If IT directors are on the main board they will usually be junior members, outside the hallowed inner circle. In any case, as IT straddles all boundaries IT directors are particularly well placed to be aware when things are not as they are dressed up to seem.
When whistle-blowing the last thing you should do is to raise the matter internally in any way or follow any formal procedures. That is the surest way of being fingered and sacked when things
Nor is it any good dealing with regulatory authorities - they usually lack any teeth to tackle future eventualities.
The only way to whistle-blow successfully is to send as many facts as possible in a brown paper envelope to a trusted journalist or business journal. Send copies or summaries, not original documents, and ensure that they cannot implicate you. It is surprising how responsible journalists are in serious cases, such as our long campaign for accountability following a Chinook crash six years ago. Indeed, journals are just about the only remaining agent of accountability.