An investigation that identifies a problem and changes nothing is worse than none, because it establishes knowledge without a response.
Root cause, not proximate cause. Identify why the control failed — incentive structure, resourcing, unclear ownership, tone at the top — rather than stopping at who did what. Regulators consistently distinguish these.
Discipline. Proportionate, consistent across levels, and documented. Disciplining junior staff while sparing the executives who set the pressure is the pattern that draws the most criticism.
Compensation consequences. Clawback and forfeiture of incentive compensation where policies allow it, and adopting such policies where they do not.
Control changes. Specific, owned, dated. Then tested — a control that was implemented but never verified is treated as not implemented.
Training. Targeted at the population and behaviour concerned, rather than an annual module for everyone.
Reporting. To the board or committee, on the findings, the plan, and subsequently on completion. The follow-up report is the one most often missing.
Retaliation. Watch the treatment of the person who reported. A remediated issue accompanied by a constructive discharge claim from the whistleblower is a worse position than before.
Records. Keep the evidence of remediation. If the matter surfaces later, the question will be what was done, and the answer must be documented rather than recalled.