United States: handling internal investigations

Allegations of corporate malfeasance may arise in myriad ways: whistleblowers, current or former employees, internal or external auditors, shareholders, the media, regulatory or law enforcement agencies, and/or the plaintiff’s bar. When allegations of serious misconduct come to a company’s attention, corporate fiduciary obligations often require a vigilant and prompt reaction from the company, including in some instances its senior management or directors.

Internal investigations are a vital and valuable means to understand and, as appropriate, respond to such allegations, and to protect the company’s interest in the face of them. A thorough investigation will position the company to assess the accuracy of allegations of misconduct, remediate any identified malfeasance and guard against its recurrence, and prepare the company to respond effectively to subsequent (or pending) regulatory investigations and parallel civil litigation premised on those allegations.

This article provides a brief primer on how to conduct an effective internal investigation. It outlines common steps designed to assure an internal investigation succeeds in the marshalling of facts underlying the allegations, and addresses important issues to consider when engaged in an internal investigation, including and especially (i) assuring the investigation is structured to maximise its credibility; (ii) preserving the confidence and protections of applicable privileges over documents created and conclusions reached during the investigation; and (iii) whether to disclose voluntarily the investigative findings to third parties, including the government.

Initial steps

Companies should structure investigations carefully and thoroughly at their outset. This includes focus on selecting who will oversee the investigation and who will conduct it, and determining the substantive and practical scope of the investigation. Numerous factors go into these determinations and should be assessed carefully upfront.

First, the company should determine who will oversee the investigation. In most circumstances, it is appropriate for management to conduct and/or oversee the investigation. However, for unusually significant matters (such as matters involving the conduct of senior management or in-house counsel), it may be appropriate for a committee of the board of directors to conduct or oversee the investigation (for example, the audit committee or a special committee).¹ Whether supervised by management or a board committee, the company should consider whether to hire outside counsel to conduct the investigation.

The individual or committee overseeing the investigation and investigating counsel should, at an early stage, establish the scope of the investigation, focusing on the issues and time period to be addressed. Counsel will then typically create an initial work plan within the agreed-upon scope. This initial work plan should detail the documents to be gathered, the means by which those documents will be collected and reviewed, the identity and the order of witnesses to be interviewed, and a timeline for completion of each of these steps. Counsel should also consider whether, and to what extent, they may need to engage external substantive experts (for example, forensic accountants) to assist the investigation, and, if so, should structure their engagement of these experts to assure that their work enjoys applicable attorney-client privilege and/or work product protections.²

There is no ‘one-size-fits-all’ work plan for an internal investigation. The scope of an investigation and the steps needed to complete it will necessarily depend upon balancing of the need for thoroughness against the need for an efficient, cost-effective and focused investigation. The severity and pervasiveness of the alleged misconduct (or lack thereof) must also be taken into account. Likewise, external time constraints will frequently dictate an investigation’s scope; for example, an investigation’s completion is frequently required in advance of a financial reporting period to provide information to the company’s auditors and to enable a company to make an informed disclosure decision.

An investigative work plan should take these considerations into account, while retaining the flexibility to permit investigators to adopt and react appropriately as their inquiry evolves and additional facts are discovered. Counsel conducting the investigation should have a direct reporting line to the individual or entity that engaged it, present that person or entity with its work plan, and provide regular updates on the investigation’s status as it progresses.

Gathering and reviewing documents

Documents – particularly email and electronic information – frequently provide the only contemporaneous memorialisation of the conduct being investigated and contain the most important and substantive information obtained in an investigation. Documents often tell the story and provide the chronology of what transpired, and will serve to refresh witnesses’ recollections of past events. Retaining, collecting and reviewing relevant documents and evaluating their significance or meaning is a critical step in any internal investigation. To that end, investigators should assess the broad range of evidence that could potentially be relevant, including both electronic and hard copy data. Counsel conducting the investigation should immediately coordinate with company personnel or representatives to identify the custodians or employees likely to possess relevant documents, the types of documents generated by the company, and the manner in which documents are stored.³ Rapid identification of individuals in possession of relevant documents is critical to timely distribution of notice to those employees to maintain the integrity of the documents pending the investigation.

Retention

Once the universe of individuals potentially in possession of relevant materials is determined, the company’s legal department, in co­ordination with external counsel, should prepare and distribute a written document retention memorandum instructing those employees not to destroy or discard specified categories of documents related to the investigation’s subject. The memorandum should describe these categories broadly, disclosing as much information as necessary to assure preservation of relevant materials while not revealing more regarding the allegations prompting the investigation than the recipient needs to know. It may be necessary and advisable for counsel to conduct document collection interviews with individual employees to determine their document retention and storage practices (eg, whether they hold data on home computers or personal mobile devices) and to collect relevant, hard-copy documents from employees directly.⁴

In addition to assuring that individual employees retain relevant documents in their possession, investigators should also coordinate with the company’s legal department and informational technology personnel to assure the preservation of electronic documents stored on company servers or elsewhere. In today’s environment, most documents are stored electronically and are usually retrieved directly from the company’s central or email servers, rather than from individual employees or custodians. It is critical to maintain the integrity of these documents. Companies may have to suspend data recycling programmes to ensure that relevant emails and electronic documents are not being deleted in the ordinary course. Additionally, because it may be necessary in certain circumstances to restore back-up tapes to recover and retrieve email or electronic data that has been already deleted, the company may need to remove those tapes from ordinary recycling programmes.⁵

Collection

Once the universe of potentially relevant documents is identified and their retention is assured, counsel should collect the documents for review. The shift to electronic platforms in recent years has greatly enlarged the universe of data stored at companies. In many instances, the universe of documents is voluminous and contains large amounts of irrelevant material, the review of which would be wasteful and inefficient. In such circumstances, investigators should consider creating a set of search terms and date restrictions to target documents likely to be relevant to the investigation, and limiting their collection efforts to only those documents that ‘hit’ on the identified search terms or fall within the specified date parameters.⁶ Alternatively (or perhaps in addition) counsel might consider employing so-called predictive coding, an increasingly used technology that attempts to use computer technology to identify the more important documents among a large data set.

Additionally, companies conducting internal investigations are often multinational corporations with operations in jurisdictions or countries subject to data privacy laws. Counsel conducting investigations in these circumstances should be sure to review applicable data privacy and other local-law restrictions in each impacted jurisdiction to ensure that collection and review efforts are compliant and to engage with, and consult with, local counsel as needed.

Review

Once documents are collected, the investigative team should review documents to organise them according to particular criteria. Review databases typically permit electronic ‘coding’ of documents to facilitate this process.⁷ While the criteria used will vary necessarily according to the particular facts, circumstances and nature of the investigation, the review, at minimum, should identify and segregate documents that are privileged and those that are particularly noteworthy. Typically, document reviewers will also identify and code documents according to more discrete substantive issues identified as relating to the investigation. Additionally, documents will usually be identified as relating to a particular individual (or individuals) and used to facilitate that person’s subsequent interview.

Counsel will also often use the results of the review to prepare a full chronology of events, with links to the documents on which each entry is based (or citation to the internal number assigned to the particular document). This chronology should be supplemented regularly as additional documents are identified. This working chronology is often essential to counsel’s efforts to synthesise facts and dates and to understand the timing and relationship of key events and persons.

Witness interviews

Witness interviews are often the other principal source of information gathering in any internal investigation. Ideally, interviews should begin after relevant documents have been reviewed and organised and investigating counsel have an understanding of the issues or events relevant to the interviewee. If time permits, counsel should prepare an outline of subjects and questions for each witness prior to the interview with reference to documents they intend to cover with the witness. Use of documents in witness interviews facilitates the investigative process by enabling witnesses to clarify the language used in a document and its context; it may also refresh a witness’s recollection about subjects he or she can no longer recall.

Investigators should also give due consideration to the ordering of witness interviews to achieve the investigation’s priorities and to prevent duplication (if possible). Typically, counsel will arrange interviews sequentially to move up the organisational hierarchy; such a structure enables investigators to develop facts surrounding relevant issues or events before interviewing senior management and executives to determine whether they knew or were implicated in them. However, time pressures or the nature of the investigation may dictate a different sequence.

When beginning an interview, counsel should ordinarily administer what is commonly known as an ‘Upjohn warning’, informing the witness that (i) the counsel is conducting an investigation on behalf of the company for the purpose of rendering legal advice to the company; (ii) the counsel represents the company and not the employee; (iii) the conversation is protected by the attorney-client privilege and is intended to be kept confidential, but that privilege belongs to the company, not the employee;⁸ and (iv) the company, not the employee, can decide in its sole discretion whether to waive the privilege and disclose to third parties the information provided by the employee.⁹ The provision of an Upjohn warning establishes the foundation for a subsequent assertion of the attorney-client privilege by the company, and prevents employees from developing a reasonable belief that they are represented personally by company counsel, which might inhibit the company from fully using the information obtained during the interview.

Counsel should generally take notes during the interview. Most often, investigators will have at least two people in the interview – one to take the lead in questioning the witness, and the other designated to take notes. Though notes should be detailed, they should not purport or attempt to transcribe the conversation verbatim. Shortly after the interview, while it is fresh in the counsel’s mind, all interviews should generally be memorialised. Information obtained during the interviews should also be added to the investigation chronology.

To maximise the likelihood that interview memoranda will be subject to the attorney-client privilege and work product doctrines, they should be labelled ‘privileged and confidential/attorney work product’, document that Upjohn warnings were administered, and state plainly upfront that they reflect counsel’s impressions of the interview and are not intended to function as a verbatim recitation of what was said.¹⁰ Generally, counsel should not provide a copy of the memorandum to the witness (or the witness’s counsel).

Remediation

If information gathered during the internal investigation reveals that misconduct (such as a violation of law or company policy) has in fact occurred, investigating counsel and the overseeing entity or individual should recommend remedial action to redress it. The recommended course of corrective action will necessarily depend on the circumstances, including any weaknesses in company compliance policies and practices and the nature of any violation detected. It may include enhanced compliance efforts, financial restatement, and/or employee discipline or termination, depending on the type of conduct at issue. In all events, the measures recommended should be sufficient to assure the cessation of the identified misconduct and the prevention of its recurrence.

Preparing a report of the investigation

Once an investigation is complete, investigators should consider the manner in which to present their ultimate findings to the client and any third party. Generally, counsel must assess whether to document its findings in a written report or whether it is preferable to report findings orally. This decision will depend on the nature of the investigation and consideration of various factors.

A written report carries with it the risk of subsequent discovery in litigation or regulatory investigations, and documented misconduct may be used against the company in those matters. Discovery of the written report may, but will not necessarily, also jeopardise the privileged nature of the work product underlying or supporting the report. Additionally, the preparation of a written report may be a time-consuming and expensive process.

Reducing the findings to writing in a report also carries several advantages. Written reports often contain a more precise analysis of the underlying facts, particularly where the issues addressed in the investigation are complicated. A written report may also serve to provide support for the investigation’s thoroughness and demonstrate the fulfilment of any applicable fiduciary obligations. A written report documenting the investigation and its findings may also be necessary to obtain cooperation credit from the government where such credit is sought.¹¹

Whether delivered orally or in writing, counsel should consider addressing in any report, at a minimum: (i) the circumstance or event that triggered the investigation; (ii) the measures taken to investigate the matter (eg, the issues and time periods investigated, the scope of the documents collected, the manner in which they were reviewed, and the identities of witnesses interviewed); (iii) the investigation’s findings; and (iv) recommendations for remediation. Counsel should also prominently disclose in the report (whether delivered in writing or orally) that the report was prepared for the purpose of providing legal advice and is intended to be privileged and confidential, which will enhance the likelihood of protection from future discovery in litigation. Toward that end, counsel should also consider taking steps to limit and tightly control the report’s distribution.¹²

Despite measures taken to preserve privilege, counsel drafting an investigation report should recognise the risk that the report may nonetheless be subject to subsequent discovery, and tailor the report accordingly.¹³ Specifically, counsel should avoid unnecessary commentary, speculation, or ancillary or unnecessary legal conclusions. The report should hew closely to the facts developed and the conduct at issue, and should present a full, fair and complete summary of the evidence, including a description of any mitigating or exculpatory facts.

Disclosure of investigative findings to third parties

Investigating counsel should also give substantial consideration to managing disclosure, if any, to third parties. Public reporting of an investigation or its findings may be mandatory in certain circumstances, and investigators should review closely whether (and to whom) disclosure may be required. As an example, disclosure obligations applicable to a publicly registered company may require public disclosure of wrongdoing at senior levels.¹⁴ The release of an investigation and its remedial recommendations may be a practical necessity in circumstances where the company matter triggering the investigation is already public and causing reputational damage. Reporting obligations and auditing standards may also require that a company share information with its independent auditors if the misconduct at issue relates to financial statements or otherwise involves an illegal act.¹⁵

Companies should approach such disclosure carefully to minimise the risk of waiving the attorney-client privilege or any applicable work product protections.¹⁶ For example, before sharing investigative material with auditors, counsel should attempt to memorialise that materials are intended to be kept in confidence.

Beyond compulsory disclosure obligations, companies may elect voluntarily to share investigative findings, or the fact that an investigation is being conducted, with the government. A company’s voluntary provision of investigative findings to governmental law enforcement or regulatory agencies can accrue cooperation credit, which may result in mitigation of penalties or deferral of prosecution in the criminal context.¹⁷

Sharing this otherwise privileged information, however, will likely implicate or effect a waiver of the protections of attorney-client privilege and work product doctrine and subject the documents to potential discovery in parallel or related civil litigation.¹⁸ Given the likelihood of waiver, counsel and the company should consider carefully the impact that discovery of the investigative materials may have on any parallel proceedings before providing them to the government. If the company does elect to share its investigative findings with a law enforcement or regulatory agency, it should take steps to limit the potential collateral ramifications of any consequential waiver. These may include, among other things, (i) entering into an explicit confidentiality agreement with the agency before production of the information; (ii) stating clearly in correspondence the company’s intent to preserve applicable privileges to the maximum extent possible; and (iii) negotiating (if possible) for the production of only a limited set of investigative materials.

Notes

1   
In some cases, there may be potentially different or conflicting interests within the company (for example, involving the independent directors) that require careful consideration as to who controls the investigation.

2   
Documentation of the structure of the engagement will assist the company in asserting privileges over communications with these experts in subsequent adversarial proceedings. See United States v Kovel, 296 F.2d 918, 922 (2d Cir. 1961) (attorney-client privilege may extend to client communications with an accountant where that accountant was retained by an attorney to assist in rendering legal advice to the client); where counsel seek and obtains outside consulting services, the attorney-client privilege has been extended to such third parties ‘employed to assist a lawyer in the rendition of legal services.’ Abdallah v Coca-Cola Co, 2000 WL 33249254, at *3 (N.D. Ga. 25 January 2000) (collecting cases).

3   
It is often difficult at the start of the investigation to determine who at the company is likely to possess potentially relevant documents. Companies developing a list of employees likely to be, or even or potentially, in possession responsive documents should typically err on the side of over-inclusion.

4   
Such interviews should be documented shortly after their completion. Additionally, counsel should maintain detailed intake records identifying the source and location of each file collected in this manner.

5   
This process is frequently both time-consuming and costly, and the burden of it should be weighed against the particular circumstances giving rise to the investigation.

6   
Investigators should give careful consideration to developing the list of search terms to assure that it is not so limited as to exclude important data, but not so broad as to pull in substantial amounts of irrelevant documents.

7   
Review databases will generally also permit reviewers to sort documents by date, custodian and/or search terms.

8   
Frequently, former employees will also have knowledge about the facts and circumstances subject to counsel’s investigation. Corporate counsel’s communications with former employees may not enjoy the protections of the attorney-client privilege in certain jurisdictions. See Barrett Indus Trucks Inc v Old Republic Ins Co, 129 F.R.D. 515 (N.D. Ill. 1990). Counsel considering interviewing former employees as part of an internal investigation should consult the law of the relevant jurisdiction.

9   
The warning stems from the US Supreme Court’s decision in Upjohn v United States, 449 U.S. 383 (1981), which held that the attorney-client privilege applies to communications between company counsel and all company employees. On the facts before it, the Supreme Court emphasised with approval that the interviewed employees were notified of the nature of the investigation and that interviewing counsel represented the company’s interests, and not the individual employees’.

10 
These disclaimers will maximise the likelihood that the memoranda will be covered by the attorney work product doctrine. See, eg, Baker v General Motors Corp, 209 F.3d 1051 (8th Cir. 2000) (‘Notes and memoranda of an attorney, or an attorney’s agent, from a witness interview are opinion work product entitled to almost absolute immunity’); see also United States v Ruehle, 583 F.3d 600 (9th Cir. 2009) (stressing importance of documenting the administration of Upjohn warnings).

11 
See, eg, Report of Investigation Pursuant to section 21(a) of the Securities Exchange Act of 1934 and Commission Statement on the Relationship of Cooperation to Agency Enforcement Decisions, SEC Rel. No. 44969 (23 October 2001) (the Seaboard Report) (in evaluating whether and to what extent to credit cooperation, the SEC will consider whether the company ‘provide[d] sufficient documentation reflecting its response to the situation’ and whether it ‘produce[d] a thorough and probing written report detailing the findings of its review’).  See also Memorandum of Sally Yates, Deputy Attorney General (9 September 2015) (‘In order for a company to receive any consideration for cooperation under the Principles of Federal Prosecution of Business Organizations, the company must completely disclose to the Department all relevant facts about individual misconduct. Companies cannot pick and choose what facts to disclose.’)

12 
Before providing a report to a company’s board, investigating counsel and/or the oversight committee should evaluate any privilege waiver implications, particularly where certain directors are directly involved in the conduct subject to the investigation, or otherwise have a personal stake in the investigation’s outcome, as opposed to an interest merely as a fiduciaries of the company.

13 
As described below, the company may also elect voluntarily to share the report with the government, which may trigger a waiver.

14 
See, eg, SEC Regulation S-K (17 CFR section 229 et seq.).

15 
See, eg, Section 302(a)(5)(B) of the Sarbanes-Oxley Act of 2002 (15 U.S.C. section 7241(a)(5)(B)) (requiring CEO and CFO to certify that they have disclosed to company auditors all fraud, whether or not material, involving management or other employees with a significant role in the company’s internal controls). Auditors are required under generally accepted auditing standards to obtain written representations from management concerning, among other things, knowledge of fraud or suspected fraud. Section 10A of the Securities Exchange Act of 1934 (15 U.S.C. section 78j-1) additionally requires that auditors have in place procedures designed to provide reasonable assurance of detecting illegal acts and/or related party transactions that would have a material effect on a company’s financial statements.

16 
While there is good authority in the US supporting the notion that disclosure to an independent auditor does not waive the work product protection, there is not complete consensus on this point. And in all events, disclosure will result in a waiver of the attorney-client privilege.

17 
See, eg, the Seaboard Report; Memorandum from Mark Filip, Deputy Attorney General, Principles of Federal Prosecution of Business Organizations (28 August 2008) (the Filip Memorandum). The guidelines articulated by the Filip Memorandum are now part of the US Attorney’s Manual. See US Attorney’s Manual section 9-28.000.

18 
Courts have generally refused to recognise ‘selective waiver’ (ie, disclosing privileged material to a governmental party, but withholding it as to other parties) in the context of the attorney-client privilege. See, eg, In re Pac Pictures Corp, 679 F.3d 1121 (9th Cir. 2012) (collecting cases); but see Diversified Indust v Meredith, 572 F.2d 596 (8th Cir. 1978). Courts have been more (but far from uniformly) willing to endorse selective waiver in the context of the work product doctrine. See In re Martin Marietta Corp, 856 F.2d 619, 625-26 (4th Cir. 1988); but see In re Columbia/HCA Healthcare Corp Billing Practices Litig, 293 F.3d 289, 306 (6th Cir. 2002).