After a whistleblower investigation, the step before accepting an action plan is to assign an independent decision owner to one substantiated finding. In October 2011, Olympus dismissed president Michael Woodford after he had raised concerns about company transactions. The investigation that followed expanded beyond the acquisitions initially under scrutiny.
The follow-up decision needs a clear problem statement. Closing the report, correcting a transaction and changing who can approve future transactions can require different actions.
A whistleblower investigation examines reported wrongdoing, gathers evidence and reaches findings within an agreed scope.
Olympus had to investigate the transactions behind the complaint
The Third Party Committee's December 2011 report records Woodford's removal on 14 October. Shareholders continued to question large payments involving the Gyrus acquisition and three domestic company acquisitions. Olympus appointed five lawyers and one accountant without conflicts to investigate the transactions and governance. The committee began work on 1 November.
On 8 November, Olympus disclosed deferred recognition of investment losses dating to the 1990s. The investigation's scope then expanded to include suspected loss-deferral transactions. The committee issued its report on 6 December. A question about acquisition payments had developed into a wider examination of concealed losses and governance.
In its response published on 7 December, Olympus acknowledged that it had postponed recognition of securities losses over many years. It also acknowledged false financial statements and the committee's criticism of governance defects. Those findings required attention beyond explaining individual payments.
The report is an investigation into transactions, loss deferral and governance. It is not a dedicated inquiry into whistleblower protection or retaliation. Its English version is marked as a translation for reference. The committee's findings should not be treated as a court judgment or proof of every concern Woodford raised.
The scope of the follow-up decision should reflect what the investigation established. An organisation applying this lesson would ask whether a proposed remedy addresses a particular payment, an approval process or the authority of those who approved it. These are separate questions. A correction to the financial record could leave the approval process unchanged.
That is the practical value of defining the problem before choosing a solution. A board can ask for a list of completed tasks. It can also ask which decision allowed the substantiated problem to continue. The second question changes what evidence the action plan must contain.
Consider the follow-up to a substantiated finding about an improper payment. The decision owner should locate the approval rule in force at the time. They should then identify who could authorise an exception and who could challenge it. This is an illustrative checkpoint, not a description of an Olympus remedial program.
A proposed training session addresses lack of knowledge only if the evidence supports that explanation. A revised approval form addresses missing information only if the missing information mattered. If people could bypass an existing rule, the owner needs to examine that authority before accepting either measure. The report's finding supplies the starting point for this work.
Frame the task as resolving the exposed decision or control problem before treating the report as closed. The owner can retain the original finding and add a precise question beneath it. For example: what must change so the next comparable payment cannot proceed without an effective independent challenge?
The figure shows a proposed follow-up checkpoint. It does not imply that the committee used this process. Olympus supplies the documented example of an inquiry whose scope widened. The decision method supplies the question an organisation can use when deciding what to do with a completed report.
An independent investigation does not remove the need for an independent decision about its findings. Whoever accepts the remedy must be able to question its scope and evidence. That distinction belongs in organisational governance, because the acceptance decision determines who can continue exercising authority and under what conditions.
Before approving the response, define the control problem that the substantiated finding exposed. Start the Walk →
What does a completed whistleblower investigation establish?
A completed report can distinguish supported findings from allegations that remain unresolved. It can preserve the reasoning behind those findings and identify limits in the evidence. Those distinctions help the decision owner avoid treating every allegation alike. They also help explain why a particular issue needs corrective action or further inquiry.
The US Department of Justice's September 2024 compliance guidance asks whether investigations were properly scoped, independent and documented. It also asks whether findings exposed root causes, system vulnerabilities and accountability failures. These are questions for evaluating corporate compliance programs, rather than a universal rule for every investigation.
A response plan can then assign work, identify resources and establish dates for review. That is useful coordination. It gives people a common record of what must happen. The problem arises when completion of those tasks becomes the only basis for accepting the response.
A revised approval form is filed. The response is accepted without checking whether the same person can still bypass approval.
The independent owner checks exception authority and evidence from the revised process before accepting the remedy.
This comparison is a proposed acceptance test. It does not predict that every form change will fail. The action plan needs evidence that its measures address the substantiated problem. The relevant question is whether the changed process works in the circumstances that exposed the original weakness.
The same distinction appears in follow-up after internal audit. A finding and a recommendation help define work. The person approving that work still has to decide whether the proposed response is adequate. Independence matters where the response concerns the decisions of a powerful manager.
A report may also leave questions outside its remit. Evidence about a transaction does not, by itself, establish how the reporter was treated. Unexamined protection questions should remain visible when the substantive investigation ends. Record them as separate questions for the appropriate policy process, with access restricted according to applicable requirements.
Assign an independent owner before approving corrective actions
Before the next action-plan approval meeting, prepare a one-page finding-to-decision note. Start with one substantiated finding and its report locator. State the decision or control problem in plain words. Name the person authorised to accept the response and record any conflict that could affect their judgment.
The owner needs authority to reject a proposed remedy that leaves the defined problem unresolved. If the finding concerns that owner's own decisions, refer acceptance to an appropriate independent authority. The allocation of decision rights should make that route clear before corrective actions are approved.
Who can reject the remedy if the exposed control problem remains?
Where the finding leaves a choice of remedies, record the alternatives briefly. Compare a narrower approval limit with a separate reviewer, for example. Identify what each option would change and which weakness it would leave. The independent owner can then accept a reasoned choice rather than a single recommendation whose purpose has never been stated.
The note should identify the proposed change and the evidence needed to accept it. For an approval weakness, that might mean examining a completed transaction under the revised process. Define which exception would require another review. Avoid a closure condition that merely asks whether a new policy has been issued.
Keep reporter protection and confidentiality within their proper scope. The UK Serious Fraud Office's own policy addresses reported victimisation, limited disclosure of identities and feedback subject to confidentiality. That policy illustrates separate follow-up questions. It does not prescribe the rules for other organisations or jurisdictions.
The owner should ask which local protections and internal policies apply, and who will examine any concern about adverse treatment. Record what feedback can be given to the reporter and who may access the underlying evidence. Obtain appropriate advice where those requirements are unclear. Do not assume that a substantiated transaction finding answers these questions.
The Universal Decision-Making Method starts by clarifying the decision's Purpose and frame. Here, the Purpose is to resolve the defined problem while meeting the relevant obligations. That frame permits different remedies and makes their adequacy open to challenge before the organisation accepts them.
Urgent protective action may need to proceed before this note is complete. Record the immediate reason, the person authorising it and when it will be reviewed. An interim measure should not become an accepted permanent remedy merely because it was introduced quickly.
Finally, set a review trigger in the decision record. A repeated exception, missing evidence or a new concern about the response should bring the decision back to its owner. Name who receives that signal. Close the finding only against the agreed acceptance evidence, with unresolved questions assigned to their own process.
Who has the authority to reject your whistleblower action plan if the exposed problem remains unresolved?
Work through your decisionNo sign-up. Just pick your decision and start.
Grant Purdy is the co-author, with Roger Estall, of Deciding (2020), and the architect of the Universal Decision-Making Method.