FORTUNE — Sometimes, in a sea of questions there is that one that makes all the difference. Last week, Judge Jed S. Rakoff asked the SEC to explain how its $285 million settlement with Citigroup would ensure that the bank would be upfront with its clients in the future.

It’s a fair question, given that the settlement is in response to charges that Citi (C) had misled its mortgage securities investors in the run up to the housing crisis. But at face value, the question may not be so easy for the SEC to answer, leaving the federal judge’s approval of the settlement up in the air.

Citi’s 2003 settlement with the SEC also included a promise to provide fair and open disclosure to clients, but this recent settlement calls for little in the away of substantive reforms to the governance and culture at the company. But it is failures in governance that lead to these problems in the first place.

Rakoff seems to understand just how important corporate governance can be. He oversaw the WorldCom bankruptcy and the appointment of former SEC chair Richard Breeden as court monitor. That case led to governance recommendations that boards would be wise to follow, but continue to resist.

So how will the SEC respond and what should Rakoff be looking at in this latest case? Here’s a start:

Why did previous remedies fail?

Citi’s board has a responsibility to oversee the company’s culture. And two of its board directors have been on the board since before the 2003 settlement, including chairman Richard Parsons.

What actions did the board take to change its cultural oversight after that settlement? Clearly, whatever remedies the board took have not been wholly effective and they should conduct a review to find out why.

It’s possible that the board has not spent enough time to understand the bank’s work culture, relying too much on management’s opinion, or the board itself may have failed to understand this critical responsibility.

Hold executives accountable

Another critical area to examine is whether the board truly holds the CEO and senior executives accountable and, if so, how it does this, including its oversight and use of promotions, compensation and dismissals.

Citigroup’s proxy describes the use of certain risk factors as a “threshold or ‘gating’ factor” in determining compensation.

Thresholds are used in compensation programs as hurdles that must be met before an employee is eligible for a bonus. (Countrywide Mortgage had a similar compensation approach, which failed to prevent risky behavior there.)

Citi’s proxy filing does not clarify whether communication with clients is used in performance evaluations and bonus determinations at the bank. Top executives who are responsible for the organization’s culture should know that their bonuses are at stake.

“Common purpose, responsible finance, ingenuity and leadership” are four key principles that Citi cites in its proxy as the basis of its strategy. Perhaps ethics or integrity should be their fifth.

Steer clear of lip service

BP and Enron had excellent codes of conduct. The same goes for Citi. Its code outlines employees’ responsibilities to clients. So why has this been insufficient?

A review of Citi’s governance should include whether the board has made sure that top management understands that these words are not lip service and that there is zero tolerance for unreliable or misleading disclosures to clients.

Further, even if there is a sound work culture, there’s always the possibility that an employee will go rogue. Citi should examine whether there are enough internal checks and balances in the way it communicates with clients to stamp out questionable behavior.

Leave room for the whistleblower

The board should also review the way it monitors and handles whistleblower complaints. Based on the board’s actions, do employees believe it is their obligation to report instances of unfair disclosure to clients and do they feel they will be supported and rewarded (rather than punished) for coming forward?

Keep an eye out for warning signs

The reforms at the bank should include processes for the board and top management to receive early warnings and take remedial actions sooner. For example, how does the board monitor the culture and concerns of its staff — does the board review anonymous surveys?

The SEC should address what kind of regulatory oversight it will establish to review Citi’s processes until the fixes at the company have been made.

While the question Judge Rakoff poses is simple, the answers must be robust. Exam time comes on November 9: will the SEC be prepared?

Eleanor Bloxham is CEO of The Value Alliance and Corporate Governance Alliance, a board advisory firm.