Now that the SEC has approved the rules, with a few surprises, it is important for every internal auditor to understand them. They can impact not only the way in which people can report potential wrongdoing, but also the mindsets of management and employees.

Just think about what would happen if an employee got a massive bounty. Perhaps a friend received one at another company. Wouldn't other employees start thinking about how they can do the same? Yes, wrongdoers would be inhibited by the additional likelihood of capture, but will this be a good thing for employee morale, behavior, etc? We may have to wait to see.

But auditors shouldn't wait to make sure they understand the rules and work with management, especially legal counsel, the ethics, and the compliance team, to figure out whether action is required. It is probably wise to review the Code of Conduct, for example.

I recommend the alert from Protiviti on the topic. It's a bit dry, but important.

Oh, by the way, internal auditors are not eligible for the SEC bounty unless certain conditions are met (see Tim's comment below). Sorry about that.