For compliance programs to be effective, bad behavior must be reported internally to management and an avenue must exist to report externally to regulators and the media. For whistleblowers to be willing to come forward, it is critical that they are protected.