Billion dollar questions
Whistleblowing is all the rage. Switch on the news and almost every month it seems that someone has gone public about criminal negligence in the NHS, misuse of public money or misdeeds by bankers.
The number of calls to the UK’s Financial Conduct Authority increased by 23 per cent over the past year – it received 4,718 calls on its whistleblower hotline by August 2013, according to law firm RPC LLP. This must be good news for anyone who believes in ensuring that organisations act within the law. So what can internal auditors do to help?
Few people have blown whistles as loudly and with such effect as Michael Woodford. In March 2011 he was promoted to president and chief operating officer of Olympus, a vast multinational Japanese organisation, known to households around the world for its cameras and to doctors for its precision medical technology. The job was the pinnacle of a career that had begun 30 years earlier, when Woodford became a salesman in an Essex-based Olympus subsidiary making industrial endoscopes. He was a loyal Olympus lifer, counted many of his best friends among his colleagues, and had been rewarded by becoming one of only four non-Japanese presidents of Japanese organisations. What could possibly go wrong?
Within months Woodford discovered, via a couple of articles in an obscure Japanese magazine, that his organisation had been making bizarre and exceptionally expensive acquisitions in companies apparently unrelated to its core businesses or strategy. Even more alarmingly, the magazine hinted that massive and disproportionate payments to shadowy third-party advisers might be connected to organised crime and the Japanese mafia.
Woodford raised the issue with the former president and the Olympus Group compliance officer, responsible for corporate compliance and governance. Their responses were evasive, so he escalated the matter, writing six letters to the board and copying the later ones to the organisation’s auditors around the world. He was then fired. The board’s press release cited irreconcilable differences and his failure to conform to Japanese business style.
So Woodford went public. Over the next 12 weeks, he spoke to media in the UK, the US and Japan as well as the Serious Fraud Office (SFO) in the UK and the FBI in the US. The consequences for Olympus were devastating. The organisation’s share price fell constantly until it had lost almost 80 per cent of its former value, and news-hounds around the world gradually revealed that Olympus’s strange investments and payments to advisers were being used to cover up earlier losses of $1.7bn (£1.05bn) that had never appeared on its books.
Two senior directors, the former CEO and the Olympus Group compliance officer, plus one of the company's statutory auditors (or “Kansayaku” – an audit role unique to Japanese organisations and required by Japanese law), eventually resigned, were tried and were given suspended sentences. Overseas shareholders demanded a new board and independent investigations, and asked why Olympus’s external auditors had not been more critical. Although one of the organisation's statutory auditors and compliance officer were tried, Woodford says that he has no evidence that any of the internal auditors at Olympus had any knowledge of the fraud.
Olympus has now returned to profitability. However, the scandal rumbles on, as the SFO and US authorities have begun proceedings.
And what about Woodford? Although he was hailed as a hero by some, he paid a huge cost. This cost was not just financial. Although he paid out more than £1m to lawyers in three months, he then sued Olympus for unfair dismissal and received a record out-of-court settlement. More importantly, he found himself isolated from, and sometimes attacked by, former colleagues whom he had counted as close family friends. He also spent several anxious months with police protection while the UK and Japanese security forces thought he could be targeted by mafia.
Now the dust has settled on the Olympus affair, Woodford has become increasingly concerned to ensure that other whistleblowers who identify fraud and criminal activity are protected and given the support they need. He is working with Public Concern at Work, which released the findings of its Whistleblowing Commission in late November, and has published a book, Exposure, chronicling his experiences, which will become a major film scheduled for release in 2015.
In July this year, he will be speaking at the IIA’s international conference in London, and explaining what he believes organisations need to do to ensure that they encourage employees to speak out.
“I was always a strong advocate of internal audit, and helped to build up the function in the parts of the business I ran because it’s such an essential basic discipline,” he says. “I’m a passionate believer in internal audit, and also in the importance of robust external audit for the business.”
For him, however, attention to detail at the transactional level is essential. Recent drives to introduce cultural audits and improve tone at the top in banks and other organisations are all very well, he says, but too often they come down to rhetoric. He questions what phrases such as “tone at the top” actually mean in practice – “It’s like trying to define love,” he says.
“We need to go in at a far more practical level and follow transactions through systematically. All human beings have the potential to do wrong, so we need to stop this by showing that they will get caught. This is not cynical. It’s realistic.”
At an external level, he believes that the UK’s Competition Commission did not go far enough when it concluded that firms should regularly put their external audit contracts up for tender. He argues that all organisations over a certain size should have to change external auditors every 10 years to prevent the personal relationship from becoming too close.
Internally, he says that organisations must first define what they mean by whistleblowing. He is clear about his definition. While employment malpractices such as sexism, racism and other forms of bullying or discrimination are important, he says these should be dealt with initially by HR, since there are clear laws already.
For him, true whistleblowing involves criminality. “The problem for whistleblowers is isolation,” he says. “If you are a middle manager and you think your organisation is doing something wrong, to whom do you turn if you don’t trust those you report to?”
This is why he believes that it is vital that all organisations provide a route for whistleblowers to follow that does not involve going through executive management. “Executives can work to create an organisation that has a strong culture and is transparent, but you need an independent whistleblowing line that everyone knows about and goes to a non-executive director, such as the chair of the audit committee or the chair of the board,” he says.“
Whereas the role of non-executive directors (Neds) used to be seen as a job for the boys that involved a few lunches, now they carry a significant amount of personal liability if they don’t show oversight. Putting them in charge of a whistleblowing line will be an onerous responsibility, but it’s already a huge responsibility to chair an audit committee.”
He adds that the role should be adequately resourced with investigation support, but that companies will get back more credibility from their investors and the media for showing that they take the issue seriously. “Whistleblowers shouldn’t be anonymous, but they should know that the organisation will offer them as much protection as possible,” he says. “Organisations should, ideally, be able to deal with whistleblowing issues internally until it reaches the point that it goes to the regulator or the police. At the moment, middle managers have an incentive to ignore any misdeeds they see.”
When it comes to external support, Woodford adds that he has been impressed by the FCA’s whistleblowing line. Further help can be sought from Public Concern at Work in the UK and from the Office of the Whistleblower in the US. These issues are particularly relevant to internal auditors, he says, because they are the key people who will be involved in ensuring that an organisation has these checks in place and that they are working. They are also, he believes, in a good position to spot weak areas where criminal activity could occur.“
I’ve been accused of turning internal auditors into policemen, but in a way they do have that role,” he says. “They have to ensure that there is scrutiny and oversight in all areas and I think that there should be a certain amount of tension when they conduct an audit.”
Not only should internal audit be involved in establishing a whistleblowing line that reports to a senior Ned, but the function should also ensure that staff know about it and that the company discloses how many calls are made to it. The Ned responsible should sign this off. “The more transparency there is around the process, the better,” he says.
But will this process remove whistleblowers’ fear that they will be victimised for their “disloyalty”? “The world has changed,” says Woodford. “There is much more cynicism about greed and excess in organisations these days. Whistleblowers are no longer seen as snitches. I’ve been offered jobs in the UK and in Japan since I was fired from Olympus, but I’d rather carry on doing what I’m doing now, and make it easier for someone else to do it next time.”
And what about the role of the media? While he believes strong internal whistleblowing procedures should mean that fewer people need to go to the press, he acknowledges the important role that the press played in his own and other major whistleblowing scandals. “The media is the ultimate safeguard of democracy,” he says.
Shareholders also have a major role to play, he believes. “They own the company, they can get rid of directors in many cases and can call extraordinary general meetings. Three non-Japanese shareholders in the Olympus case were excellent and started to demand the resignation of the directors early on in the scandal. They also offered me lots of practical support,” he says. “Shareholders could be far more active in demanding whistleblowing lines in organisations – as could regulators.”
The problem is that a scandal can cause an organisation’s share price to fall and this can lead to shareholder losses that are greater than those of the initial fraud – as happened at Olympus. But this is unavoidable, Woodford says. “The whole system depends on believing the figures in the accounts. If you don’t believe this is important, and you are not prepared to see the share price fall if there’s a problem, then you shouldn’t be a shareholder.”
He believes that management should be more aware of the fact that internal audit, through the policies and processes it assesses, is a key defence against fraud and other misdeeds. “If management tries to restrict internal audit’s remit and the auditor stumbles across something worrying, it’s important they know they can go to a senior Ned,” he says.
He is sceptical about how independent any employee can be of the organisation that pays their salary, but adds that a direct line to a Ned would give them a greater feeling of control and independence from managerial influence.
At the international conference this July, Woodford plans to share his insights into the human behaviours that come to the fore when you have a “governance meltdown”.
“How people act in an organisation, and how organisations seem to instinctively protect themselves rather than consider the rights and wrongs, is all about how people respond to issues of loyalty and betrayal. Organisations are tribal – like football clubs or like the family in The Godfather,” he says. “Internal auditors have to be able to stand in other peoples’ shoes. Ask how you would react in their place. I’ll use my story to share my experiences in this.”
This article was revised on 19 February to clarify the roles of the senior managers tried for fraud in the Olympus case.
Further information
The IIA has also contributed to a BIS consultation on whistleblowing and the policy team has been working with Public Concern at Work on the role of internal audit in whistleblowing. It will publish a paper in early 2014 giving guidance and examples.
Michael Woodford’s book about the Olympus scandal, Exposure, is published by Penguin, price £9.99. It is being made into a film. All proceeds go to Woodford’s charitable trust that supports a range of causes including The Safer Road Foundation and Reprieve.
This article was first published in Audit & Risk January/February 2014.
