Home – Internal Investigations—Perspectives, Immediate Steps, the Long Haul

Internal Investigations—Perspectives, Immediate Steps, the Long Haul

By Kristin Casler, featuring Matthew Boxer of Lowenstein Sandler LLP, Michael Hayes of Montgomery McCracken Walker & Rhoads LLP, Annemarie McAvoy of Ernst & Young and Bart M. Schwartz of Guidepost Solutions LLC.


The only thing worse than conducting an internal investigation is conducting one poorly. And getting it right can be tough. There are a lot of moving parts—different constituencies with different agendas, reams of documents, dozens and dozens of interviews and don’t forget attorney-client privilege. Sometimes the stakes are incredibly high. How can you manage it all and get the job done right? A few tips from professionals who understand the day-to-day issues of internal investigations may give you the advantage you need.

There’s no standard, cut-and-dried internal investigation. Each is different. Some are run-of-the-mill, some are high profile. Some are triggered by an internal reporting or monitoring system, tip line or even social media. Others by whistleblowers. Sometimes, a previously improperly conducted investigation is the impetus for a whistleblower’s complaint and a new investigation.

“No matter how it comes about, it’s very important that an investigation is handled properly, that everything that is done is documented, and that the strategy is thought through, because the ramifications of missteps are very significant, financially and otherwise,” said Matthew Boxer of Lowenstein Sandler.


Credibility Instills Confidence

No matter what type of circumstance or who is conducting the investigation it has to be above board and independent, though independent does not necessarily mean that the investigating group has no prior relationship to the company.  In some cases that is essential, but in others it is not.  If, for example, law enforcement is involved, investigators won’t be particularly impressed if someone from the company’s own staff conducted the internal review and says, “We haven’t done anything wrong.”


“In many of those kinds of situations, it’s in the company’s interest to bring on outside counsel, perhaps folks that have a relationship with the law enforcement office in question, to conduct more of an independent review,” said Boxer. “The person who conducts the investigation will sit with prosecutors and be able to advocate for a non-prosecution situation, based on what they’ve found.

“One thing that’s frequently very important in these cases is the attorney who’s doing the review should not have been the one to give legal advice related to the issue in question. But even if you don’t have a situation quite like that, companies frequently decide it’s in their interest to get an entirely new law firm involved, to really preserve that independence.”


Multiple Hats Cause Conflicts

Michael Hayes of Montgomery McCracken agreed. In the case of Broadcom, outside counsel was brought in with expertise to conduct the internal investigation, but it also was handling civil litigation arising from the issues that led to the internal investigation. “Consider, when you’re conducting an internal investigation, the other areas that you might need outside help in, and whether or not one firm, one company can handle multiple hats. Your outside counsel can have some of the same problems as inside counsel, where you’ve got multiple hats on, and it creates conflicts or problems.” Those conflicts can be costly. Bart M. Schwartz of Guidepost Solutions pointed to Upjohn v. United States, 449 U.S. 383 (1981); 1981 U.S. LEXIS 56. After three years of time and expense into an internal investigation, the U.S. Department of Justice deemed it not sufficiently independent.

When regulators mandate an investigation, they often refuse to accept or rely on the company’s investigation. They require an outside consulting company to come in and do a complete review, and it’s incredibly costly to the company, said Annemarie McAvoy of Ernst & Young. When that happens, companies need to establish parameters. What type of transactions are you looking at? Only those from high-risk countries? What time frame should be the focus? Will they also be looking at small transactions? Are the people coming in qualified to do the type of investigation required? Do they have appropriate quality assurance controls? All of that should be set out in your statement of work with the consultant.

“All of this is incredibly important, especially down the line, because you want to show the regulators that you did it the right way,” McAvoy said.

If you have monitoring systems, a consent decree for prosecution may require that the systems be updated. Outside monitors may be appointed by the regulators. They have their own systems and will double-check the findings of your monitoring system.

McAvoy also cautioned that your monitoring system must be up to standards. In the case of Standard Charter, the company was hit with an extra $300 million fine after initially getting hit with about $650 million, because the systems weren’t as good as they should have been and weren’t upgraded properly. “The financial institution can’t say, ‘Well, I don’t agree with that.’ Whatever the regulator determines, the regulator or the law enforcement agency is calling the shots.”

The addition of multiple regulators and law enforcement agencies can further complicate the investigation. “If you’re handling this investigation or you’re overseeing it in any way, you have to be aware that you have different constituencies that are looking at the results, and each one is going to make their own determination as to whether it’s been handled appropriately and the right measures are being taken,” McAvoy said. “You have to really juggle all of these different parties that are involved, too.”


Internal Perspectives

And don’t forget that those interested parties include company executives. Many senior executives want to be briefed on everything, Hayes said, but it’s generally not a very good idea. “The CEO, the CFO—they should be running the company, and those who are experienced in conducting the investigations should be doing that.”


It’s also not a good practice to have those involved in the investigation also determine discipline. “I feel very strongly about this separation,” Hayes said. Discipline should be up to others who may have broader interests in the company, to make sure that there’s consistency, and everyone is treated fairly.”

McAvoy presented another side to that argument. Since, more and more, senior executives are being held responsible based on the outcome of the investigation, they want to be involved. In some cases, such as anti-money-laundering cases, they must to be involved and sign off on policies and procedures. They’re required to know what’s going on. She cited a $1 million fine to the MoneyGram chief compliance officer and a $25,000 fine to an executive of Brown Brothers Harriman as examples.

This brings up another sticky question. If you have outside counsel representing the company, but the CEO may be personally liable, should they bring their own outside counsel? There is a lot of potential for conflicts of interest.


Best Practices

What is the surest way to have a smooth investigation? You already know the answer. Be prepared. Have a plan.


“Planning for things like this is not real high on folks’ lists of favorite things to do,” said Hayes. “But if you put off that planning now, you’re going to have to do it later, and it’s going to be a more painful process for you later, for sure.”


Anticipate the types of internal investigations you might have to run. Develop a different team for each —violations of internal policies, violations of the law by employees, violations of law by the company through employees. Plan to move in a way that will be defensible and achieve your investigation goals: determining what happened, who was involved, what response is required, anticipating the response from regulators, law enforcement and plaintiffs’ attorneys, and preventing a recurrence.


“I can’t speak highly enough on standardized processes and procedures, like a scientist does with scientific methods,” Hayes said. “If you can’t repeat your process for internal investigations in a large-scale way, how are you going to defend it? How are you going to create that audit trail? When folks leave your organization, how are you going to make sure that knowledge is institutionalized, so that you’re protected and you know what was done previously?”


Your plan should also include document and data management policies and procedures. Before you start worrying about how you’re going to preserve evidence, you have to know where your documents and data are. Your company also should have a good internal reporting system for litigation threats and tips so claims don’t linger and delay a response. Another must is a case-tracking system, Schwartz said.


Preserving Attorney-Client Privilege

One of the issues that dominates internal investigations is the attorney-client privilege. To preserve it, at a minimum, requires including in-house or independent counsel in the review, Boxer said. The privilege may be irrelevant in a run-of-the-mill human resources investigation. Or, companies frequently decide to waive the privilege and share with prosecutors or with others the product of the investigation. That may be the best course of action. But if you later need the privilege and you haven’t done everything to preserve it, you likely will have to turn over documents from your investigation.


McAvoy noted that you don’t always know what an investigation is going to turn into. Even if the issue is seemingly small, the legal department should get its arms around it early, giving you a much greater chance of maintaining the attorney-client privilege. For that reason, the company’s reporting policy should require contact with legal.


If you want to maintain the privilege from a structure standpoint, you’ve got to think about the primary purpose or significant purpose test, also called the “but-for” test. Lawyers on your internal investigation response team can’t just be members of the team, Hayes said. They really need to direct and supervise the internal investigation, because the provision of legal advice or the request for legal advice must be that primary purpose.


“The thing that kills companies in this area is when courts look at it after the fact and say, ‘You know, this really wasn’t about legal advice, this was about business advice. This was about the best way for the company to proceed, business-wise,’” Boxer said. “I always make clear to every witness that this interview is being conducted so that I can provide the company with appropriate legal advice, and I make sure that gets documented.”


And, it may seem like a minor thing, but be sure you and everyone at the company knows who is being cc’d on emails, where they are going and what they say.  Sending documents to third parties, for instance, can destroy the privilege, McAvoy said.


Investigative Team Models

Common ways to establish your investigative team include having a large team of lawyers, IT, HR and other personnel set up prior to the need for investigation. Then, when one comes in, they decide who on the team needs to be involved in that particular review. The second tends to be less expensive and involves a smaller team with representatives from multiple departments. Each individual is the point person for his/her department on every investigation. Because of the repetition, they know the issues well, Schwartz said.


The Interview

When it comes to actually conducting the interviews, Hayes said you should not do them alone. You have to think about protecting the privilege. You also need to think about the Upjohn warning—the corporate Miranda warning. This warning ensures that the people being interviewed understand that you represent the company alone, that the attorney-client privilege over your discussion belongs to the company alone, and that the company alone has the right to waive that attorney-client privilege. Additionally, the employee being interviewed should keep the discussion confidential in order to avoid having the company waive the privilege.


“If you don’t do this with employees in your internal investigations, where you want to keep privilege, you run the risk that the employee’s going to be under the misimpression that you, as in-house counsel, or that you, as outside counsel, represent not only the company but also them. Then you can get into a real big conflict problem that could result in a privilege waiver,” Hayes said.


It can also be a mess strategically: If a company tells the most senior officers that the attorneys represent them, too, and then six months down the road, the CFO decides to testify for the government against the company. “Now, as the attorney involved, you’ve got a major problem on your hands, because you’ve got one client testifying against the other,” Hayes said.


Instead, be very clear that you only represent the company. Period. If the witness asks if he needs an attorney, Hayes advised putting it back on the witness—it’s his decision. You might offer to postpone the interview while he considers it, Hayes said. You could also offer to ask the questions before he decides whether bringing an attorney is wise, Schwartz said. Sometimes, it just works itself out.


One final note about investigative interviews. Schwartz reported hearing from witnesses that lawyers treat everyone as if they’ve done something wrong. These accusatory interviews send the wrong signal and often are counterproductive to the investigative process.


The article is drawn from a panel discussion at HB Litigation Conferences’ 2015 Northeast Corporate Counsel Forum in Atlantic City.


Disclaimer: The views and opinions expressed in this article are those of the individual sources referenced and do not reflect the views, opinions or policies of the organizations the sources represent.