John Carreyrou’s Bad Blood: Secrets and Lies in a Silicon Valley Startup is the account of Theranos, the blood-testing company that raised more than $700 million from investors, reached a paper valuation of $9 billion, opened blood-draw centres in Walgreens stores, and was exposed in October 2015 by the author’s reporting in the Wall Street Journal as having technology that did not work and results that endangered patients. Its founder, Elizabeth Holmes, was convicted of fraud in 2022; its president, Ramesh “Sunny” Balwani, was convicted later the same year. For an internal auditor the book is the clearest modern case of a governance failure in a private company: a celebrated board with no laboratory expertise, a culture of secrecy enforced by lawyers, whistleblowers threatened rather than heard, and partners who signed contracts on demonstrations they were not allowed to examine. This guide summarises the book without reproducing it, sets out how the deception worked and the gates that failed, maps the case to audit practice, and ends with a worked example of a hospital system’s audit function testing its own exposure to a vendor whose claims it had never verified.
In this guide
- The book in one page
- Who John Carreyrou is, and how the book came about
- The timeline: 2003 to 2022
- How the deception worked
- The gates that failed, and the two that worked
- The nine ideas worth keeping
- The vocabulary: twelve terms defined for practitioners
- What it means for internal audit: a failure-by-failure map
- The whistleblowers: what the book shows about speaking up
- The aftermath: trials and what changed
- The criticisms, and what the book leaves out
- Editions, reading time and how to read it
- A one-hour discussion guide for an audit team
- Worked example: Ashgrove Health System tests a vendor’s claims
- Frequently asked questions
- Related guides
The book in one page
| Question | The answer, in our words |
|---|---|
| What is it about? | Theranos, founded in 2003 by a nineteen-year-old Stanford student who dropped out months later, which claimed to run hundreds of laboratory tests on a few drops of blood from a finger prick using a proprietary device, and which was in fact running only about a dozen of its tests on its own device, dozens more on commercial analysers modified to take diluted finger-prick samples, and the rest on conventional equipment or at outside laboratories, producing unreliable results. |
| How big was it? | More than $700 million raised from investors including the Walton family, Rupert Murdoch and Betsy DeVos; a $9 billion valuation at its 2014 peak; a board that included two former secretaries of state, two former senators and a retired four-star general; retail partnerships with Walgreens and Safeway. |
| How was the deception sustained? | Secrecy enforced through non-disclosure agreements and litigation threats; compartmentalisation so that no employee saw the whole picture; demonstrations staged for investors and partners; a board chosen for prestige rather than expertise; and the personal charisma of a founder who modelled herself on Steve Jobs. |
| How was it exposed? | A pathologist’s blog raised scientific doubts; a former employee, Tyler Shultz, grandson of a board member, and a laboratory associate, Erika Cheung, became sources and complainants; Carreyrou’s first article ran on 15 October 2015; a federal laboratory inspection found deficiencies that endangered patients; the company collapsed over the following three years. |
| What was the harm? | Patients received wrong results for tests including those affecting pregnancy, cancer and heart conditions; tens of thousands of test reports were voided or corrected in 2016, and the book puts the eventual total at nearly a million. |
| Why read it as an auditor? | Because the controls that would have stopped it were ordinary, a board that asked to see the laboratory, a partner that insisted on an independent validation, a channel for employees that did not run through the executives being reported on, and because the book shows exactly how each was defeated. |
| Reading time | About eleven hours for the paperback; it reads as a thriller, which it is. |
Who John Carreyrou is, and how the book came about
Carreyrou was a two-time Pulitzer Prize winner at the Wall Street Journal, covering health care and corporate fraud, when a tip from a pathologist who had read a flattering magazine profile of Holmes led him to question the company’s science in early 2015. His reporting, published from October 2015 onward, drew on former employees, laboratory documents and patients, and was conducted under sustained legal pressure from Theranos and its counsel, which included surveillance of sources and threats against the newspaper. The book, published by Knopf in May 2018, extends the articles with the full history of the company from its founding and with the inside accounts of the people who worked there. It won the Financial Times and McKinsey business book of the year award for 2018, was followed on screen by an HBO documentary (2019) and a Hulu drama series (2022), neither of them adapted from the book, and is now the standard text on the case. Carreyrou later covered the trials and produced a podcast on them.
The timeline: 2003 to 2022
| Date | Event | Why it matters |
|---|---|---|
| 2003 to 2004 | Holmes leaves Stanford, founds the company and raises early money on a patent for a wearable drug-delivery patch that soon gives way to a blood-testing device | The founding claim changes; the fundraising does not pause |
| 2006 to 2008 | The chief financial officer is dismissed after questioning a demonstration; the board is told the device works when it does not; a first wave of departures | The pattern is set: dissent is removed, the board is managed |
| 2009 | Balwani joins as president and chief operating officer; he and Holmes are in an undisclosed relationship | An undisclosed related-party relationship at the top of the company |
| 2010 to 2013 | Walgreens and Safeway sign partnerships worth hundreds of millions on staged demonstrations; the device, the Edison, cannot run most tests; commercial analysers are modified in secret | Partners rely on demonstrations and reputation rather than validation |
| 2013 to 2014 | The company goes public with its claims; recruitment of the board of former statesmen, begun in 2011, continues; the valuation reaches $9 billion; testing begins in Walgreens stores in Arizona and California | Peak credibility; patients are now receiving results |
| 2014 to 2015 | Tyler Shultz and Erika Cheung raise concerns internally about failed quality controls and are rebuffed; Shultz takes his concerns to his grandfather on the board and writes to a state regulator; Cheung files a complaint with the federal laboratory regulator | The internal and external whistleblowing, and the company’s response through lawyers |
| 15 October 2015 | The Wall Street Journal publishes Carreyrou’s first article | Exposure |
| 2016 | The federal inspection finds deficiencies posing immediate jeopardy to patient safety; the laboratory licence is revoked; Walgreens ends the partnership; tens of thousands of results are voided | Institutional confirmation |
| 2018 | The SEC charges Holmes and Balwani with fraud; Holmes settles; a federal indictment follows; the company dissolves | Accountability begins |
| 2022 | Holmes convicted on four counts in January and sentenced to more than eleven years in November; Balwani convicted on twelve counts in July and sentenced to nearly thirteen years | The end |
How the deception worked
The core claim was technical and false: that a proprietary device could perform a full range of laboratory tests on a tiny sample. Around that claim the company built a structure that prevented anyone from testing it. The structure had five parts, and each corresponds to a control that was absent or defeated.
| Component | What the company did | What it defeated |
|---|---|---|
| Staged demonstrations | Investors and partners saw a finger-prick sample go into the device and a result come out; in several accounts the result had been produced elsewhere or the device was displaying a recorded sequence | Validation by observation; the demonstration was a document, not the thing |
| Modified commercial analysers | About fifty to sixty tests were run on third-party machines adapted to handle diluted finger-prick samples, which degraded accuracy; the practice was hidden from partners, regulators and most staff | Any check that compared the claimed method with the actual method |
| Secrecy and compartmentalisation | Non-disclosure agreements for everyone, teams prevented from talking to each other, security surveillance, the chemistry and engineering groups kept apart | The internal flow of information that lets an organisation notice its own problems |
| Legal intimidation | A prominent litigator on the board and as counsel; threats against former employees, sources and the newspaper; surveillance of whistleblowers | The speak-up channel; external scrutiny |
| The prestige board | Former secretaries of state, senators and a general, with no laboratory, medical-device or diagnostics expertise, who relied on what management chose to show them | Oversight; the board was a credential, not a control |
The company also had an undisclosed relationship between its two senior officers, an absence of a chief financial officer for years, audited financial statements that investors did not ask for, and a laboratory director role filled nominally. The corporate governance audit guide lists each of these as a test; the book shows them all failing at once.
The gates that failed, and the two that worked
- The board. Chosen for stature, kept from the laboratory, and persuaded, when it considered removing Holmes in the company’s early years, to keep her. George Shultz, the former secretary of state, sided with the company against his own grandson’s evidence. The lesson is that the independence of a board is a function of its access and its expertise, not its reputation.
- The partners. Walgreens and Safeway committed hundreds of millions without an independent validation of the device, partly from fear of losing the deal to a competitor; a Walgreens consultant who asked to see the laboratory was refused and the deal proceeded anyway.
- The investors. Sophisticated investors invested on the strength of the board, the partners and each other, without audited financials or technical diligence; the valuation validated itself.
- The regulators, at first. The company exploited a gap between the regulators of devices and of laboratories; when the laboratory inspection finally happened, in 2015, it was decisive.
- The internal channels. Employees who raised quality-control failures were told to resign or were threatened; concerns went to the two executives running the company, and the company’s lawyers then pursued the people who had raised them.
- The gate that worked: whistleblowers who went outside. Shultz and Cheung took their evidence to a regulator and to a journalist, at personal cost; Cheung’s complaint triggered the inspection.
- The gate that worked: the press. Carreyrou’s reporting survived legal threats because the newspaper stood behind it and because the sources had documents. The Money Men summary tells the same story with a different company.
The nine ideas worth keeping
- A demonstration is a claim, not evidence. Anything the subject controls end-to-end proves only that the subject can stage it. Validation requires independent samples, independent operators and results compared against a reference.
- Secrecy is a control defeat, not a trade secret. Compartmentalisation that prevents employees from comparing notes also prevents the organisation from discovering its own failures; an auditor should treat unusual secrecy as a risk indicator.
- Prestige is not expertise. A board without a member who understands the core technology, product or risk cannot oversee it, however distinguished its members are elsewhere.
- The channel for concerns must not run through the lawyers. A speak-up process whose recipient is the function that defends the company will silence rather than surface; the recipient must be independent and the audit committee must see the log.
- Partners and investors borrow each other’s diligence. Each relied on the fact that the others had committed; nobody had checked. Reliance on a third party’s diligence should be documented and tested, not assumed.
- Undisclosed relationships at the top compromise every control between the people involved. The Holmes–Balwani relationship meant the two officers who should have checked each other did not.
- Fear of losing the deal is a control risk. Walgreens proceeded in part because it feared a competitor would sign instead; competitive pressure is a named condition in the fraud risk guide for a reason.
- Regulatory gaps are found by the regulated. The company positioned itself between regulators for years; the audit question for any organisation is which of its activities sits in a gap, and why.
- Whistleblowers pay, and the organisation decides how much. The cost to Shultz and Cheung was personal and financial; a company’s treatment of its first whistleblower determines whether there is a second.
The vocabulary: twelve terms defined for practitioners
| Term | What it means in the book | What it looks like in an audit |
|---|---|---|
| Validation study | Testing a device or method against a reference standard on independent samples | The evidence a partner should demand before relying on a vendor’s claim; see the third-party risk guide |
| Proficiency testing | External samples with known values sent to a laboratory to check accuracy | The laboratory equivalent of a surprise count; the company manipulated it |
| Immediate jeopardy | The regulator’s finding that deficiencies pose immediate risk to patient safety | The highest severity in a regulatory inspection |
| Non-disclosure agreement | A contract restricting what employees may say | Legitimate for secrets; a red flag when used to prevent reporting of wrongdoing |
| Compartmentalisation | Restricting information so that no one sees the whole | The structure that defeats internal discovery |
| Prestige board | Directors chosen for reputation rather than relevant expertise | Test the board’s expertise against the company’s principal risk |
| Related-party relationship | A personal or financial relationship between officers or with counterparties | Disclosure and recusal controls; the Holmes–Balwani case |
| Staged demonstration | A presentation engineered to produce a predetermined result | A claim; validation must be independent |
| Reliance on others’ diligence | Assuming another party has checked | Document and test any reliance; do not infer it |
| Speak-up channel | The route by which employees raise concerns | Independence of the recipient; audit committee visibility |
| Regulatory gap | An activity that falls between regulators’ remits | A question for the compliance risk assessment |
| Legal intimidation | Using litigation threats to suppress scrutiny | A pattern the board should log; a reason to look harder |
What it means for internal audit: a failure-by-failure map
The book describes no internal audit function at Theranos, which is itself the first finding; the lessons apply to the functions of the companies that dealt with it and to any organisation that relies on claims it has not verified. The corporate governance audit guide, the third-party risk guide and the fraud risk management guide carry the frameworks.
| Failure in the book | Control the audit function should expect | Test that produces evidence |
|---|---|---|
| Partners relied on staged demonstrations | Vendor and partner claims that the organisation relies on are independently validated before commitment, with the validation documented | For the five largest vendor relationships, identify the claim relied upon and the validation performed by someone the vendor did not control |
| Board without relevant expertise or access | Board composition reviewed against the organisation’s principal risks; the board visits and inspects what it oversees | Compare the board skills matrix with the risk register; read the minutes for site or laboratory visits in the last two years |
| Concerns routed to the executives they concerned | Speak-up channel with an independent recipient; case log reviewed by the audit committee; anti-retaliation protection tested | Reconcile the case log to committee papers; interview two reporters about how they were treated |
| Undisclosed relationship between officers | Annual related-party and conflict declarations by officers and directors, reviewed by the committee | Read the declarations; test one against external evidence |
| Investors without audited financials | The organisation does not invest in, lend to or partner with entities whose financial statements it has not obtained | Sample the investment and partnership files for financial statements and the review performed |
| Secrecy and compartmentalisation | Information-sharing norms consistent with the business; unusual restrictions escalated | Interview staff in two functions about what they are prevented from knowing and why |
| Regulatory gap exploited | Compliance risk assessment identifies activities between regulators and the organisation’s position on each | Read the assessment; the compliance risk guide gives the method |
| Competitive fear drove commitment | Deal approvals require the diligence to be complete regardless of competitive timing; exceptions are visible to the board | Review exceptions to the diligence policy in the last year |
The whistleblowers: what the book shows about speaking up
The two employees whose evidence ended the fraud deserve a section of their own, because their experience is the most transferable part of the book for anyone who designs or audits a speak-up process. Tyler Shultz joined the company in 2013 after graduating from Stanford, worked in the laboratory, and within months found that proficiency-testing results were being manipulated and that the devices failed quality-control checks far more often than the company admitted. He raised it with his supervisor, then by email to Holmes, and received a reply from Balwani that combined contempt with a threat. He had already written, under an assumed name, to the state laboratory regulator; he resigned. His grandfather, a director, believed the company over him, and the company’s lawyers pursued him for more than a year, at a cost to his family of hundreds of thousands of dollars in legal fees. Erika Cheung, a laboratory associate, raised the same quality-control failures internally, was similarly rebuffed, resigned, and in 2015 filed a complaint with the federal laboratory regulator that triggered the inspection; she too was pursued by the company’s lawyers.
Three features of their experience bear on control design. First, both went through the internal route first and were punished for it; the internal channel was not merely ineffective but hostile, which is the condition under which an organisation learns of its problems from the press. Second, the external routes worked only because both had documents and the courage to be named; a regulator’s complaint process and a journalist’s reporting are the last gates, not the first. Third, the cost fell on the reporters, and the company’s willingness to impose it was itself evidence of what it had to hide. An internal audit function that reviews its organisation’s speak-up process should test for the opposite of each: a recipient independent of management, protection that is real rather than stated, and a record of what happened to the last person who used the channel. The fraud risk management guide sets out the tests, and the case for performing them is this chapter of the book.
The aftermath: trials and what changed
The SEC charged Holmes and Balwani in March 2018; Holmes settled, paying a penalty and accepting a ten-year ban from serving as an officer or director of a public company. The criminal trial of Holmes began in September 2021 and ended in January 2022 with convictions on four counts of defrauding investors; she was sentenced in November 2022 to eleven years and three months and began serving the sentence in May 2023. Balwani was convicted in July 2022 on twelve counts, including fraud against patients, and sentenced to nearly thirteen years; in February 2025 the Ninth Circuit upheld both convictions and sentences. The company had dissolved in 2018. Arizona’s attorney general recovered refunds for patients tested in the state. The wider effects were on practice rather than law: investors in life-sciences start-ups are more likely to ask for validation data and audited financials, the gap between device and laboratory regulation was debated but not closed (a 2024 FDA rule on laboratory-developed tests was vacated by a court in 2025), and the case became the reference point for board diligence in private companies. The lesson that most concerns an auditor is the simplest: a laboratory inspection, which any partner could have insisted on, found in a few days what a decade of boards and investors had not.
The criticisms, and what the book leaves out
The book is the reporter’s account, and its limits are those of its sources: it is strongest on the laboratory and the people who worked in it, and thinner on the investors’ and partners’ internal deliberations, which later litigation and the trials filled in. Some reviewers found the portrait of Holmes too unambiguous, a judgment the trial evidence did little to support. The book ends before the trials, so the account of culpability is the reporter’s, since largely confirmed by two juries, although Holmes was acquitted on the patient counts. And the focus on one extraordinary founder can obscure the ordinary mechanism: the people who failed to check were not fools, they were busy, impressed and afraid of missing out, which is the condition the Lying for Money summary describes as the normal state of commerce. The book is best read with that in mind: the failure was not that intelligent people were deceived but that none of them performed the one check that would have ended it.
Editions, reading time and how to read it
| What | Details | Best for |
|---|---|---|
| Hardback | Knopf, May 2018, about 340 pages | The first edition |
| Paperback | Vintage, 2020, with a new afterword; current printings cover the trials and sentencing | The edition to read |
| Audiobook | Unabridged, about twelve hours | Works well as narrative |
| Screen | HBO’s documentary The Inventor (2019) and Hulu’s series The Dropout (2022), neither adapted from the book | A team that will not read it; the book is more precise |
| Reading plan | The chapters on the Walgreens deal, the laboratory, the whistleblowers and the exposure | An auditor who wants the controls before the drama |
| Companion reading | The Money Men summary for the same pattern in a listed company; the Billion Dollar Whale summary for board capture in a public fund | Seeing the pattern across cases |
A one-hour discussion guide for an audit team
- Fifteen minutes: the claims we rely on. List the five claims by vendors, partners or counterparties that the organisation depends on most. For each, name the validation performed by someone the claimant did not control. Blanks are findings.
- Ten minutes: the board. Compare the board’s expertise with the organisation’s principal risk. Ask when a director last inspected the thing that risk lives in.
- Fifteen minutes: the channel. Trace what happens to a concern raised by an employee about senior management: who receives it, who investigates, who sees the result. Compare with Shultz and Cheung.
- Ten minutes: the deal. Recall the last significant commitment made under competitive time pressure and whether the diligence was complete.
- Ten minutes: the plan. Decide which tests in the map belong in the next plan; the risk assessment guide describes the documentation.
Worked example: Ashgrove Health System tests a vendor’s claims
Ashgrove Health System is a fictional non-profit of five hospitals with $2.1 billion in revenue and an internal audit function of twelve. In 2027 the system was negotiating a contract with a diagnostics start-up offering a rapid point-of-care testing platform for its emergency departments, and the audit committee chair, who had read the book, asked the function to review the diligence before the contract was signed.
| Theranos question | What Ashgrove found | Result |
|---|---|---|
| Was the device validated independently? | The vendor had supplied a validation study performed in its own laboratory on its own samples; the clinical team had observed a demonstration at the vendor’s site | The function recommended, and the committee required, a validation on Ashgrove’s own samples run by Ashgrove’s laboratory staff against the central laboratory’s results before any clinical use |
| Do we have audited financial statements? | The vendor had provided investor presentations but no audited statements; it was privately held and three years old | Audited statements requested as a condition; the vendor supplied reviewed, not audited, statements, and the contract added a termination right |
| Who regulates the device, and has it been inspected? | The device held a regulatory clearance for a narrower set of tests than the vendor’s sales material described | The contract scope was limited to the cleared tests; the compliance risk guide‘s regulatory-perimeter test applied |
| Are we relying on another party’s diligence? | The clinical lead had cited a university hospital’s adoption as evidence; that hospital was in a pilot, not in production | Reliance removed from the business case |
| What does the vendor’s board and leadership look like? | The founder was chief executive and chief scientist; the board had no clinician and one investor | Noted as a risk in the committee paper, with a request for a clinical advisory board as a contract term |
| Does our own speak-up channel work? | Unrelated to the vendor, the function used the occasion to test the system’s channel: concerns about executives went to the general counsel | Finding: routing changed so that concerns about executives reach the audit committee chair directly |
The contract was signed four months later than planned, for a narrower scope, with validation evidence from Ashgrove’s own laboratory showing acceptable agreement on the cleared tests. The chief medical officer, who had championed the deal, said afterwards that the delay had been frustrating and the validation had changed how he read vendor material. The function recorded the review as a model for future clinical technology contracts. Nothing about the vendor suggested fraud; the point of the exercise, and of the book, is that the checks that would detect fraud are the same checks that detect ordinary overstatement, and an organisation that performs them is protected against both.
Frequently asked questions
Is Bad Blood accurate?
The two criminal trials, with testimony from many of the book’s sources and from the people it describes, confirmed its account in substance. The book predates the trials and so does not cover the defence’s case, which the paperback afterword and Carreyrou’s later reporting address.
Did Theranos have any internal audit or compliance function?
Not in any meaningful sense; the laboratory director role was nominal and concerns went to Holmes and Balwani themselves. The absence is the first lesson: a company handling patient results with no independent assurance function should not have been trusted by partners who had one.
What should an auditor take from the board’s failure?
That independence requires access and expertise. A board that cannot inspect what it oversees and has no member who understands it is not a control, whatever its members’ records elsewhere. The audit committee playbook describes the stance a committee should take.
How does the case compare with Wirecard?
Closely: a charismatic leader, secrecy, legal intimidation of critics, whistleblowers routed through the company’s lawyers, and partners and regulators who deferred. Wirecard was a listed company with a Big Four auditor, which makes its failure worse; Theranos was private and had no auditor investors insisted on, which makes its lesson about diligence. The Money Men summary covers the other case.
What is the single most useful control from the book?
Independent validation of any claim the organisation relies on, performed on samples the claimant did not choose by people the claimant does not control. It applies to devices, software, financial results and audit evidence alike.
Where does the book sit in the reading list?
In the fraud and scandal group of the internal audit reading list, beside Money Men, Billion Dollar Whale and The Smartest Guys in the Room.
Related guides
- How to Audit Corporate Governance — the board that never saw the laboratory
- Third-Party Risk Management End-to-End — validating the claims partners rely on
- Fraud Risk Management: Assessment, Controls and Analytics — competitive pressure and secrecy as indicators
- Money Men: The Wirecard Fraud, Summarised for Auditors — the same pattern, listed company
- Billion Dollar Whale: The 1MDB Scandal, Summarised for Auditors — board capture in a public fund
- Corporate Scandals and the Internal Audit Lessons — Theranos beside the other cases
- The Best Books for Internal Auditors — where this book sits among the others
- All book summaries — the full set of summaries for auditors
- Willful Blindness by Margaret Heffernan: Summary and Lessons for Auditors — why organisations ignore what they can see
Leave a Reply