Recall that Section 302 of Sarbanes-Oxley requires companies to set up a venue where whistleblowers can report misdoings. That caused a lot of companies to scramble. But what is done with those reports really is critical. You need a vetting and escalation process. This is a pain, but the recent case of Dyadic, which wasn't subject to Sarbox until it went public in 2004, points out how a formal process really can help. With Dyadic, it seems that early reports of fraud were not well handled, according to cfo.com. In fact, they remained dormant for years. For whatever reason, the CEO seems to have kept the initial whistle blows to himself. The whistleblower clause of Sarbox, in general, has not led to a lot of uncovered crime. But a process is required.  

For more on Dyadic:
- here's the article [1] from cfo.com

Related Articles:
What to do about whistleblower protection? Article [2]
Has Sarbox really changed attitudes? Article [3]
Enron 'whistleblower' a fraud? Article [4]
Will this Sarbox whistleblower fare any better? Article [5]
Sarbox-style whistleblowing not a lot of fun. Article [6]