10 Keys to Defensible Internal Investigations

Investigations don’t always go according to plan.  And sometimes, there is no plan at all.  They also rarely follow a straight line.  When the unexpected happens, the investigative team will need to adjust on the fly.

Another factor that often comes into play is time pressure.  There is pressure to start the investigation, make regular reports to leadership and to bring them to an end just as quickly.

And organizational leadership doesn’t necessarily understand or accept the fact that there’s no way to predict outcomes or the length of time an investigation may require. But following a defined methodology will help create efficiencies and lead to more consistent results.  To help organizations shape their investigative processes, Sheppard Mullin Partner Scott Maberry and White Collar Forensic President Scott Moritz have created a list of 8 musts and 2 “nice to haves” to help you in your efforts to move from an ad hoc process to a future state that is both repeatable … and defensible.

At the Direction of Counsel

Topping the list of musts is the Attorney Client Privilege and the Attorney Work Product Doctrine. It is surprising when the suggestion of performing an internal investigation at the direction of counsel is frequently met with resistance.

Performing an investigation under the privilege is not a hard and fast rule. And sometimes there are good reasons not to have the lawyers overseeing everything. But typically when the investigation is digging into issues that might create a record of wrongdoing, potential wrongdoing or any kind of record that the organization and their attorneys want to keep secret from third parties, the attorney-client privilege and the related work product doctrine are really important.

They’re not absolute protections, but if you can get that protection, you want to have that protection. If an attorney is overseeing or conducting the work, the material that’s produced is protected under the attorney-client privilege. Additionally, communications between the attorney and their client for purposes of providing legal advice is also protected. A little further out on the spectrum of protection is material that’s protected under the work product doctrine. That is when an attorney directs work to be done for the purposes of providing legal advice, that work product created by non-attorneys can be protected.

In a perfect world, the way the protection works is that if a third party outside the attorney-client relationship requests, subpoenas or demands information, if it’s privileged it should be protected from disclosure. But those protections vary from jurisdiction to jurisdiction around the United States, and it varies widely outside of the U.S.  Suffice it to say, that having the protection is better than not having protection.

Have an Investigative Plan

Our first of two “nice to haves” is “Have an Investigative Plan or Protocol.  There are a number of benefits to organizations that perform internal investigations that follow a written plan. Given the fact that time pressure is often a factor in internal investigations, leadership usually wants to see things resolved quickly. There may be external forces such as law enforcement or regulators who have a rooting interest in a timely investigation that is properly scoped. One of the benefits of having an investigative plan is there isn’t time lost associated with confusion, particularly if it’s a company that hasn’t had prior experience conducting internal investigations. There can be a lot of open questions including who’s going to be on point inside the organization, what skill sets do we have inside the organization that could be of utility and where are we lacking in skill sets? Having an investigative plan allows you to be introspective, look realistically at the skill sets that you have and identify those that you need to supplement with outside service providers.

Being introspective as to the organization’s strengths and weaknesses with its internal investigations capabilities enables the company to identify gaps.  Once those gaps are known, it allows for the proactive identification of resources that may be needed in an internal investigation. Examples of these types of resources include computer forensics and eDiscovery professionals, investigators with expertise in background investigations, forensic accountants and blockchain investigators. Having access to those resources because you took the time to line them up in advance of a need enables the organization to respond quickly.

Another benefit of having a written, repeatable investigative plan is that when someone is fired for cause following an investigation, it gives the organization the ability to demonstrate that it followed a consistent and repeatable investigative process. This will go a long way toward countering arguments that the company acted unreasonably or was being arbitrary.

Data is Everywhere – Know Where it is and How to Access It

The identification of the different information sources that exist within the organization and that may be needed in an investigation is critically important, particularly when an investigation is time sensitive. As important is knowing who can grant you access to that information and how those data owners can be reached after business hours.

We often think of accounting, banking and business records, emails and the contents of devices when collecting data for investigations. But sometimes, it’s the more exotic data sources that make or break the investigation. So, why is knowing all of the company’s data sources and how to access them so important?

Data can be anywhere and everywhere. And any one piece of it can move the needle in an investigation. One of the first things to do in any investigation is make sure that the email servers are protected, that people get a notice not to lose, alter or destroy any documents or any records and that the IT department knows not to overwrite system backups. Do the same thing with hard copy records. Informal company communications channels often come into play. One such channel that comes up regularly is Slack. Knowing who acts as administrator of the company’s instance of Slack is key so that there is an agreed upon protocol to capture Slack to preserve, collect and analyze communications has been established.

Understanding the various ways company personnel communicate with one another outside of what is typical significantly increases the likelihood that critical communications between bad actors will be captured within the scope of the investigation. Social media is also a part of the puzzle. The company social media account and the social media accounts of witnesses may provide valuable information to the investigative team.

In one recent case, the owners of a manufacturing plant suspected that their contract laborers were overstating their hours leading to millions of dollars of overbilling. The time keeping system was of obvious use but so was the access control system that captured when each employee swiped in at the start of their shifts. But what enabled investigators to have a definitive basis of comparison to the timekeeping records was the fact that the access control system required everyone to swipe again as they left the facility for the day. Having these records on everyone’s arrival and departure times enabled the investigators to refute the allegations. You never which data source is going to become relevant so acquaint yourself with all of them.

Creating a Standing Investigations Committee

Since investigations tend to emanate from different organizational domains, they have both common elements and then some that are specific to the organizational domain, business unit or whatever’s being investigated. Knowing the different constituencies who tend to need investigations will point you to what different organizational functions that might need to be represented on the Standing Investigations Committee. What exactly are those constituencies and what’s the benefit of creating an investigations committee inside the company?

The different constituencies, functions and activities within an organization means that investigations within these different groups may necessitate some variance specific to that business unit or the subject at hand. A human resources investigation might have elements that differ from a network intrusion investigation or a financial crime investigation, but there’s also commonality. And that standing committee is a useful structure for a variety of reasons. First, it creates a mechanism for the sharing of information across the different committee representatives so that they each have the benefit and the insights that come from internal investigations occurring outside of their primary domain.

Sharing the pain points experienced and the identification of shortcomings in the control environment can enable the standing committee to refine the investigative processes being followed and assist the business in their continuous process improvement efforts by providing meaningful input supporting the need to make changes.

Calling for Reinforcements

Most organizations do not have personnel with all of the skillsets needed to perform internal investigations. Some don’t have any.  What are of the drivers as to when and how to bring in additional disciplines and subject matter experts to an internal investigation?

Internal investigations sometimes reach a point when the team recognizes that additional expertise is needed. Technical accounting expertise is one such example. If a witness advised the team that employees have been inaccurately booking revenues or expenses in the company’s accounting journals, it would be wise to add a CPA to the team who understands accounting and the rules that govern when to recognize revenue and how to account for different types of business expense. That new team member should be the person leading interviews of accounting and finance personnel and sitting in on accounting system walkthroughs.

Sometimes as investigators, we encounter highly technical data that is important to the investigation and the need to understand that specific data may drive the need for additional expertise. Scott Maberry’s team conducts a lot of export control investigations and many of those investigations include making determinations whether a complex technology item, software code or some other piece of technical data requires an export license. These are highly technical determinations that are best performed by engineers, scientists or software development experts.

If the investigative team needs to add technical expertise, it might be tempting to immediately call someone, ask them questions and generate interview notes and documentation. Acting on impulse when addressing the need for technical expertise has the potential to undermine the attorney-client privilege. Ideally, the attorney leading the investigation should speak to each potential new team member, explain the privilege and give instructions on the steps the team has been following to protect the information, advice and strategy of the investigation. It may sound unnecessarily complicated but it’s quite routine and it enables a smooth transition as new professionals are added to an investigative team.

Planning for the Press

Although investigations are best performed covertly especially during the early stages, the existence of the investigation and the problems that gave rise to the investigation sometimes erupt in a very public and uncontrolled way.  It is important to consider and plan for when an investigation becomes public knowledge. In fact, it’s critical.

Questions to ask yourself at that outset of an internal investigation include:

Do we have a relationship with an outside crisis communications firm?

Are there in-house professionals who act as press spokespersons that are well suited to front the press in a crisis?

Does the CEO or a member of the executive team have crisis communications training?

Absent having thought through press inquiries in advance, the role often defaults to the CEO or possibly the head of the local business unit. That doesn’t necessarily put the organization on the best footing if default designee is not prepared or has not been in that situation before. Public statements that are either premature, commit the company to a timetable or level of transparency that isn’t appropriate may actually compromise the investigation or things like privilege.

If you have taken the time to consider the types of incidents that could happen before they actually occur, you’re going to make much better decisions. And deciding who speaks to the press and what they should say is at the very top of the list. Those first 24 to 72 hours in a crisis will set the tone positively or negatively.

The Inevitability of Whistleblowers

More than half of corporate internal investigations are triggered by confidential or anonymous whistleblowers. And with the many economic incentives that exist for whistleblowers, the frequency and volume of whistleblower cases seems likely to grow. Investigative plans should include guidelines and advice on how to interact with whistleblowers, build trust and protect them from being retaliated against.

One of the organization’s first considerations is that it is absolutely unlawful to retaliate against a whistleblower for bringing to light some misdeed committed by company personnel. Biases, instincts to be protective of the organization and dismiss the whistleblower as disgruntled or disenfranchised are an ever present factor that must be acknowledged. These very normal and customary reactions  which if they are not reined in at the outset, your problems are at risk of getting much worse because the perception is that guilty parties retaliate and good corporate citizens do what is right.

Put yourself in the shoes of the person who is reporting the information and consider what is at stake for that person.  And despite the career and sometimes personal safety risks, they set them aside and still decided to come forward.

Your written communications, spoken words and actions in responding to whistleblower actions become a part of the record of the investigation, good or bad. Proceed with caution, follow your written guidelines and try to separate any preconceptions and biases that may creep in from the allegations that are being made.

Organizations must manage these processes carefully, and that means making sure that the investigative team is completely aligned with the human resources team that’s dealing with personnel actions that may be relevant and the overall legal advice for the company.

It’s also important to keep in mind that many times, the investigative team doesn’t know who the whistleblower is but it’s a safe bet that it’s a current or former employee or officer.  Sometimes, there are multiple whistleblowers in play.  And some or all of them may be talking to the government at the same time they are talking to you.

There may come a point in the investigation when the identity of the whistleblower becomes known and the investigative team has an opportunity to interview them. And when the team is interviewing that person, one temptation that companies very often have is to guarantee that person confidentiality. “We’ll keep you out of it”. “We’ll keep your identity confidential”. “We won’t disclose anything”.  While that may encourage the person to be completely transparent, those promises may not be legally possible.  Be careful not to commit the organization to actions that may not be possible and could end up putting the company in a vulnerable position.

Even if the identity of the whistleblower is not revealed, the investigative team should be mindful of the fact that every time you are interviewing a witness, they could actually be one of the people who was sharing information confidentially or anonymously. And sometimes upon being interviewed, the witness may reach a point of feeling comfortable with how the interview is going and identify themselves as a whistleblower. When preparing for each witness interview, consider the possibility that the person you’re interviewing may be the whistleblower and don’t say anything during the interview that would cause you to be prominently featured in their next anonymous communication.

Companies conducting internal investigations sometimes don’t understand the necessity of providing an Upjohn Warning to the witness. An Upjohn Warning is given at the beginning of an interview making it clear that the attorneys in the room doing the interview are legally representing the company and not the witness individually. This is very important because if the witness ever forms a subjective impression that they have an attorney-client relationship in their personal capacity with the lawyer who’s interviewing them, then they become the person who governs whether there’s an attorney-client privilege and effectively end up owning it. Interview planning should include a discussion as to who should do the interview,  and whether an Upjohn Warning is appropriate and necessary.

Allegations Against the Leadership Team

Sometimes, the allegations that give rise to an investigation are directed at organizational leadership. That can change everything. Knowing that as a possibility enables organizations to take steps beforehand to make sure that the people being implicated can’t wield undue influence over the investigation or even prevent it from happening.

Routing of that initial information is a very important part of an organization’s investigative procedures.  If the allegations come through an ethics hotline, most hotlines are set up with someone acting like a triage nurse. That person assesses allegations as they come through, determines which category they fall into and routes them accordingly. Most often, allegations against senior leadership are shared with the chairperson of the audit committee when hotline allegations against senior leadership are raised.

In terms of how organizations configure their hotline complaint intake process, they should anticipate allegations against senior leadership, and take steps to create an ethical wall insulating the investigative team and the investigation itself from those individuals.

With each consideration being discussed, the business case for having and adhering to a written investigative plan gets even more compelling. Having an investigative plan helps protect the independence of an investigation when senior leadership is “in the frame”.

Inhouse Counsel or Consigliere?

What if the allegations are directed at the legal department? This can make the scoping of an internal investigation even more complex since it affects the structure of the engagement of outside counsel, investigators and other service providers who may be necessary.

An organization’s normal point of contact for an internal investigation is typically the chief legal officer. If the legal department is being implicated, you’ve got to find another way to govern the investigation. When this possibility is contemplated in advance, there’s usually a way the organization can structure the engagement so that it’s overseen by a committee of the board or its chairperson. This arrangement also requires rethinking who’s conducting the investigation because very often an investigation is a deep collaboration between outside counsel, outside consultants, and the legal department. When investigating the legal department, one of the three legs of that stool isn’t there. It can make the investigation awkward. The company and members of the investigative team have to anticipate that and be aware of how the atypical reporting structure and investigative focus may affect the investigation. Even routine investigative tasks like setting up witness interviews, the imposition of legal holds, and access to the email system are normally arranged by inhouse counsel. It’s good to factor these variables into the investigative workplan prior to getting underway to allow for the investigation not being performed in collaboration with the General Counsel’s office.

Avoid Trampling on the Company’s Culture

We have already discussed that the existence of the investigation and the underlying allegations could be made public. People inside the organization are the ones who are most likely to notice when an internal investigation is going on.

The arrival of an army of suits is seldom a welcome sign inside of an organization. When an investigation moves to a more overt phase and anxiety across the organization is soaring, what steps should the company take to avoid setting off a panic?

In fact, the effect that an internal investigation can have on an organization’s culture and morale is often overlooked. When a company hasn’t experienced internal investigations often, there’s a tendency not to acknowledge the existence of the investigation internally. Not saying anything means that people’s worst fears become the internal narrative. The first thing that everybody thinks about is “how is this going to affect me?” ,“Am I going to lose my job?”, or  “I the company going to go under?” A myriad of anxieties start bubbling to the surface. Absent some thoughtful messaging from leadership to quell those anxieties, the rumor mill will be rampant, and people may react in a way that could undermine the internal investigation and possibly lead to misinformation when rumors get reported as fact.

Saying nothing isn’t an advisable strategy for the leadership team.

Earlier, our discussion was about who should speak to the press and what the script should look like.  There should be an internal script of talking points too and it should go something like this. “You may have noticed some new faces in our offices recently and we wanted to share what we are able to about what’s going on. While we can’t share every detail, here’s what we can tell you.” Sometimes, it is ok to acknowledge there’s an internal investigation.  If that’s the case, say: “We are in the midst of an internal investigation. The company’s not in trouble. There’s no indication that we did anything wrong. Your job isn’t at risk.” Of course, these statements need to be aligned with the facts but if it’s accurate to say these things, people will appreciate hearing them. They are the exact things that people need to hear to tamp down their anxiety. The talk tracks should align to public statements including: “we will share what we can share as soon as it’s permissible and appropriate to share it with you. But just rest assured, we are looking out for the company and its best interests, but we also have to do what’s right”.

Giving what assurances that can be given will go a long way toward lowering organizational anxiety and keeping the rumor mill in check.  Like public comments, internal comments should be filtered through outside counsel before their release to make sure that they don’t obligate the company to do things that they can’t deliver on,  risk compromising the internal investigation or the company’s legal position.

Closing Thoughts

Internal investigations vary greatly, and you should expect to have to change directions several times before the investigation reaches the end. But if you use these 10 keys as guideposts, you may find that doing so introduces a degree of consistency, drives efficiencies and a measure of predictability to an otherwise unpredictable and challenging process.

About the Authors

Scott Moritz is the president of White Collar Forensic LLC, a provider of complex investigations, forensic accounting and compliance advisory services.  He has 39 years of combined private sector and public sector investigative experience including as an FBI Special Agent.

Scott Maberry is a partner and international trade lawyer in Sheppard Mullin’s Governmental Practice in DC where he counsels and defends clients in civil and military export controls, the Foreign Corrupt Practices Act (FCPA), anti-terrorism, national security, economic sanctions, anti-boycott controls, and anti-money laundering (AML) matters.

To watch and listen to the full podcast episode on this topic, click here.

To listen to an audio-only version, click here.