Is a company with no whistleblower reports a healthy one, or one that has simply stopped listening? Kyle Welch's research points to the latter. Using the largest database of internal corporate whistleblowing reports in the United States, the George Washington University School of Business accountancy professor has found that companies with more internal reports tend to face fewer lawsuits, lower fines and less negative press. As reporting volumes hit record highs and the SEC issues eye-catching awards to those who expose corporate wrongdoing, Welch spoke about why silence persists, why managers misread their own data and why he considers whistleblowing a quintessentially American act.
: In what industries or sectors are we most likely to hear about whistleblowing, and why?
First, it helps to separate hearing about whistleblowing from actively using it because most of what reaches the news is a failure of a whistleblowing system. If a system works, someone reports a problem, it gets dealt with inside the company and there is no news story at all.
The industries with the most active systems tend to be the most regulated ones because they have the most on the line. In healthcare, you need a way for people to report incidents anonymously, both internally and to regulators, because people’s lives are risk if something goes wrong. Banking and finance are similar, in large part because the fines are so large. A company like McDonald's surely has a system, but I imagine it is not nearly as central, because so much of what they do is standardized.
The useful way to think about it is that an active system gets you ahead of problems. We tend to assume a good organization is one without problems, but there is no such thing. Organizations are like families: there are no problem-free families; only families that know about their problems and families that do not. The transparent ones get ahead of things.
: If internal whistleblowers make companies aware of weaknesses or violations, why isn't reporting more widely encouraged?
There is a counterintuitive trap here. If I offered you a choice between running a company with lots of internal reports and one with almost none, most people would take the one with almost none, assuming it is run better. But that is not what the data shows. Using millions of reports from publicly-traded companies, we found that the companies with more reports had fewer lawsuits, lower fines, lower settlement amounts and fewer negative news stories.
The mistake managers make is assuming that no reports means no problems. You have problems no matter what; the question is whether you know about them. It is very easy to get zero reports: you just make the system hard to find. That does not make the problems disappear.
The harder part is that these systems do get abused. Sometimes an employee who senses they are about to be let go will file a report on the day of their termination because they know the protections that come with it. Those protections matter, but you also need to be able to let people go when it is warranted. Balancing the two is genuinely difficult and it is part of why the topic does not get the attention it deserves.
: When there is a scandal, we often hear of one or two whistleblowers. Why does everyone else stay silent?
Part of it is that not everyone knows. But a big part is fear of retaliation, and a lot of that fear is built on a distorted picture. You only hear about whistleblowing when it fails, when management did not respond and it ended up in the press. So the data people absorb is filtered for failures.
There is also a deep social instinct to conform and classic psychology experiments show it. In the Asch conformity experiments (1950s), people gave an obviously wrong answer about the length of a line because everyone else in the room did. In Milgram's experiments (1961), a majority of participants kept administering what they believed were dangerous shocks because someone in a lab coat told them to continue. In the smoke-filled-room studies (1968), people who would report smoke when alone stayed silent when others in the room ignored it. We are socially evolved to go along with the group, and that instinct works against speaking up.
I would also push back on the idea that we are living in an age of fraud. We are living in an age of uncovering fraud. There is almost certainly not more wrongdoing now than in the past; what has changed is that people feel more empowered to speak up about it, name it and bring it to light. The reports we see are less a sign of rising misconduct than of a growing willingness to report it.
: Are whistleblowers seen as guardians of a company's integrity or as disloyal to their employers?
It depends on the employer, but in America it is close to a badge of honor. When you hear about someone standing up and speaking out, that reads as a quintessentially American act, and it comes straight out of having First Amendment rights. Organizations in other countries often wish they had a culture where people speak up the way Americans do.
If you work somewhere that does not want your feedback, you should go somewhere that does. This is a competition among companies, and the best ones win. That said, I almost always recommend reporting internally first. It is like a family. If a parent has a bad day and crosses a line, the better first step is usually a spouse saying that has to change, not an immediate call to the authorities. Give the organization a chance to fix it. And if a company refuses, there is almost always an external regulator you can turn to, especially anywhere consumers could be harmed.
: What is the biggest risk for internal whistleblowers, and do HR departments have the tools to support them?
In highly-regulated industries, they generally do. The biggest risk comes in lightly regulated ones, and that usually means fast-growing technology and disruptor companies. When you see a whistleblowing situation blow up in health care or banking, you know there is real rot at the top, because everyone in those industries understands the consequences of noncompliance. In newer, faster-growing companies, the compliance function often has not caught up. Uber faced serious internal problems it did not treat with the seriousness they deserved, and OpenAI drew hard questions over how it handled a whistleblower. Those are the environments where reports are most likely to be mishandled.
: The SEC's Investor Protection Fund issued some high-value awards this year, including one above $50 million in April and another around $20 million in June. Do these incentives encourage employees to bypass internal reporting?
Yes and no. The SEC actually strikes close to the right balance. If you raise an issue internally first and management ignores it, and you then report to the SEC and it results in a finding, you are eligible for more. So the structure rewards going internal first while still protecting you if you have to go external.
The risk is gaming. I can imagine someone filing a deliberately vague report that looks obvious only in hindsight, then pointing to it later. There is also real ambiguity about what counts. As one financial commentator likes to put it, almost everything is securities fraud. Misstating earnings clearly qualifies. But take the person who reported that Facebook knew its products were harming teenagers. I am glad she spoke up, and I want that known, but whether it is truly securities fraud, as opposed to a product-harm problem, is a real question. It may be that we need a separate reward system for exposing products that are harmful to the public, rather than routing everything through securities law.
: Even with those large payouts, the number of rewarded whistleblower claims has dropped. Is the government losing interest?
Not at all. It is going the other direction, with more agencies offering more rewards. You cannot read much into the ratio of awards to total reports, because a very small number of individuals file an enormous share of the claims. At one point, something like 80 percent of reports were coming from just a few people. As more people realize there is money in helping the government catch fraud, you get more frivolous filings, which distorts the denominator.
You also cannot see the whole picture, and that is the real difficulty. If fewer awards are going out, one explanation is that executives increasingly understand they cannot get away with things, so they play it clean. We only see the crimes that surface, not the ones that were quietly deterred, so it is hard to draw conclusions from what looks like a decline.
: What new research are you working on now?
We are digging into how reports actually get substantiated and what leads to real solutions inside a company. There is a lot that is counterintuitive about how reports are investigated and which ones end up driving change, and that is the area we are focused on.