whistleblowing in both the law and popular culture, may create a climate in which employees more frequently engage in "undersight" to report violations of law or policy. "Undersight" is a term this author has coined to describe corporate employees who witness potential fraud first-hand and voice their concerns, in contrast with "oversight" through which corporate outsiders attempt to detect fraud relying on second-hand information.
Undersight is a culture issue. No one wants to be known as the "Stool Pigeon" or the "Rat" who attempts to undermine the organization with a warning bell about someone or some procedure that is flawed. How you promote the use of "Undersight" in your company begins with management behavior.
To the extent that fear of retaliation has deterred employees from identifying themselves by openly raising concerns, the ability to make anonymous complaints knowing that such complaints must be investigated may encourage whistleblowing. Put differently, before SOX, it may have been easier to rationalize remaining silent based on fears of retaliation. The new stature given to anonymous complaints, however, may give employees greater assurance that their identities will not be discovered, and that their concerns still will be addressed. Thus, a common rationalization for not blowing the whistle may be significantly undermined.
Even as SOX has heightened the issues around detecting and reporting internal fraud by employees, it still may be the external auditors who remain the bad guys. Have you ever made it obvious to an outside auditor that you have a "hunch" or suspect something isn't right? Just remember, you don't have to wait. Audit Committee's are obligated to investigate any anonymous tips, regardless of the outcome.