It goes without saying that wrongful conduct in a corporate setting can have drastic and irreparable legal, commercial and reputational consequences for the individuals and entities involved. Internal investigations, which can be carried out quickly and tailored to address specific company concerns, can be particularly well suited to identifying, minimising and remediating such fallout. This is particularly relevant in the current corporate climate in Australia, which has seen an increased level of scrutiny over corporate governance and operational issues. More than ever, there is an expectation that board members and senior managers understand what is happening in their company and wider third-party business and supply chain networks, and take responsibility for the actions of employees and third parties who carry out business on behalf of the company. In this climate, internal investigations are becoming more prevalent; a trend that we expect will continue.

What makes an efficient and effective investigation can vary dramatically depending on the subject matter of the investigation, and the individuals and entities involved. This article provides a brief overview of the key considerations that will allow a company to craft and manage an effective Australian internal investigation, and achieve a prompt and robust outcome.

Launching an investigation

There are countless reasons for commencing an internal investigation. A company may itself have identified potential wrongdoing. Third parties may have alleged inappropriate conduct. Regulators may have made informal enquiries or launched a formal investigation, either of the company itself or of another industry participant, that has knock-on consequences for the company. In some cases, regulators may have required an organisation to undertake an internal investigation (see, for example, section 53 of the Independent Commission Against Corruption Act 1988 (NSW)), or there may be other circumstances creating the impetus to investigate (for example, licence requirements or positive reporting obligations in particular industries).

Entities may commence investigations to determine whether notification is required under the mandatory data breach notification laws introduced into the Privacy Act 1988 (Cth) effective 22 February 2018, in the event the entity suspects but is not certain that a serious and eligible data breach has occurred. Entities are required under the data breach notification scheme to undertake 'reasonable and expeditious assessment' to determine whether there are 'reasonable grounds' to consider that an eligible data breach has occurred. This assessment must be made within 30 days of the entity becoming aware of the relevant circumstances. Entities may also avoid the new notification requirements if they take remedial action before any serious harm is caused by any eligible data breaches.

Entities may also commence investigations in relation to Commonwealth and state modern slavery laws, which require large commercial organisations to report on the steps they have taken to ensure that their goods and services are not a product of supply chains in which modern slavery is taking place. The Commonwealth modern slavery legislation commenced on 1 January 2019.

In some circumstances, urgent action is necessary. This includes where there is an actual or anticipated destruction of documents (discussed below), a need to promptly inform third parties what has occurred, or where relevant personnel are about to depart from the organi sation. Immediate action is also required where any unreasonable delay in launching the investigation could be seen as acquiescence or tacit approval of the impugned conduct by the company.

While those considerations may dictate the timing of immediate steps in an investigation, other factors, such as the need to efficiently carry on business and the availability of resources, will also influence an investigation's progress. Insufficient information and resources can result in a haphazard investigation process and a less than credible – or even unreliable – investigation report.

Identifying who will conduct the investigation

Once the company has decided to commence an internal investigation, it will need to appoint someone to take responsibility for coordinating and conducting the investigation. Often, this will be a member of the company's legal team. However, there may be cases where it is more appropriate for members of the board to have oversight of the conduct of the investigation – for example, where the conduct of senior management is impugned.

Likewise, if the scale of the investigation involves numerous persons across various offices and a large quantity of factually or technically dense material, the company may need to allocate additional and specific resources to the investigation. For example, if the subject matter of the investigation is a serious and systemic issue, or potentially involves misconduct on the part of senior personnel, it may be advisable for external advisers to conduct the investigation. This often adds an additional layer of impartiality, objectivity and forensic scrutiny, and can assist in navigating difficulties created by internal reporting lines or interpersonal relationships between company personnel.

The members of the investigations team should have an appropriate combination of skills, training and experience to support a well-rounded and thorough investigation. If the investigation involves topics where specialised expertise would be beneficial (such as concerns about securities or antitrust violations), that should be taken into account in forming the team. Failure to appoint appropriate persons could compromise the investigation process and outcome. For similar reasons, close colleagues or peers of persons who are 'at risk' in the investigation should not be appointed to the investigations team.

To view the full article click here.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.