1 The Decision to Conduct an Internal Investigation
1.1 What statutory or regulatory obligations should an entity consider when deciding whether to conduct an internal investigation in your jurisdiction? Are there any consequences for failing to comply with these statutory or regulatory regulations? Are there any regulatory or legal benefits for conducting an investigation?
An entity should firstly consider if there is an ongoing statutory or regulatory investigation and if so, how that might impact the decision to conduct an internal investigation. For example, it should also consider whether there exists a reporting obligation to An Garda Síochána (the police authority). Section 19 of the Criminal Justice Act 2011 ("the 2011 Act") makes it an offence for a person to withhold information from An Garda Síochána which may be of material assistance in (a) preventing the commission of a relevant offence, or (b) securing the apprehension, prosecution or conviction of a person for a relevant offence. A "relevant offence" for the purpose of the 2011 Act includes offences in the areas of banking and other financial activities, company law, money laundering and terrorist, theft and fraud, bribery and corruption, consumer protection and criminal damage to property.
It is also necessary, prior to undertaking an internal investigation, to consider whether the information on foot of which the investigation is being conducted came from a whistleblower. If so, the entity must ensure that the protections afforded to whistleblowers by the Protected Disclosures Act 2014 ("the 2014 Act") are adhered to.
The principles of constitutional and administrative law are applicable; in particular, fair procedures must be followed in any investigation.
If an effective internal investigation is conducted and the report is subsequently made available to a statutory or regulatory body contemplating undertaking its own investigation, the relevant statutory or regulatory body may accept the findings of the internal report and decide to take no further steps. For example, they might instead insist on being updated in relation to the implementation of recommendations in the internal report. In that regard, a regulator may attach more credibility to the findings of an intern investigation where it is carried out by an external third party.
1.2 What factors, in addition to statutory or regulatory requirements, should an entity consider before deciding to initiate an internal investigation in your jurisdiction?
It is important to gain an understanding of the scale of the issues, the ability of the entity to conduct the investigation, the manner in which the investigation is intended to be carried out and the potential impact of the investigation.
1.3 How should an entity assess the credibility of a whistleblower's complaint and determine whether an internal investigation is necessary? Are there any legal implications for dealing with whistleblowers?
The 2014 Act provides that employers may not dismiss or otherwise penalise or cause detriment to a worker for having made a "protected disclosure".
It is mandatory for all public bodies, and highly recommended for all entities, to have in place a whistleblowing policy. In assessing the credibility of a whistleblower's complaint, an entity should have regard to any internal procedure as set out in the whistleblowing policy. The entity should assess whether or not the concern raised is in fact a protected disclosure or if it is, for example, a grievance issue. Where the matter is being treated as a protected disclosure, depending on the level of information provided by the whistleblower, further discussion with the whistleblower may be required in order to clarify the substance of the allegations.
Under the 2014 Act, there are a number of protections for a whistleblower. For example, an employee may be awarded up to five years remuneration for unfair dismissal on the grounds of having made a protected disclosure.
1.4 How does outside counsel determine who "the client" is for the purposes of conducting an internal investigation and reporting findings (e.g. the Legal Department, the Chief Compliance Officer, the Board of Directors, the Audit Committee, a special committee, etc.)? What steps must outside counsel take to ensure that the reporting relationship is free of any internal conflicts? When is it appropriate to exclude an in-house attorney, senior executive, or major shareholder who might have an interest in influencing the direction of the investigation?
Not every employee of the entity will be considered the client for the purposes of claiming privilege over communications. Rather, the client will usually be those individuals who are expressly charged with seeking and receiving legal advice on behalf of the entity. In certain circumstances, it may be appropriate to establish a subcommittee to deal with a particular issue. Outside counsel should establish at the outset who "the client" is and establish clear lines of reporting with those individuals as legal advice privilege may only attach to communications between the client as defined and the external lawyers.
Individuals who may be the subject of the investigation or who may be a relevant witness should not be involved in the running of the investigation.
2 Self-Disclosure to Enforcement Authorities
2.1 When considering whether to impose civil or criminal penalties, do law enforcement authorities in your jurisdiction consider an entity's willingness to voluntarily disclose the results of a properly conducted internal investigation? What factors do they consider?
As a general rule, law enforcement authorities do not consider an entity's willingness to voluntarily disclose the results of an internal investigation when deciding whether to impose civil or criminal penalties. However, there are some exceptions to this.
In a health and safety context, cooperation by an employer, employees and others with a Health and Safety Authority ("HSA") investigation, including the facilitation of interviews with HSA inspectors, can be a mitigating factor taken into account in the sentencing of any employer/employee convicted of an offence under the Safety, Health and Welfare at Work Act 2005.
In a competition law context, the Competition and Consumer Protection Commission ("CCPC") operates a Cartel Immunity Programme in conjunction with the Director of Public Prosecutions ("DPP"). The Programme provides that if a member of an illegal cartel is the first to come forward and reveal its involvement in the cartel before the CCPC has completed an investigation and referred the matter to the DPP, it may avoid prosecution. The applicant must provide the CCPC with full, frank and truthful disclosure of all details and evidence relating to the alleged cartel.
2.2 When, during an internal investigation, should a disclosure be made to enforcement authorities? What are the steps that should be followed for making a disclosure?
As soon as it becomes clear to an entity during an internal investigation that a relevant offence pursuant to section 19 of the 2011 Act has occurred, the entity should make a disclosure to An Garda Síochána. Section 19 does not provide a defined time limit within which the information must be disclosed but states that it must be provided "as soon as practicable". The better view is that disclosure should be made as soon as the information comes to hand to avoid prosecution or penalty. A similar disclosure obligation arises pursuant to sections 2 and 3 of the Criminal Justice (Withholding of Information on Offences against Children and Vulnerable Persons) Act 2012 which makes it an offence to withhold information in respect of certain offences against children or vulnerable persons.
Usually, a disclosure to An Garda Síochána is by way of letter to the appropriate Superintendent/Chief Superintendent setting out brief details of the relevant offence, the information on which the knowledge or belief that an offence has or may occur is based, the identity of the suspected offender (if known) and any other relevant information.
There are a number of other legislative provisions that impose obligations on people to report to the relevant authorities. These include a duty on individuals in a "pre-approved control function" to report breaches of financial services regulation to the Central Bank of Ireland pursuant to the Central Bank (Supervision and Enforcement) Act 2013; a duty on designated persons such as auditors and financial institutions to report money laundering offences to An Garda Síochána and Revenue pursuant to section 42 of the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010; a duty on auditors pursuant to section 59 of the Criminal Justice (Theft and Fraud Offences) Act 2001 to report offences that may have been committed by a client under that Act; and a duty on auditors to report to the Director of Corporate Enforcement a belief that an offence has occurred. The reporting procedures are largely similar to that outlined above.
In addition, it is overall good governance to report suspected criminal offences to the authorities.
2.3 How, and in what format, should the findings of an internal investigation be reported? Must the findings of an internal investigation be reported in writing? What risks, if any, arise from providing reports in writing?
There is no obligation to report the findings of an internal investigation in writing; however, the advantages to preparing a written report include that it provides a comprehensive record of the steps taken in the investigation, the methodology used, an analysis of the facts and issues considered and the findings following investigation.
One of the main risks in preparing a written report is that it carries with it the risk of subsequent disclosure to regulatory authorities, or in litigation, in circumstances where the report will not always be protected by privilege.
3 Cooperation with Law Enforcement Authorities
3.1 If an entity is aware that it is the subject or target of a government investigation, is it required to liaise with local authorities before starting an internal investigation? Should it liaise with local authorities even if it is not required to do so?
There is no legislative requirement for an entity in this situation to liaise with local authorities before commencing an internal investigation; however, it may be good practice to do so, so as not to impede the government investigation.
3.2 Do law enforcement entities in your jurisdiction prefer to maintain oversight of internal investigations? What level of involvement in an entity's internal investigation do they prefer?
Internal investigations are separate to regulatory or criminal investigations. Having said that, where the enforcement agency is aware that an internal investigation has or is being conducted, it may request details of the findings of the internal investigation. The enforcement agency may also request a delay in steps being taken in the internal investigation pending any regulatory or criminal investigation.
3.3 If regulatory or law enforcement authorities are investigating an entity's conduct, does the entity have the ability to help define or limit the scope of a government investigation? If so, how is it best achieved?
In general, entities have little power to limit the scope of a government investigation. However, in certain instances, where an inquiry or commission of investigation is being conducted, the relevant authority may request submissions on the terms of reference which may have the effect of limiting the scope of the inquiry or commission of investigation.
In addition, some limitation on scope may be achieved if it can be established by the entity that access to only certain information is relevant. Communication with the authorities is key in this instance. An investigation cannot involve a widespread trawl of documentation; the information sought must be relevant to the matters under investigation.
3.4 Do law enforcement authorities in your jurisdiction tend to coordinate with authorities in other jurisdictions? What strategies can entities adopt if they face investigations in multiple jurisdictions?
Irish authorities regularly liaise with enforcement authorities in other jurisdictions in relation to requests for, and the provision of, mutual legal assistance pursuant to the Criminal Justice (Mutual Assistance) Act 2008 and the Criminal Justice (Mutual Assistance) (Amendment) Act 2015.
There are many other legislative provisions pursuant to which the Irish authorities may share information with other jurisdictions. For example, section 33AK(5)(d) of the Central Bank Act 1942 (as inserted by Section 26 of the Central Bank and Financial Services Authority of Ireland Act 2003) provides that the Central Bank of Ireland may disclose confidential information "to an authority in a jurisdiction other than that of the State duly authorised to exercise functions similar to any one or more of the statutory functions of the Bank and which has obligations in respect of nondisclosure of information similar to the obligations imposed on the Bank under th[at] section".
The key for entities facing investigation in multiple jurisdictions is to maintain a coordinated approach to the investigations insofar as possible bearing in mind the variances in legislation between jurisdictions, and to have effective centralised oversight.
4 The Investigation Process
4.1 What unique challenges do entities face when conducting an internal investigation in your jurisdiction?
Ireland is a common law jurisdiction with a Constitution; therefore, general common law and constitutional principles apply.
4.2 What steps should typically be included in an investigation plan?
A typical investigation plan should include an analysis of the reason(s) for conducting the investigation, the objectives of the investigation, information required, where this is likely to be located and how it is to be collated. An investigation plan may also include details of the necessity for witness interviews, consideration as to whether external resources are likely to be required, and whether any statutory or regulatory reporting obligations arise. The roles of the respective individuals involved in the investigation should also be clearly defined.
4.3 When should companies elicit the assistance of outside counsel or outside resources such as forensic consultants? If outside counsel is used, what criteria or credentials should one seek in retaining outside counsel?
Outside counsel should be engaged where the company does not have the necessary internal expertise. Where forensic consultants are instructed by external lawyers to carry out an investigation, it is more likely that arguments over privilege may be upheld.
When retaining outside counsel, a company will often first seek advice from its corporate lawyer. The company should ensure that its lawyer has the relevant expertise to deal with investigations and, if not, that the company is referred to an appropriate investigation lawyer.
5 Confidentiality and Attorney-Client Privileges
5.1 Does your jurisdiction recognise the attorney-client, attorney work product, or any other legal privileges in the context of internal investigations? What best practices should be followed to preserve these privileges?
There are two types of legal professional privilege ("LPP") recognised in Ireland. Legal advice privilege applies to documents the dominant purpose of which is the giving or receiving of legal advice. Litigation Privilege applies to confidential documents created with the dominant purpose of preparing for litigation that is pending or threatened or for the purpose of prosecuting or defending litigation.
In an effort to maintain LPP, entities should ensure that lawyers are involved as early as possible in any investigation. In addition, the client should be identified for the purpose of engaging with external counsel and all communications over which it is intended to claim LPP should be sent by or to external lawyers. Documents over which LPP is likely to be claimed should be captioned "confidential and legally privileged". While this is not determinative, it may assist a court in evaluating a claim of privilege. Access to reports and other communications over which LPP may be claimed should also be restricted; the wider the circulation the greater the risk that LPP may be lost.
Common interest privilege may also apply in the context of internal investigations.
5.2 Do any privileges or rules of confidentiality apply to interactions between the client and third parties engaged by outside counsel during the investigation (e.g. an accounting firm engaged to perform transaction testing or a document collection vendor)?
Generally speaking, for legal advice privilege to apply, the communication must be confidential as between the client and lawyer and disclosure to a third party may amount to a waiver of the privilege. On the other hand, litigation privilege may extend to communications between clients and third parties if the communication is created for the dominant purpose of litigation.
Common interest privilege may also operate to preserve privilege in documents disclosed to third parties where it can be shown that the third party has a common interest in the subject matter of the privileged document or in litigation in connection with which the document was created.
It is usual that there would be an obligation of confidentiality in relation to interactions between the client and third parties engaged by outside counsel. However, this will depend on the particular circumstances of the investigation and is subject to any statutory reporting or notification obligations.
5.3 Do legal privileges apply equally whether in-house counsel or outside counsel direct the internal investigation?
Under Irish law, LPP extends to communications with both in-house counsel and external lawyers on the same basis. However, in order for communication with in-house counsel to attract privilege, inhouse counsel must be acting in their capacity as such.
5.4 How can entities protect privileged documents during an internal investigation conducted in your jurisdiction?
There are no compulsory powers of disclosure in internal investigations and each investigation should be carefully considered on its own facts. If there is a failure to disclose privileged material which is relevant to the issues under investigation, this may impact on the overall effectiveness of the investigation.
5.5 Do enforcement agencies in your jurisdictions keep the results of an internal investigation confidential if such results were voluntarily provided by the entity?
Voluntary disclosure of the results of an internal investigation does not guarantee confidentiality, particularly if the enforcement agency considers that further investigation is necessary. Receipt of the results of the investigation may also trigger disclosure or notification obligations for the enforcement agency.
6 Data Collection and Data Privacy Issues
6.1 What data protection laws or regulations apply to internal investigations in your jurisdiction?
The principal Irish legislation regulating data protection is the Data Protection Acts 1988 and 2003, the latter of which implemented the EU Data Protection Directive 95/46/EC. When conducting an internal investigation, an entity must consider the extent of its right to interrogate data relating to individuals or employees pursuant to all applicable data protection and privacy legislation.
On 6 April 2016, the Council of the European Union published the final text of the General Data Protection Regulation (GDPR) which will enter into force on 25 May 2018 and will implement a harmonised data protection regime throughout the EU. The GDPR will replace Directive 95/46/EC and contains a number of provisions which will serve to increase accountability of data controllers and processors including expansion of the duties of data controllers and processors; increased reporting obligations; and strengthened data subject rights.
6.2 Is it a common practice or a legal requirement in your jurisdiction to prepare and issue a document preservation notice to individuals who may have documents related to the issues under investigation? Who should receive such a notice? What types of documents or data should be preserved? How should the investigation be described? How should compliance with the preservation notice be recorded?
There is no legal requirement to issue a documentation preservation notice for the purposes of an internal investigation. However, once an internal investigation is contemplated, an entity should consider suspending all standard document destruction policies. Where possible, IT servers and software systems should be configured so as not to delete any data from the date an investigation is contemplated. All individuals who may have information relevant to the investigation should be notified that they must retain all data. This may be done by the issuing of a document preservation notice but there is no obligation to issue such notice.
Where a statutory or regulatory investigation is being conducted, it may be an offence to dispose of documents relevant to the matters under investigation. In such circumstances, it is advisable to retain all data pending the outcome of the investigation.
How the investigation will be described will depend on the nature of the investigation. Where a statutory or regulatory investigation is ongoing, greater specificity as to the nature of the investigation may be required.
6.3 What factors must an entity consider when documents are located in multiple jurisdictions (e.g. bank secrecy laws, data privacy, procedural requirements, etc.)?
In general terms, the Data Protection Acts 1988 and 2003 specify conditions that must be met before personal data may be transferred outside the jurisdiction. If an entity is considering the transfer of data, it should have regard to applicable data protection and privacy legislation of both Ireland and the other country (particularly if the data is being transferred outside of the European Economic Area).
Aside from data protection and privacy rules, the common law implies a duty of confidentiality on banks/financial institutions in respect of their clients. Contractual relationships between parties may also contain confidentiality provisions which restrict the disclosure of data and entities should consider carefully any such contractual provisions.
6.4 What types of documents are generally deemed important to collect for an internal investigation by your jurisdiction's enforcement agencies?
In Ireland, enforcement agencies do not conduct internal investigations; however, the documents which are generally deemed to be important for internal investigations include communications/ emails, audit reports/accounts, internal policies, diaries, time records, personnel records, telephone records and any other data specific to the nature of the investigation.
6.5 What resources are typically used to collect documents during an internal investigation, and which resources are considered the most efficient?
The resources required will depend on the scale of the investigation. The likelihood is that large volumes of data required for any internal investigation will be stored on company servers. If so, it may be possible for IT to download this data onto a review platform with little disruption to business. If a large volume of data requires review, independent computer forensic experts may assist in collating the data from various sources. Once the data is collated, appropriate keywords or key phrases may be applied to narrow the data requiring review.
6.6 When reviewing documents, do judicial or enforcement authorities in your jurisdiction permit the use of predictive coding techniques? What are best practices for reviewing a voluminous document collection in internal investigations?
The Irish High Court endorsed the use of predictive coding in the recent case of Irish Bank Resolution Corporation Limited & Ors v Sean Quinn & Ors  IEHC 175. This is a developing area and we are likely to see a greater reliance on predictive coding in the future. In terms of reviewing voluminous data, targeted keyword/ key phrase searches are frequently used to narrow the scope of data which is then reviewed using a tailored review platform.
7 Witness Interviews
7.1 What local laws or regulations apply to interviews of employees, former employees, or third parties? What authorities, if any, do entities need to consult before initiating witness interviews?
There is no obligation to notify any authorities prior to initiating witness interviews for an internal investigation; however, if there is a parallel criminal or regulatory investigation, it may be prudent to consider the timing of such witness interviews.
The general principle is that all interviews should be conducted having regard to the principles of fair procedures. It is important that interviews are conducted appropriately and that this is recorded in the interview notes as the notes may subsequently be disclosed to persons against whom allegations are made. If interviews are not conducted in an appropriate manner, this may affect the outcome of the entire investigation.
7.2 Are employees required to cooperate with their employer's internal investigation? When and under what circumstances may they decline to participate in a witness interview?
An employee usually has a duty to provide reasonable co-operation with an internal investigation. This derives from a common law obligation but is generally underpinned by an employee's contract of employment. An employee cannot be compelled to answer questions but, if they fail to co-operate, this may lead to an adverse finding.
7.3 Is an entity required to provide legal representation to witnesses prior to interviews? If so, under what circumstances must an entity provide legal representation for witnesses?
The general position is that an entity is not required to provide legal representation. However, the entity may have a company policy on this issue and if so, it should be considered. In regulatory investigations, regulators often spend time explaining the process to witnesses but they do not provide legal advice. In respect of internal investigations, a trade union representative may often assist a witness prior to interview.
7.4 What are best practices for conducting witness interviews in your jurisdiction?
All interviews must be conducted fairly and reasonably. It is preferable in advance of interview to outline the interview process/ procedure to the witness to avoid any unnecessary delays at the commencement of the interview. When conducting witness interviews, interviewers should:
- inform the witness of the nature of the interview and why their attendance is required;
- advise as to the confidential nature of the interview and investigation;
- put any relevant documentation to the witness so that they have an opportunity to provide their comments on said documentation (consideration should be given as to whether such documentation should be provided to the witness in advance);
- remain impartial during the interview;
- record the interview in writing. Where possible a stenographer should be engaged. As soon as possible after the interview, the interview notes or transcript should be provided to the interviewee who should then be allowed a reasonable period within which to revert with any comments or to otherwise confirm agreement;
- ensure that questions are asked in a reasonable manner; and
- bear in mind that the notes or transcript of interview may be disclosed to a third party at a later date.
If the interview is being conducted by a regulatory or statutory body, the interviewer(s) should outline to the interviewee in advance of interview the range of powers available to them.
7.5 What cultural factors should interviewers be aware of when conducting interviews in your jurisdiction?
The fundamental principle for conducting interviews in Ireland is to ensure that fair procedures are followed irrespective of the circumstances giving rise to the interview.
7.6 When interviewing a whistleblower, how can an entity protect the interests of the company while upholding the rights of the whistleblower?
An entity should consider who the appropriate person to conduct the interview is. In particular, consideration should be given as to whether the individual who received the protected disclosure is the same person charged with conducting the interview.
The interview should be conducted in a fair and balanced manner, and care taken to ensure that the whistleblower is not penalised or otherwise treated unfairly as a result of having made the disclosure.
7.7 Is it ever appropriate to grant "immunity" or "amnesty" to employees during an internal investigation? If so, when?
There is no provision in Irish law for granting immunity or amnesty to employees. Entities should approach this with caution as it may be perceived as bias, or that the entity is willing to overlook the activities of some of its employees while others face scrutiny.
7.8 Can employees in your jurisdiction request to review or revise statements they have made or are the statements closed?
This depends on the nature of the investigation and by whom it is being carried out. For example, in a criminal investigation, once a statement is made to the authorities, it may only be revised by way of supplemental statement. The original statement remains in existence and will be the subject of disclosure in any criminal proceedings. It is good practice to apply similar principles to statements in internal investigations.
7.9 Does your jurisdiction require that enforcement authorities or a witness' legal representative be present during witness interviews for internal investigations?
There is no general requirement that a member of the enforcement authority be present or that a witness have legal representation during interview. Whether a witness is entitled to legal representation at witness interview will largely depend on internal policy and the staff handbook may need to be consulted. Depending on the nature of the investigation, it may also be necessary from a fair procedures perspective.
8 Investigation Report
8.1 Is it common practice in your jurisdiction to prepare a written investigation report at the end of an internal investigation? What are the pros and cons of producing the report in writing versus orally?
The magnitude and seriousness of the matters under investigation will usually dictate whether or not a written report is required. Where a written report is prepared, issues of LPP and other general disclosure or notification issues may arise.
8.2 How should the investigation report be structured and what topics should it address?
The type of report required will be determined by the nature of the investigation and whether it arises from a statutory investigation or an ad hoc investigation or inquiry. However, a typical report might include:
- Executive summary.
- Issues, objectives and scope of the investigation.
- Review of documentation and records.
- Interview summaries.
The report should accurately and fairly reflect the investigation findings, which findings must be based on evidence. It may also be necessary to consider if the report is privileged and if so, it should be marked as such.
The authors would like to acknowledge the assistance of Gregory Glynn, Partner, Litigation and Dispute Resolution and Colm Maguire, Associate, Technology and Innovation at Arthur Cox.
This article contains a general summary of developments and is not a complete or definitive statement of the law. Specific legal advice should be obtained where appropriate.