In an era of the 24-hour news cycle, social media, avaricious plaintiffs' lawyers and aggressive government enforcement, discrete (and discreet) problems can spin out of control in the blink of an eye. Moreover, Congress has "deputized" the entire corporate work force to serve as law enforcement, providing substantial financial incentives for employees to report wrongdoing by their organizations. Building on the tremendous success of the False Claims Act, Congress established the IRS whistleblower program in 2007 – through which a former UBS employee was recently rewarded $104 million for information about overseas tax shelters – and the SEC whistleblower program in 2010. In this environment, it is more important than ever for companies and institutions to understand how use effectively internal investigations to minimize and possibly eliminate these risks.
Problems can take many forms – financial fraud, kickbacks, unsafe working conditions, cutting corners in the manufacturing process and producing a substandard product, security leaks, sexual harassment, etc. The common denominator in this parade of horribles is that each can significantly detract from an organization's mission or even threaten its very existence. Even the most innovative compliance program cannot overcome all human frailties that can lead an organization to peril — for example, criminal prosecution, lawsuits and a loss of support from customers and key benefactors. An entity facing allegations of serious wrongdoing will be judged as much by how effectively it responds to the situation as by the occurrence of the misconduct itself, especially when the organization has a vital compliance program in place. In many instances, an effective response begins with a thorough but focused investigation of the facts as soon as credible allegations are reported.
Early Warning System
An organization cannot respond effectively to a problem unless it is promptly informed about it. Traditional internal auditing practices do uncover valuable information about financial malfeasance within an organization but, for budgetary reasons, often are limited in scope and, experience shows, can be thwarted by efforts to conceal the wrongdoing. Therefore, organizations must, in the first instance, depend on their employees to support the goal of compliance with the law.
Where that goal is not met, employees must believe they have a legitimate avenue to report noncompliance without fear of retaliation. Most organizations now have a compliance hotline. Employees should be encouraged to use it, and the company should provide quick acknowledgment and follow-up on information about possible wrongdoing. At annual performance reviews, supervisors should actively elicit information about potential problems by asking employees directly if they have been asked to do anything that makes them uncomfortable ethically, or are aware of any wrongdoing by company employees. Retaliation against whistleblowers should be expressly discouraged, and treated as instances of serious employee misconduct whenever it occurs.
Internal Investigation
Conducting an internal investigation at the first sign of trouble can give an organization the ability to manage the resulting information and address the issue proactively. It also can provide reassurance if the initial concerns are not substantiated. An internal investigation need not be large or particularly expensive. It just needs to be sufficient under the circumstances for the organization to be confident that it understands the issue and has sufficient information to act (or not act).
An internal investigation into suspected wrongdoing demands initial planning to ensure that it serves its purpose of getting to the truth of the matter, without creating more problems than it solves. For an organization to rely upon the results of an internal investigation to justify the action it takes – or doesn't take – it is critical that the investigation is credible, meaning that it is even-handed in its approach, thorough and effective in uncovering the facts. Conducting a perfunctory or biased investigation will inevitably compound the organization's difficulties.
Accordingly, the following issues should be considered at the outset when conducting an internal investigation:
- Who should conduct the internal investigation
- Applicability and protection of attorney-client and work product privilege
- Conduct of investigation: document collection, employee interviews and Upjohn warnings
- Counsel for employees
- Expected end product and audience for report of investigation
These issues should be considered holistically, because they are generally interconnected, and flexibly, because new information might warrant a change of course.
Who Should Conduct The Internal Investigation?
While an experienced human resources employee or member of the compliance team might be adequate to conduct an investigation in relatively straightforward situations, such as employment discrimination allegations or routine expense report problems, there are several benefits to having an investigation conducted by counsel when more complicated or serious allegations arise. Counsel experienced in internal investigations will have the capability in real time to apply the information uncovered to the applicable law, to assess the company's exposure to potential enforcement action or securities claims, and to advise senior management or the board of directors accordingly.
Moreover, investigations conducted by counsel in most instances can be protected from disclosure, at least in part, by the attorney-client and work product privileges. The applicability of these privileges gives the organization flexibility to limit disclosure of the uncovered information to key internal decisionmakers, or to make a disclosure to law enforcement, to a court or to the public on its own terms if circumstances warrant. The question also arises whether inside counsel or outside counsel ought to conduct the investigation. There is no definitive answer, and several factors might influence this decision.
Inside counsel offers the advantage of knowing the key players, policies and operations of the organization, and may seem less threatening to employees as they collect documents and conduct interviews. An investigation by inside counsel may also be more cost effective in the short term. However, there also are risks to having inside counsel conduct an internal investigation. For example, inside counsel may have been consulted at some point about the matter under investigation, which could compromise his or her objectivity and perhaps even make the lawyer a witness at some point if litigation or a government investigation ensues. An insider also may feel constrained by personal or even reporting relationships from aggressively following the evidence wherever it leads, especially if it leads to the upper reaches of the executive suite. In addition, because inside counsel often provides business as well as legal advice, his or her investigation may be susceptible to a privilege challenge because only legal advice is covered by the attorney-client privilege. Business advice is not.
Accordingly, it might be best to retain outside counsel to conduct an internal investigation, particularly in serious, complex matters where a law enforcement investigation and/or a shareholder lawsuit seem likely and the internal investigation will be closely scrutinized. The use of outside counsel may be essential to establishing the true independence of the investigation, thus enhancing the investigation's credibility in the eyes of a prosecutor or court.1 Outside counsel represents "fresh eyes" and is not likely to be beholden to management in a way that might subtly or even unconsciously influence their findings. Outside counsel might also convey a sense of purpose and seriousness that can cut through reticence on the part of employees who need to be interviewed.
Applicability of Attorney-Client Privilege or Attorney Work Product Protection
Maintaining a privilege over the documents prepared in the course of an internal investigation is a dicey proposition. No matter how well planned and executed the internal investigation might be, attorney-client privilege or work product protection can be challenged, or eventually waived to serve the larger interests of the organization. The best approach, therefore, is to preserve the privilege in the course of the investigation as best as possible to provide the most flexibility to senior management or the board in addressing the underlying concern.
There are two privileges most relevant to internal investigations – attorney-client communications and attorney work product. Avenues to preserve these privileges should be considered together (for both can be waived) and separately (for each can be challenged). Start with the engagement letter for outside counsel, which should make clear that counsel is being retained to conduct an investigation in order to provide legal advice to the entity – magic words for attorney-client privilege protection. If the underlying issue reasonably might result in litigation, that should be noted in the engagement letter as well, which will help buttress a claim for work product protection over documents and memos generated in the course of the investigation. As the investigation progresses, it will be important to avoid disclosure of attorney-client communications to third parties, which likely would waive the privilege.
The organization ultimately may decide that it is in its interest to waive attorney-client privilege in order to demonstrate the forthrightness of its investigation, or to make a disclosure to law enforcement in order to stave off, mitigate or even assist in, a criminal prosecution. In some cases, such as hostile work environment claims, a company could rely upon an internal investigation as a defense to liability, in which case any claim of privilege with respect to the investigation will almost surely be deemed waived.
The bottom line is that while there are many advantages to protecting the information developed during an investigation under the cloak of privilege, both counsel and client should approach an internal investigation expecting that at some point, the organization will decide to disclose at least the facts that are uncovered. In practice, this means that draft memos and reports should not be retained, and sensitive information – especially any preliminary conclusions that are drawn – should be communicated orally when possible, and not by email.
Conduct of Internal Investigation
An organization virtually will be forced to make some kind of public report from an internal investigation into such calamities as the BP oil spill in April 2010 or the Jerry Sandusky scandal at Penn State University. Particularly in high-profile matters, the organization can expect that the quality of its internal investigation will be scrutinized heavily by government enforcement agencies, the media, shareholders and the public. Two of the most important measurements by which the credibility of the investigation will be judged are whether the investigation is truly independent, and whether the investigative team had unfettered access to all of the relevant documents and witnesses (a third, of course, is the diligence with which the facts are pursued). As discussed above, utilizing outside counsel, particularly "special counsel" with limited or no prior relationship with the organization, can help substantiate the independence of the review. Additionally, no one in the organization with any connection to the possible wrongdoing should be involved in decision-making regarding the selection of counsel or the scope of the investigation, or be in the reporting chain for counsel conducting the investigation. Finally, the organization's leadership should be deferential (within reason) to counsel's judgment concerning the scope of the investigation, and the documents and witnesses to which counsel believes it needs access. It is not unusual for counsel to have to expand the scope of an investigation based upon information learned in its course, that suggests different or more widespread problems than the original precipitating allegation had indicated.
Preserving and Collecting Documents
The collection and review of documents usually are essential elements of an internal investigation. Documents, of course, can be damning or exculpatory on their face, but more often will help develop and focus lines of inquiry for interviews with company employees. Obviously, if an investigation is triggered by the receipt of a government subpoena, the organization will have immediate responsibilities to preserve, collect and produce responsive documents. Routine email purges should be halted immediately, and as soon as practical – it reasonably may take a little while in larger organizations – a "hold notice" should be sent by in-house counsel to those employees expected to have responsive documents, with clear direction to preserve documents related to the subject matter of the subpoena. Then, a plan for collection of documents can be developed.
Subject to time and resource constraints, a substantive review of the documents to be produced to the government (in addition to the necessary privilege review) should be done to identify issues and potential defenses to be developed in the internal inquiry in parallel to (and ideally one or two steps ahead of) the government's investigation. With sufficiently targeted search terms, such a review can be conducted cost effectively. Where an investigation is prompted by an internal report of employee wrongdoing, the universe of relevant documents generally is defined by the nature of the allegation. Document collection for an internal investigation should be planned in the same manner as the other aspects, with the goal being to access all of the information reasonably obtainable in a timely fashion to provide as complete a picture of the underlying facts as possible. Collecting and reviewing too wide a swath of documents can slow down the progress of the investigation and significantly increase its cost. Conversely, a document review that is not broad enough (or quick enough) heightens the risk of spoliation of evidence, overlooking important information, or later criticism about the scope of the investigation itself.
Certain allegations could impel counsel (through experienced IT support staff) immediately to image employees' hard drives to ensure that key evidence is preserved. This can be especially important where allegations against an individual or a small group of "rogue" employees are raised, such as embezzlement, sexual harassment, or a discrete kickback scheme. In other cases, sending a document preservation notice to employees who may have relevant information should be sufficient to ensure that the documents will remain available as the investigation unfolds. It is often helpful to allow employees to review the documents they can expect to be shown during a scheduled interview in advance of that interview, so they could provide thoughtful responses to questions about those documents.
Interviewing Employees
Another area that demands some attention throughout an investigation is how to handle interviews with current or former employees. Current employees have an obligation to cooperate with an internal investigation. Still, interviews of current employees need to be handled delicately to foster earnest cooperation in uncovering the facts and in dealing with other interviews or depositions requested by law enforcement or other third parties – as well as to protect their rights, preserve their relationship with the organization, and avoid costly distractions from the progress of the investigation.
At the outset of any interview of an employee by outside counsel, it is essential to provide them with the so-called Upjohn warnings, which have evolved from the U.S. Supreme Court's decision in Upjohn Co. v. United States, 449 U.S. 383 (1981). The Upjohn warnings require counsel to make clear to the employee that they represent the entity, not the individual, and that counsel's duty of loyalty is to the organization alone, and not to that employee. Accordingly, there is no confidentiality in the interview vis-à-vis senior management or the board members to whom counsel is reporting. Moreover, counsel must further advise the employee, the interview is privileged, but that privilege belongs to the organization, and may be waived by the organization through a disclosure to the government or in a public report.
Although these words obviously can have a chilling effect on the interview, it is important for the employee to understand the role of counsel to which he or she is speaking, and the limitations on the confidentiality that applies to the discussion. Indeed, it should be documented in the memorandum of interview that is later generated that the Upjohn warnings were given, and the interviewee acknowledged that he or she understood them. This will minimize the risk of collateral arguments, or even litigation, with an employee claiming to have an independent attorney-client relationship – and correspondingly, an independent attorney-client privilege – with the investigating attorney. Such disputes can be very damaging to the organization, by detracting from the credibility of its investigation, delaying or even preventing a voluntary disclosure by the entity as part of an effort to resolve the matter, increasing legal costs, and perhaps jeopardizing counsel's engagement by forcing counsel to become a testifying witness in the matter.
Another issue that frequently arises in the course of interviewing company employees is whether employees need their own counsel. This question is asked often by the employees themselves at the outset of an interview. Accordingly, it may be worthwhile to address the issue up front, as part of the Upjohn warnings, by noting that the employee has a right to confer with individual counsel, but that the interviewing counsel is unable to advise them about whether they "need" counsel for themselves. However, investigating counsel still must be alert to conflicts of interest, and for the potential down the road
of government prosecutors seeking to disqualify it from representing the organization in a resulting prosecution. Therefore, it may be necessary for certain employees to retain their own counsel if information is uncovered about illegal activities by those employees, or the government is asking to speak with them.
The Outcome
Once an internal investigation is concluded, decisions must be made about how to assemble the information that was gathered, to whom it should be presented, and what steps should be taken in light of what was learned. In many cases, this is the point where experienced counsel's guidance is at a premium: applying the facts, the law and its experience to provide guidance to senior management or the board about how to address the situation effectively.
High-profile instances of illegal activity almost certainly will require some public disclosure of the results of the organization's investigation, and/or a presentation of the results to law enforcement in an effort to avoid or mitigate prosecution. Accordingly, it may be advisable for counsel to prepare two reports of investigation – one straightforward recitation of the facts for public consumption, and a separate report that also contains analysis and legal advice, directed solely to the "client" that retained them. Preparing two reports in this manner may increase the likelihood that the entity will be able to preserve the attorney-client privilege over the "internal" report, since the facts, which are not privileged, will be in the public domain, lessening the professed "need" for the privileged report sought by a potential adversary. Alternatively, when transparency is paramount and the organization wants to quiet conspiracy theorists speculating about what lurks in the "nonpublic report," counsel can prepare just one report of investigation for public consumption, and confine its legal analysis and advice to face-to-face meetings with the client.
Ultimately, an effective investigation enables counsel to report to senior management or the board: (1) what wrongdoing occurred and by whom; (2) what vulnerabilities in the organization's processes were exploited by the wayward employee(s); (3) what the legal and other consequences are to the organization from the misconduct itself, as well as the potential "holes" in its compliance program that were revealed; and (4) options to address and rectify the exposure created by the wrongdoing. The course that the organization may choose to follow is as varied as the array of problems that can arise, but an internal investigation providing the entity with this information will give the board and senior management the tools to address any problem appropriately and protect the organization from calamitous consequences.
Footnote
1 For this reason, the American College of Trial Lawyers recommends using an independent "Special Counsel," with little or no previous relationship to the company, to conduct the internal investigation in cases where serious criminal or securities law violations are raised.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
