The Walmart bribery scandal is one of the most closely-watched cases of alleged malfeasance by  a global company. It broke into the open  in April, 2012, when  the New York Times published a lengthy investigative piece alleging Walmart bribery in a Mexican subsidiary and a cover-up in its Bentonville, Arkansas, global headquarters. The piece, which won a Pulitzer Prize for reporter David Barstow, raised a host of  personal accountability and corporate governance issues for the company.

Late last month, on the second anniversary of the story nearly to the day, Walmart released its first Global Compliance Report (GCR). The report describes the company’s governance response and changed compliance framework — from holding 20 audit committee meetings in 2014, to substantial organizational restructuring, to enhanced education and training.  On paper, Walmart appears to have adopted many best practices and to have set out a sound plan for moving forward. However, questions of accountability remain unanswered, when it comes to determining what actually happened in the past, what systems failed, and who was responsible for possible violations of the Foreign Corrupt Practices Act, which bars bribery of foreign officials.  A lengthy internal inquiry continues, as well as investigations by the Justice Department and the SEC, with the scope broadened to include possible Walmart improprieties in Brazil, China and India.

Finding the answers to these questions is important in two ways. First, the answers will determine whether current and past senior officials are culpable and whether any sanctions (governmental or company imposed) are appropriate. Holding people accountable — especially senior officers — is essential to deterrence inside Walmart (and for other companies, too). The essence of the Times story was the allegation that Walmart Mexico, under the direction of the then country CEO and his General Counsel, bribed officials to get permits and clearances for new stores — and falsified records of these transactions. When a Walmart lawyer in Mexico blew the whistle in 2005, senior officers both in Mexico and in the United States allegedly stopped two different efforts by other Walmart employees at headquarters to conduct a thorough and independent inquiry. The whistleblower charges were sent back to Mexico and buried. Although it must be emphasized that there are no official findings as yet, these senior officers, according to the story, included the then-Walmart CEO and General Counsel in Mexico, the then-CEO, Lee Scott (recently retired as member of  the Walmart board);  the then-head of Walmart international, Mike Duke (who succeeded Scott as CEO, has just retired from that position, and remains on the Walmart board as executive  committee chair), and Thomas Mars, then-General Counsel. Also at issue are what and when management told the board and what processes the board had for oversight.

Second, the reforms outlined in the GCR are hard to evaluate fully unless and until the specific problems that prompted them are laid out in detail. Certainly an important goal for Walmart’s board and current management is to improve the company’s compliance capability. But it is also likely that enhanced compliance  personnel, processes and systems are part of a company effort to respond to problems uncovered in the investigation to improve its position in settlement negotiations with the government. Whether there will be a settlement, what facts Walmart will admit and what precise sanctions and future obligations it will face are not known to outsiders at present.

What is known is that the inquiry is wide-ranging and Walmart has taken it very seriously. Through January, 2014, the company has spent $439 million on the probe, and estimated that it would spend $200-240 million more on investigative and compliance costs this year. It has retained three law firms, one for the audit committee, one to conduct an internal investigation and one to advise on the global compliance review. Moreover, it is paying numerous other firms to represent 30 Walmart employees who have been questioned in the probe, including senior executives from corporate headquarters.

The  Global Compliance Report does respond, in general, to issues raised in the original story. Most substantially:

• Walmart has a number of initiatives to combat the culture of silence which allegedly allowed the Mexican scandal to fester for a number of years before corporate leadership was informed. That malign culture, in turn, allowed corporate leadership to ignore the evidence of wrongdoing and keep the board in the dark. Among the most important new initiatives is an escalation and review procedure which aims to ensure that high-risk issues move swiftly to the attention of  the chief ethics office in headquarters, which has a direct link to the Audit Committee. (Think GM and its delays in addressing problems with an ignition switch.)

• Walmart has made a number of organizational changes to integrate compliance, legal, risk and finance staffs, both in geographies and in relation to different compliance subjects. This step aims to bring appropriate expertise (e.g. anti-bribery, money laundering, product safety, etc.) to different types of compliance issues in different nations and markets, and to create checks and balances so that key staff functions can be both partners to business leaders as well as guardians of the company, and not be pressured by business leaders to ignore serious issues. In the report’s next iteration, Walmart should, however, explain more clearly how its newly drawn (and perhaps overly complex) matrix organization will actually carry out the fundamental compliance tasks of prevent, detect and respond — how it will map business processes, assess risks under various requirements, prioritize them and then mitigate them.

• Walmart has instituted a critical technique for ensuring board and senior management involvement in creating a culture of integrity.  The Audit Committee on behalf of  the  board sets key compliance objectives for the next calendar year. The Committee then assesses whether senior managers have met those objectives. If not, then some or all of that executive’s cash incentive will be withheld by the board’s Compensation Committee. This vital focus on pay for performance with integrity involves the board and senior management in articulation and implementation of  key annual compliance goals,  just like key annual commercial goals.  Here, too, more detail is needed in the next Compliance Report about what the goals actually are (one can infer them from the Report but a clear articulation would be more potent) and what methods were used to measure whether or not the goals were met.

What is missing, in my view, is a powerful statement by the CEO that he is the leader of compliance in Walmart — and a companion, deeply-felt statement by the board that this is a core CEO responsibility. The Report is replete with redrawn organizational boxes and organizational detail. But, an integrity culture is simply not possible without CEO commitment to integrity as a bed-rock company goal, and to driving compliance deep into the organization through personal action and reviews. In both the current Annual Report and Proxy Statement, there are rather pro forma statements, but not a sense of real personal commitment from the CEO (as opposed to the Audit Committee) or the board.  Similarly, the company must make clear the related point that the top operating business leaders are the chief integrity and compliance leaders in their sphere — that they must make this issue a reality by their own personal actions and leadership.

Walmart’s bribery scandal, and the sweep of the current investigation, have made this case a poster-child for the snares of corruption facing global companies, putting it in the same category as the towering bribery scandal faced several years ago by Siemens. Many boards and CEOs from around the globe cite corruption as one of the top issues they face in current globalization efforts — in this sense, “the whole world is watching” the Walmart case carefully.

With its Global Compliance Report,  Walmart has written an important chapter in this saga. But, until the results of the investigation are made public and the government’s response revealed, the story — both on past accountability and future governance — is far from over.

This blog first appeared on Harvard Business Review on 5/15/2014.

View our complete listing of Strategic HR and Leadership Development blogs.