By any measure, the whistleblower bounty provisions of the Dodd-Frank Act have been an unmitigated success in bringing essential information to the Securities and Exchange Commission, leading to substantive enforcement actions. According to an SEC press release, the whistleblower program has led to over $500 million in financial remediation paid by companies and bounties paid to 33 whistleblowers have now exceeded the $107 million mark. According to SEC Chairperson Mary Jo White, “The SEC’s whistleblower program has proven to be a game changer for the agency.”

These whistleblower reports have come from far and wide, including all 50 states and 95 foreign counties as well. The SEC has also been active in prosecuting companies that it believes has tried to dampen employees’ legal right to report illegal conduct to the SEC. The SEC had concluded enforcement actions against companies that have forbidden employees from reporting to the SEC in confidentiality agreements (KBR); companies that attempted to forbid employees from receiving the statutorily mandated whistleblower bounties in severance agreements (Health Net Inc. and BlueLinx Holdings), and one company that made an award to a whistleblower who suffered retaliation as a result of reporting his employer’s illegal conduct to the SEC (Paradigm Capital).

There were recent reports that the SEC has paid its first whistleblower award for a Foreign Corrupt Practices Act (FCPA) enforcement action. The Financial Review (Australia) initially reported that a whistleblower received a $3.75 million payment for alerting the SEC to the actions of the Australian-based BHP Billiton around its travel and entertainment program for foreign government officials during the 2008 Beijing Olympics. Billiton paid a fine of $25 million for its failures around internal controls, the highest fine ever for an internal controls-only civil FCPA enforcement action. Many wondered how the matter came to the attention of the SEC as the FCPA resolution documents did not report that Billiton self-disclosed, or even how the SEC became aware of the matter. From the reports by the Financial Review, we now know it was through an anonymous whistleblower.

While the whistleblower bounty has been a boon for SEC enforcement, there have been some criticisms of the SEC in its prosecutions of firms for violations of U.S. securities law. Indeed, two whistleblowers have been in the news for some interesting reasons surrounding their whistleblower awards.

The first is Eric Ben-Artzi, a Deutsche Bank employee, who—along with another fellow employee—reported to the SEC that Deutsche Bank had improperly inflated its self-reported values on a portion of its portfolio of credit derivatives. The SEC awarded both whistleblowers a combined $16.5 million award, but Ben-Artzi declined his portion of it, requesting instead that his share be given to Deutsche and its stakeholders and the amount of it be clawed back from the bonuses paid to Deutsche senior executives. His logic was that the fine his whistleblowing helped to create would be borne by Deutsche Bank’s shareholders, who really were not at the heart of the problem. Who was, he pointed out very publicly in an op-ed to the Financial Times.

The whistleblower bounty program created under Dodd-Frank can only be called a success, in bringing in substantive information to the SEC to help stop corporate fraud. The critiques by Ben-Artzi and the Monsanto whistleblower, however, remind us all that questions are still open on the full scope of SEC enforcement.

In the FT piece, Ben-Artzi complained that the fines levied against the bank in other SEC actions would be borne by Deutsche Bank shareholders rather than those he deemed responsible—the senior management who led the efforts. He believed that many top executives had their bonuses based on these inflated numbers, and their actions not only cemented their compensation but also hurt the bank’s employees because of the fraudulent valuations place on bank assets.

Yet Ben-Artzi went even further than that, blaming the “revolving door” of SEC officials who came from Deutsche Bank without ever pointing to any actions by their former colleagues, or even if any of those former Deutsche Bank officials were involving in this enforcement action, which ultimately led to a fairly light penalty sustained by the Bank. Robert Rice, Ben-Artzi wrote, was the chief lawyer in charge of the internal investigation at Deutsche in 2011 and became the SEC’s chief counsel in 2013. Robert Khuzami was Deutsche’s top lawyer in North America and became head of the SEC’s enforcement division after the financial crisis. Richard Walker was the boss of both Rice and Khuzami and was the bank’s longtime general counsel until he left the bank this year. He was once head of enforcement at the SEC.

The second whistleblower to make news recently was an anonymous Monsanto whistleblower who raised allegations about certain sales bookings at the company.

The next was taken by an anonymous whistleblower from Monsanto, who alerted the SEC about certain sales bookings at the company, for which he received a bounty of $22 million.

This Monsanto whistleblower initially went to the company with his concerns. However, the company did not take his claims seriously, so the Monsanto whistleblower then went to the SEC and the agency fined the company. The SEC Order delineating the conduct and resultant penalty stated, the “Claimant voluntarily provided original information to the Commission that led to the successful enforcement” of the Act.

There were a couple of troubling aspects to this SEC enforcement action. Mirroring the response received by Ben-Artzi, the Monsanto whistleblower award is one in a long line of those where a company employee brings attention to an internal company issue and the allegation is not acted upon by the company to bring its conduct into regulatory requirements. Even more troubling was the conduct of the company’s external auditors, Deloitte. They not only disdained the concerns raised by the whistleblower but actively fought the allegations by defending its work.

The Monsanto whistleblower, through attorney Stuart Meissner, called for the SEC to investigate Deloitte’s conduct. Meissner said, “We hope the agency will probe Monsanto’s outside auditor Deloitte for the role we believe it played in enabling the company to overstate earnings and issue misleading financial statements—not only once, but twice. In my opinion, there was an initial misstatement by Monsanto and a subsequent restatement—the restatement is actually the bigger issue of the two in my view. When auditors are allowed to audit their own mistakes, it is difficult for them to be independent and objective.”

The question of who watches the watchers is always an important issue for any internal company investigation. Recall Enron, which turned to its regular outside counsel, Vinson & Elkins to investigate the allegations of its internal whistleblower, Sharon Watkins. The law firm performed an internal investigation of its own services for Enron and found nothing askance. As the anonymous whistleblower’s attorney, Stuart Meissner said in a press release, “This raises key issues about the auditor’s role. They were checking their own work.”

Whenever an auditing firm or law firm is required to investigate an ongoing client and, more particularly, services delivered for that client, the result is almost always the investigation turns up no wrongdoing. The actions by Deloitte raise some important issues for any company that needs to evaluate its internal controls and perform an audit or an investigation. If you utilize your existing professional service provider who put those controls, policies, or procedures now being questioned in place, there is always the potential conflict of interest. The fallout for Deloitte is only beginning, and it will be interesting to see where this matter may go.

As for Ben-Artzi, forced out of the financial services industry because of his whistleblowing, his very public refusal to accept a whistleblower award is the first time a person entitled to financial compensation for coming forward has declined such an award. It will be interesting to see what the fallout will be.

The whistleblower bounty program created under Dodd-Frank can only be called a success, in bringing in substantive information to the SEC to help stop corporate fraud. The critiques by Ben-Artzi and the Monsanto whistleblower, however, remind us all that questions are still open on the full scope of SEC enforcement.