United States: Handling Internal Investigations

Goals of the internal investigation

Always begin with the end in mind. This chapter walks through the nuts and bolts of conducting an internal investigation in the United States, but there are many different ways to conduct an investigation. The company must decide, among many other things, how much to rely on internal resources like internal legal, audit, compliance or finance; should it retain external counsel; and how should it document the investigation? The classic lawyer answer to all these questions is that it depends on the facts. And though it is a frustrating answer, it happens to be true: there is no one-size-fits-all plan for conducting internal investigations. So our best advice is to take time at the beginning of any internal investigation and think comprehensively about where you need to be at the conclusion of the investigation. In short, what information do you need to know (or determine is not possible to know), and how can you best position the company when the investigation is concluded? Beginning with the end in mind provides a structure to making each decision in conducting an internal investigation.

Not all internal investigations will result in government investigations or litigation, but it is helpful to know how the US regulators – who see many such investigations and often are called upon to assess the adequacy of an internal investigation – describe an effective internal investigation. We reviewed public statements of Department of Justice (DOJ) and Securities and Exchange Commission (SEC) officials (several of which are quoted in the footnotes) to identify what they believe are the hallmarks of an effective internal investigation. They focus on the results: namely, did the investigation identify the individuals responsible for the wrongdoing. ^[1] This is of obvious importance to the government – there have been many public statements about the government’s desire to prosecute individuals in addition to companies ^[2] – but it is also important to companies. If the company understands the scope of individual wrongdoing, it has necessarily conducted a thorough investigation. And, if it does not, it is difficult to implement remediation designed to avoid the same mistake in the future. Not surprisingly, the government has also emphasised remediation. As a best practice, an internal investigation should focus on thoroughly assessing the veracity of allegations of wrongdoing, including reviewing all relevant documents and interviewing all employees who possess relevant information, whether located at home or abroad. ^[3]

In many, if not most cases, the company will have the best and most direct access to the facts through documentary evidence and witnesses. Designing an effective internal investigation will often put the company in the position of getting the first and clearest view into the relevant issues, and can sometimes allow it to make decisions (eg, in litigation) based on a better understanding of the strengths and weaknesses of the company’s position. Further, if a company is approached by a US enforcement agency to explain an allegation of potential wrongdoing, the best response from the company is that it was already aware of the potential issue and has conducted a thorough investigation, including, if appropriate, effective remediation. Appropriately addressing allegations of wrongdoing (whether potential violations of law or company policy) is a hallmark of an effective compliance programme, and being able to show the government how that works in your company builds trust with the enforcement agency and sends a message that the company is serious about compliance.

The aspects of an internal investigation reviewed below are meant to identify and remind companies of the key issues as they navigate the many decision points of an internal investigation.

Structuring the investigation

There are initial decision-points that will shape any internal investigation. Of primary importance is identifying the client. Is the client the entire company, a subsidiary of the company, the board of directors or a committee of the board? Different clients have different needs and different mandates, goals and duties. For example, if a company’s board of directors establishes a special committee to handle the investigation, and outside counsel is retained by the special committee, both the special committee and outside counsel need to be careful to preserve privilege. The company and the special committee may have a common interest that will protect privileged communications between the two, but it is not necessarily so. ^[4]

The company must also decide who will conduct the internal investigation. Many internal reviews can be handled in-house. When considering whether to hire outside counsel, companies typically consider the capability and availability of inside resources, the potential scope of legal liability or public embarrassment, and the need for independence.

Finally, the origin of an internal investigation is a touchstone for scoping the review. An internal investigation can be triggered in many ways, including by an internal whistleblower, a news report, a government settlement or public disclosure by a competitor, or an inquiry from the government. No matter how it arises, though, the key initial question is: what is the actual allegation of wrongdoing or issue? Focusing on the actual allegation or issue both helps to ensure the company will have the information it needs at the conclusion of the review, and it helps guard against the temptation to conduct an overly broad review. ^[5]

Document preservation and collection

An initial step in conducting any investigation is to identify, obtain control over and implement measures designed to prevent the destruction or loss of relevant documents and information. Absent appropriate measures, investigators may lose the ability to accurately determine the facts. Where litigation is reasonably foreseeable, failure to preserve documents may subject the company to discovery sanctions for spoliation of evidence. ^[6] Further, where criminal investigation is possible, preserving evidence is critical to protect the company and its personnel against allegations of obstruction of evidence. The government can, and does, bring criminal obstruction of justice charges against companies and individuals based on deletion of even just a relevant email or text message. ^[7]

The means to preserve documents may vary based on the scale and complexity of the investigation. Typically, counsel will issue a preservation notice to those persons who may have relevant information. ^[8] This notice will instruct employees to preserve and not destroy information related to the matter under investigation, and employees will be asked to confirm their receipt and agreement to comply with the notice. As the investigation proceeds, it may become necessary to modify the scope of the notice or to expand the number of persons to whom it is issued. ^[9] As part of the preservation measures, the company should consider whether it is necessary to modify its document retention policy to the extent it provides for relevant electronically stored information to be automatically deleted or electronic back-up tapes to be recycled.

Depending on the investigation’s scale and what documents are needed, it may also be necessary to conduct privileged collection interviews. Collection interviews are thorough interviews with document custodians to determine, based on their responsibilities, roles within the organisation, and document practices, what relevant paper documents and electronic records the custodian may have; and to identify, locate and collect the information. Collection interviews are also customary where the investigation is being conducted in parallel with a document request or subpoena from an enforcement agency. It can be helpful to conduct collection interviews while a third-party e-discovery vendor is on-site to collect forensically the identified electronic records and image any hard copy documents.

Document review

Once relevant documents are identified, the investigators must review and analyse the documents, which often includes critical evidence needed to create a factual understanding and chronology of events, and to prepare for witness interviews. Proper organisation of the documents is critical to ensure they are useful and retrievable for investigatory purposes and, if later necessary, to produce to enforcement authorities or in litigation. Often an e-discovery platform is helpful in organising and conducting the review.

In conducting large-volume document reviews, it may be possible for reasons of economy and speed for junior attorneys, contract attorneys or paralegals to conduct the first-line or initial review, though they should always act under the direction of more seasoned attorneys. The review may include classifying documents based on legal privilege status or particular issues. In addition, reviewers should mark key documents for review by the lead attorneys. In many cases, it is possible to narrow the initial universe of documents to review by applying keywords or data analytics techniques. (Again, think carefully about what questions you actually need to answer to guard against an overly expansive and expensive review.)

Counsel must also be sensitive to foreign data privacy rules and regulations. While US law imposes few restrictions on processing, reviewing and producing documents from company employees resident in the United States, many US investigations involve overseas custodians or business operations. In those instances, US counsel should consult with the company’s data privacy officer and, as necessary, data privacy counsel before collecting or reviewing data. ^[10] Chinese law, for example, requires that documents undergo state secrets review before transfer from China. Under the General Data Protection Regulation, European Union member states also have significant restrictions on the processing and transfer of personal data, a term that can be broadly understood. These and similar restrictions might require document review to be conducted outside the United States.

Interviews of fact witnesses

Interviewing fact witnesses is nearly always an essential component of any investigation. Witness interviews conducted by counsel develop the facts by filling gaps in knowledge that cannot be understood through documents. In addition, a properly documented interview memorialises the witness’s recollection, which can be disclosed as necessary, or later be used to impeach or challenge the witness should the witness’s account change. The sequencing and timing of witness interviews must be decided strategically after careful consideration. In the best case, relevant documents are reviewed prior to interviews; however, urgency may dictate that initial interviews be conducted before documents are fully reviewed or exhibits assembled. Privilege, commercial considerations and related issues may be significant when considering interviews of former employees or third-party witnesses.

In conducting an interview of company employees, counsel must identify themselves and their role as counsel for the company. The essential aspects of the so-called 2 warning ^[11] or 2 include advising the employee witness that:

• counsel represents the company and does not represent the witness;
• the interview is privileged and should be kept confidential; and
• the company owns and may elect to waive the privilege.

Failure to properly admonish the witness can lead to the disqualification of counsel if the witness later claims to have believed that the attorney represented the witness or that the company would keep the interview confidential. Skilled counsel can generally provide the requisite 2 warning while maintaining a productive relationship with the witness. DOJ policy requires that a company seeking cooperation credit must disclose all relevant facts relating to misconduct by individual employees who were substantially involved in or responsible for the misconduct, and it is not uncommon that facts gleaned during interviews are disclosed to enforcement authorities. ^[12]

Effective use of experts in internal investigations

Experts can often provide valuable assistance to the legal team conducting an internal corporate investigation. Retaining an expert early in an investigation can assist counsel in developing the investigative work plan, the investigative strategy, the potential facts and the strategic objectives. Targeted experts can lead to more streamlined and effective document collection and review and more targeted witness interviews.

Cases involving potential financial reporting, books and records, internal controls or compliance violations often benefit from the expertise of a forensic accountant. Economists are also frequently hired to assist with complex corporate investigations because they can assist in determining the financial impact of the company’s activities. Depending on the nature of the issues involved in the investigation, counsel may also consider retaining subject matter experts with knowledge about particular industries, technologies or fields of study.

Before retaining an expert, counsel should consider how they intend to use the expert and whether they want to shield the expert’s opinions and work product from production. Answering these questions will guide the structure of the expert engagement.

There are two types of expert witnesses – consulting experts and testifying experts. Consulting experts are typically hired by counsel to assist behind the scenes with an investigation or subsequent litigation, not to provide testimony during discovery or trial. Except in unusual circumstances, if a consulting expert is retained by counsel, the client is not required to disclose the existence of consulting expert, the substance of counsel’s communications with the expert or the expert’s opinions. ^[13] Because communications with consulting experts are ordinarily protected from disclosure, counsel often use consulting experts to have candid communications about facts, investigative theories and strategies without fear that the communications may later end up in the hands of the opposition.

In contrast, counsel are required to disclose the identity, qualifications and opinions of experts who may be called to testify in pretrial discovery or at trial; the facts or data considered by the expert; and a list of other cases in which the expert testified during the previous four years. ^[14] Communications between a party’s counsel and a potential testifying expert may also be subject to disclosure if they:

• ‘relate to compensation for the expert’s study or testimony’;
• reveal facts or data that counsel provided to the expert and that the expert considered in forming their opinions, or
• they reveal assumptions counsel provided to the expert that the expert relied on in forming their opinions. ^[15]

Documenting the results of an investigation

Before drafting a written report summarising the results of a corporate internal investigation, counsel should consider and carefully review with the client the pros and cons of committing the results to writing.

In a written report, counsel can document the investigative steps, key facts uncovered during the investigation, findings, conclusions and recommendations for remediation. Not only can the report serve as evidence of the actions the company took to examine the matter, but it can also serve as a record that the company can use in subsequent litigation and government investigations. The DOJ and SEC have stated that they will consider whether a company has conducted and produced the results of an internal investigation when deciding whether to give the company cooperation credit. ^[16]

Written reports also have potential drawbacks. When an investigation uncovers improper conduct, a written report serves as a clear record of that conduct. Committing a report to writing increases the risk of disclosure to the government, legislative bodies, or to litigants in private suits. ^[17] If disclosed, statements in a written report may be used as ‘admissions’ by the company in subsequent litigation. ^[18] To mitigate these risks, if a written report is prepared, counsel should be careful to mark a written report privileged and confidential, limit the report’s distribution, and avoid including unnecessary information or conclusions in the report.

In lieu of a complete written report of the investigation, counsel may choose to draft a limited written report or provide company officials with an oral report. Limited written reports typically contain a discussion of the investigative steps and a high-level summary of the facts and issues investigated. Oral reports allow counsel to provide a detailed account of the investigative process and results while minimising disclosure risks. Counsel may also choose to take a hybrid approach by drafting a limited written report supplemented by a verbal reporting of sensitive facts, findings and conclusions.

Whatever means of documentation chosen, it is important to recognise that using the results of the internal investigation (discussed below) often does not happen until years after the conduct, and sometimes years after the internal investigation is complete. Employees turn over and memories fade. Without some record of the investigation, its scope and, importantly, the remediation, the company will lose the full value of an effective internal investigation if important details are lost to the passage of time or retirement.

Using the internal investigation

Internal investigations allow companies to identify problems and implement remediation recommendations. Counsel should inform the company if they uncover ongoing legal violations, misconduct or compliance deficiencies during the course of an investigation so the company can implement corrective action.

At the conclusion of an investigation, counsel should carefully review the findings, legal conclusions and recommendations with the company to determine the appropriate next steps. In some instances, a company may be legally required to report certain findings to the public or a third party regulator. Public companies, for example, are obligated to report material information to investors that may require disclosure of information uncovered during an internal investigation. ^[19] Environmental, health and safety regulations and permits often require self-reporting to the government. ^[20]

Even when disclosure is not legally required, a company may choose to voluntarily disclose the results of an internal investigation. Voluntary disclosure provides the company with an opportunity to control the timing and the messaging around the release of the information, which may assist in mitigating reputational risk. Some law enforcement and regulatory agencies, including the DOJ and the SEC, have policies to encourage self-disclosure by awarding extra cooperation credit for entities that voluntarily self-report. ^[21] On the other hand, voluntary disclosure can lead to unwanted enforcement attention.

Voluntary disclosure runs the risk of waiving the attorney-client privilege or work product protection of the investigative record. ^[22] Counsel should take steps to attempt to preserve the privilege, including obtaining a signed confidentiality agreement from the government that makes clear that the company intends to preserve all privileges and that the government is precluded from unilaterally disclosing the contents of the report to third parties. ^[23] Other techniques, including attorney proffers and ‘hypothetical’ discussions, are available as well to minimise privilege waiver risks while disclosing information, if the decision is made that disclosure serves the company’s interest.

Conclusion

Through careful consideration of the goal of the investigation, and then planning and execution, internal investigations can help mitigate legal risk, reputational harm, business interruption and expense. Achieving these goals requires close collaboration between counsel and client to maximise benefits and avoid negative consequences.

Notes