Many companies invest heavily in compliance infrastructure and encourage employees to raise concerns internally first.
At the same time, the law gives some whistleblowers strong reason to take their concerns to the SEC rather than rely on internal reporting alone. In Digital Realty Trust v. Somers, the Supreme Court held that Dodd-Frank's anti-retaliation protections reach only those who report to the Commission.
That creates an interesting tension. Organizations may assume they have time to investigate, assess, and respond internally. The reality is that a report may already be sitting with a regulator by the time the company learns about it.
For compliance leaders, that's an important shift in mindset. The question is no longer whether an issue will be reported externally. It is how quickly the organization can respond once concerns are raised internally.