United States: 6 Questions To Ask Before An Internal Investigation

Every company, large or small, will eventually face a problem that requires an internal investigation. Boiled to its essence, an internal investigation is really nothing more than a way to obtain information to avoid or solve problems. But performing an effective investigation requires experience and skill. Not surprisingly, there is ample literature on how to conduct an effective investigation and best practices in doing so. Far less common, but equally important, are the questions a company's decision-makers — whether a CEO, compliance officer, or in-house counsel — should ask before an investigation begins. Those questions are critical, however, because their answers will affect the course of the investigation — and ultimately its results.

Here are six that are part of an effective inquiry:

1. What risks does the company face?

This is the simplest but most important question. If a problem poses only a minor risk, it may not merit a full-scale investigation, a significant time investment, or use of outside counsel. But risks can be hidden. For example, a run-of-the-mill employee complaint may on the surface appear to be a routine human resources problem. On closer examination, however, the allegations, if substantiated, might reveal a compliance breakdown or a more systemic issue, leading to potential company liability. Or the complaining party may be a potential whistleblower who could prompt a government investigation.

Depending on the company, one of two obstacles to proper risk analysis occurs. Larger companies will likely have compliance officers, in-house counsel or outside attorneys who can adequately assess the risk. The obstacle is ensuring that the necessary information reaches those individuals. For that to happen, front-line employees must be trained to identify problems, and there must be a known pathway to communicate and, where necessary, elevate problems.

For smaller companies, by virtue of their leaner operations, getting information to the top is usually less of a concern. The problem instead is ensuring that decision-makers, who often are generalists and wearing many hats, can recognize and weigh the issues and risk exposure.

An initial risk assessment, continually reconsidered as facts become known, should account for as many potentialities as possible. Properly used, it will drive every other legal and business consideration in advance of a possible internal investigation.

2. What is the purpose and scope of the internal investigation?

Once company decision-makers decide to investigate, they must be clear on the purpose and scope. The purpose may be narrow, e.g., to determine whether a specific contractor offered a bribe, or it may be broad, e.g., to review the company-wide anti-corruption policy.

Scope is related but distinct. It is the body of information to be gathered, and the steps authorized to gather it. The scope of the investigation will greatly influence its costs, particularly if electronic data is involved. A sharply defined scope provides guidance to the investigators, avoids mission creep, and controls costs.

Considering short-term costs alone, however, is a mistake. A broad purpose will almost always require a broad scope for the investigation to be effective and to produce the information needed. Credibility is equally important: whether it's the board of directors, a disgruntled employee, or a federal prosecutor, they will know a superficial investigation when they see it — and the long-term costs of a botched investigation are likely to far exceed the initial savings.

3. Who will conduct the internal investigation?

The advantages of using in-house personnel to conduct their own investigation are obvious: they are more cost-effective, likely to be less threatening and disruptive to employees, and generally know the players, policies and operations of the organization better than outside counsel.

But risks abound: potentially compromised objectivity, trickier privilege issues, awkwardness investigating personnel with whom there is a long-standing relationship, likely lesser credibility with government officials, and usually less specialized skill in conducting an investigation. Outside counsel of course pose a greater initial expense but offer some assurance with respect to privilege, independence and credibility.

In general, the more serious the risks and the broader the scope, the more likely outside counsel should be involved. Long-time outside counsel who have a significant relationship with the company also may present the same credibility issues as in-house counsel. Again, as the risks increase, companies should consider whether separate, independent outside counsel for purposes of the investigation are advisable

4. What disclosures are required?

The same event that triggered an internal investigation may trigger disclosure obligations and often they are time sensitive. Some are industry- or role-specific such as Federal Acquisition Regulation disclosure rules for prime contractors or shareholder-reporting obligations and Sarbanes-Oxley reporting requirements for public companies. Others may be contract-based, such as insurer contracts with health care providers or hospital credentialing policies with medical practices. Companies may also have insurance to cover internal investigations and have a notice obligation. Finally, notice of potential overpayments from the government can trigger the 60-day window for repayment under the False Claim Act.

5. How will we protect the company and communicate on its behalf?

Protecting the company is a foremost concern, and is intertwined with how information is communicated. The most obvious example involves privilege issues. The steps for preserving privilege in an internal investigation include ensuring that Upjohn warnings are given, counsel conducts or directs the internal investigation, third-party contractors (investigators, e-discovery consultants, etc.) are properly managed by counsel, and privileged communications — particularly email — are clearly established.

But protection and communication go beyond mere privilege concerns. In-house counsel must consider how media issues will be handled and who will communicate on behalf of the company. Internal communications to employees and stakeholders also play an important protective role. Clear information and open lines of communication, while balancing confidentiality issues, can minimize rumors and external reports. By contrast, poor communication can stoke discontent and make things worse. Not every problem and internal investigation will pose all of these issues, but communication and protecting the company should always be a consideration.

6. What coverage applies?

The issues giving rise to an internal investigation can often involve bet-the-company stakes. In those cases, urgent matters can occupy all of the focus. But early on, companies should also consider financial issues and whether any insurance coverage applies to internal investigations. Increasingly, such policies are available — especially with mushrooming FCA investigations in health care and other regulated industries. Coverage will of course depend on policy specifics and often turns on the nature of the investigation (criminal or civil) and other factual circumstances. Nonetheless, company decision-makers should consider their liability coverage, its scope, and whether it may cover or defray costs associated with an investigation.

Internal investigations by their nature are stressful and fraught with peril. Asking the right questions at the beginning can put companies on the path to the best outcome possible.

Republished with permission. This article first appeared in Law360 on December 12, 2014 .

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.