This is general problem anytime there is a person or organization which looks for problems. When a problem is found, an organization has two basic approaches:

This is general problem anytime there is a person or organization which looks for problems. When a problem is found, an organization has two basic approaches: 1) Acknowledge the problem, prioritize fixing it, and then fix the problems in priority order. 2) Punish the person who reports the problem. This is a very bad idea but it is common. I once worked with a very good QA person. He was pushed out of the QA organization because he found too many bugs. In particular, there was one developer who complained because it took "too long" to test his changes. The reason it took a long time was the QA person was thorough, the software was complex, and the developer wrote buggy code. More recently, I was punished because I reported web service had no authentication and could be used to access customer PII. My manger's manager screamed at me for reporting this and claimed it was not a problem. Punishing people who report problems is destructive, and it has been happening for millennia. That is why we have the phrase "shooting the messenger". I am not sure how you fix this problem. My guess is organizations have to adopt a culture where reporting problems is valued, and also where covering up problems is punished. Even then, organizations always have bad people who try to take the destructive path. I do not think there is an easy way to remove all dishonest, incompetent, destructive, and dysfunctional people from any organization. The best we can do is be vigilant, speak up, and accept we will sometimes be punished for trying to do the right thing.