Thank You!

You are attempting to access subscriber-restricted content.

Are You Ready to Experience Everything Internal Auditor (Ia) Has to Offer?


​Former Olympus CEO Michael Woodford shares what he’s learned since blowing the whistle on a billion-dollar fraud, and how internal audit can help prevent such scandals in the future.​​

Comments Views
Fraud Whistleblower

​​Whistleblowing is all the rage. Switch on the news and almost every month it seems that someone has gone public about misuse of public money, misdeeds by bankers, and violations of personal privacy. The number of calls to the United Kingdom’s Financial Conduct Authority (FCA), for example, increased by 23 percent over the past year — it received 4,718 calls on its whistleblower hotline by August 2013, according to law firm RPC LLP. In the United States, the Securities and Exchange Commission (SEC) recently reported that the number of whistleblower tips and complaints it received during fiscal year 2013 rose 8 percent compared to the same period in 2012.

Few people have blown whistles as loudly and with such effect as Michael Woodford. In March 2011, he was promoted to president and CEO of Olympus, a vast multinational Japanese organization known to households around the world for its cameras and to doctors for its precision medical technology. The job was the pinnacle of a career that began 30 years earlier when Woodford became a salesman in a U.K.-based Olympus subsidiary making industrial endoscopes.

Within months Woodford discovered, via articles in an obscure Japanese magazine, that his organization had been making bizarre and exceptionally expensive acquisitions in companies apparently unrelated to its core businesses or strategy. Even more alarming, the magazine hinted that massive and disproportionate payments to shadowy third-party advisers might be connected to organized crime.

Woodford raised the issue with the former president and the Olympus Group compliance officer, responsible for corporate compliance and governance. Their responses were evasive, so Woodford escalated the matter, writing six letters to the board and copying the later ones to the organization’s auditors around the world. He was then fired. The board’s press release cited irreconcilable differences and Woodford’s failure to conform to Japanese business style.

Woodford subsequently went public. Over the next 12 weeks he spoke to media in the U.K., the United States, and Japan as well as the Serious Fraud Office (SFO) in the U.K. and the U.S. Federal Bureau of Investigation. The consequences for Olympus were devastating. The organization’s share price fell constantly until it had lost nearly 80 percent of its former value, and reporters around the world gradually revealed that Olympus’ strange investments and payments to advisers were being used to cover up earlier losses of US $1.7 billion that had never appeared on its books.

Two senior directors, the former CEO and the Olympus Group compliance officer, plus one of the company's statutory auditors (or "Kansayaku" — an audit role unique to Japanese organizations and required by Japanese law), eventually resigned and were tried and given suspended sentences. Overseas shareholders demanded a new board and independent investigations and asked why Olympus’ external auditors had not been more critical. Although one of the organization's statutory auditors and compliance officer were tried, Woodford says that he has no evidence that any of the internal auditors at Olympus had any knowledge of the fraud.

And what about Woodford? Although he was hailed as a hero by some, he paid a huge price, both financial and otherwise. He paid more than £1 million (US $1.6 million) to lawyers over three months and then sued Olympus for unfair dismissal, subsequently receiving an out-of-court settlement. More importantly, he found himself isolated from, and sometimes attacked by, former colleagues whom he had counted as close family friends. He also spent several anxious months with police protection while the U.K. and Japanese security forces thought he could be targeted by the Yakuza, the Japanese mafia.

Now that the dust has settled on the Olympus affair, Woodford has become increasingly concerned with ensuring that other whistleblowers who identify fraud and criminal activity are protected and given the support they need. He is currently working with the whistleblowing charity Public Concern at Work, which released the findings of its Whistleblowing Commission in late November. He has also written a book titled Exposure, published by Penguin Portfolio, in which he chronicles his dramatic experiences — Exposure is expected to be released as a major motion picture in 2015. In July he will be speaking at The IIA’s International Conference in London and explaining what he believes organizations need to do to ensure that they encourage employees to speak out.

Even before his whistleblowing experience, Woodford says he firmly believed in the value of internal audit. “I was always a strong advocate of internal audit and helped to build up the function in the parts of the business I ran because it’s such an essential, basic discipline,” Woodford says. “I’m a passionate believer in internal audit and also in the importance of robust external audit for the business.”

For Woodford, attention to detail at the transactional level is essential. Recent drives to introduce cultural audits and improve tone at the top in banks and other organizations are all very well, he says, but too often they come down to rhetoric. He questions what terms such as “tone at the top” actually mean in practice — “It’s like trying to define love,” he says.

“We need to go in at a far more practical level and follow transactions through systematically,” he says. “All human beings have the potential to do wrong, so we need to stop this by showing that they will get caught. This is not cynical. It’s realistic.”

At an external level, he says, the U.K.’s Competition Commission — an independent public body that examines mergers, markets, and industry regulation — did not go far enough when it concluded that firms should regularly put their external audit contracts up for tender. He argues that all organizations over a certain size should have to change external auditors every 10 years to prevent the personal relationship from becoming too close.

Internally, he says that organizations must first define what they mean by whistleblowing. He is clear about his definition. While employment malpractices such as sexism, racism, and other forms of bullying or discrimination are important, he says these should be dealt with initially by human resources, because there are clear laws already in place.

For Woodford, true whistleblowing involves criminality. “The problem for whistleblowers is isolation,” he says. “If you are a middle manager and you think your organization is doing something wrong, to whom do you turn if you don’t trust those you report to?”

This is why he says it is vital that all organizations provide a route for whistleblowers to follow that does not involve going through executive management. “Executives can work to create an organization that has a strong culture and is transparent, but you need an independent whistleblowing line that everyone knows about and goes to a nonexecutive director [NED], such as the chair of the audit committee or the chair of the board,” he explains.

“Whereas the role of NEDs used to be seen as a job for the boys that involved a few lunches, now they carry a significant amount of personal liability if they don’t show oversight,” he says. “Putting them in charge of a whistleblowing line will be an onerous responsibility, but it’s already a huge responsibility to chair an audit committee.”

He adds that the role should be adequately resourced with investigative support, but that companies will get back more credibility from their investors and the media for showing that they take the issue seriously. “Whistleblowers shouldn’t be anonymous, but they should know that the organization will offer them as much protection as possible,” he says. “Organizations should, ideally, be able to deal with whistleblowing issues internally until it reaches the point that it goes to the regulator or the police. At the moment, middle managers have an incentive to ignore any misdeeds they see.”

When it comes to external support, Woodford adds that he has been impressed by the FCA’s whistleblowing line. Further help can be sought from Public Concern at Work in the U.K. and from the SEC’s Office of the Whistleblower in the United States.

Whistleblowing issues are particularly relevant to internal auditors, he says, because they are the key people involved in ensuring that an organization has these checks in place and that they are working. They are also, he says, in a good position to spot weak areas where criminal activity could occur.

“I’ve been accused of turning internal auditors into policemen, but in a way they do have that role,” he says. “They have to ensure that there is scrutiny and oversight in all areas, and I think that there should be a certain amount of tension when they conduct an audit.”

Not only should internal audit be involved in establishing a whistleblowing line that reports to a senior NED, but the function should also ensure that staff know about it and that the company discloses how many calls are made to it, Woodford maintains. The NED responsible should sign off on this. “The more transparency there is around the process, the better,” he says.

While Woodford maintains that strong internal whistleblowing procedures should mean that fewer people need to go to the press, he acknowledges the important role that the press played in his own and other major whistleblowing scandals. “The media is the ultimate safeguard of democracy,” he says.

Shareholders also have a major role to play. “They own the company, they can get rid of directors in many cases, and they can call extraordinary general meetings,” Woodford says. “Three non-Japanese shareholders in the Olympus case were excellent and started to demand the resignation of the directors early on in the scandal. They also offered me lots of practical support. Shareholders could be far more active in demanding whistleblowing lines in organizations — as could regulators.”

Of course the problem is that a scandal can cause an organization’s share price to fall, and this can lead to shareholder losses that are greater than those of the initial fraud — as happened at Olympus. This is unavoidable, Woodford says. “The whole system depends on believing the figures in the accounts. If you don’t believe this is important and you are not prepared to see the share price fall if there’s a problem, then you shouldn’t be a shareholder.”

He says that management should be more aware of the fact that internal audit, through the policies and processes it assesses, is a key defense against fraud and other misdeeds. “If management tries to restrict internal audit’s remit and the auditor stumbles across something worrying, it’s important they know they can go to a senior NED,” he says. He is skeptical about how independent any employee can be of the organization that pays his or her salary, but adds that a direct line to a NED would give employees a greater feeling of control and independence from managerial influence.

Despite protections that exist, it stands to reason that potential whistleblowers could still fear they will be victimized for their “disloyalty” to the organization. Woodford, however, sees it differently. “The world has changed,” he says. “There is much more cynicism about greed and excess in organizations these days. Whistleblowers are no longer seen as snitches. I’ve been offered jobs in the U.K. and in Japan since I was fired from Olympus, but I’d rather carry on doing what I’m doing now and make it easier for someone else to do it next time.”​


​*A version of this article first appeared in Audit & Risk, January/February 2014, the magazine of the Chartered Institute of Internal Auditors. Reproduced with permission. ​



Comment on this article

comments powered by Disqus
  • IIA GRC_July 2020_Premium 1
  • AuditBoard_July 2020_Premium 2
  • IDEA_July 2020_Premium 3