Spotlight on Solicitors Regulation Authority (SRA) Guidance: Part one, reporting misconduct and conducting internal investigations

A. Series overview

This briefing forms part of a series looking in detail at the SRA’s guidance for in-house teams, issued following a thematic review of the sector, recognising the growth and importance of the in-house role and the unique pressures to which in-house solicitors can be subject. The guidance covers six topics and does not introduce any new standards or requirements but aims to explain how the existing framework applies in particular in-house scenarios.

In this part, we cover reporting concerns about wrongdoing and internal investigations. Part two will cover identifying your client and legal professional privilege and Part three will cover guidance for employers and for governing boards and senior management.

B. Introduction to Part one

Recent high-profile cases involving failures to report wrongdoing and mishandling of whistleblowing and other internal investigation issues across various sectors have highlighted the importance of having robust speak-up and investigation protocols; ensuring they are well understood and followed when issues arise and that outcomes are consistent and recorded and lessons learned are fed back to staff to the extent possible.

Key steps for in-house lawyers include monitoring external guidance and checking that their organisation’s policies and procedures meet best practice.

C. Reporting Concerns About Wrongdoing

The guidance recognises that reporting can be a challenging area for in-house solicitors faced with competing duties and obligations (for example a duty to the organisation to act in the best interests of each client and keep information confidential but subject to overriding wider public interest duties including upholding the rule of law and public trust and confidence).

Concerns that may need to be reported include:

• circumstances in which loopholes are exploited with the aim of defeating the intention of the legislation in question;
• actual or potential breaches of regulatory requirements or law;
• a risk that requires the organisation to take action or report to an external body.

Failing to raise concerns internally could give rise to a breach of duty and damage public trust and confidence. Consideration should also be given to making an external report such as to the FCA/PRA or NCA (taking into account legal privilege on which separate guidance is available). Factors to consider include whether the conduct involves serious offences or harm or may result in a miscarriage of justice. In some circumstances a decision not to report may be more justifiable such as where reporting involves a risk to personal safety, you believe the issue will be addressed or you may breach confidentiality or privilege (although the SRA indicates that support will be provided to those that err on the side of caution and report a genuine concern).

Escalation may be needed for example if concerns are ignored, conduct persists, the issue is particularly serious or the usual reporting line includes a wrongdoer.

Turning a blind eye or being complicit, for example by providing assistance in exploiting a loophole or suppressing exposure of wrongdoing could give rise to a breach of SRA Principles. In some circumstances more drastic action may be needed such as taking independent legal advice and/or resigning (although resignation does not remove the duty to report).

Those who are in a position to do so should ensure appropriate reporting policies and procedures are in place and all solicitors should familiarise themselves with these. Solicitors should also keep written records of any concerns, actions taken and the outcome and reasons for decisions made.

D. Internal Investigations

The investigations guidance is designed to help all firms the SRA regulates and all solicitors (wherever they work) understand and manage regulatory risks and issues associated with conducting an internal investigation. The guidance has been issued because the SRA is concerned that:

• poorly managed investigations could fail to properly deal with underlying risks/control weaknesses and give rise to regulatory issues;
• internal investigations that are not carried out properly can in themselves give rise to a breach;
• investigation reporting that fails to provide a clear and objective assessment of the facts and applicable law risks serious misconduct for concealing or failing to disclose material information, misleading the organisation or others, or even the commission of a criminal offence; and
• there may be circumstances where a client chooses to disregard a report or advice/ conclusions on an investigation and then brings in another solicitor who they are able to influence.

We explore below some of the key areas for any internal investigation and actions that in-house solicitors can take with a view to preparing their organisations and avoiding some of the pitfalls. The guidance includes helpful reminders on the following four key areas:

1. independence;
2. support;
3. evidence; and
4. notifications to the SRA.

1. Independence

Individuals leading or conducting an internal investigation need to be able to act with independence throughout the investigation lifecycle to avoid undermining it and to deliver an unbiased outcome. To assist with this, the SRA flags the following considerations:

i. ensuring that the individuals commissioning and directing the investigation are far removed from any alleged wrongdoing;

ii. confirming that the individuals conducting the investigation have no prior knowledge of or involvement in any relevant events;

iii. considering whether there are measures that can be put in place, such as information barriers, to maintain confidentiality and independence from any individuals providing advice on the underlying matters; and

iv. making clear in the terms of reference whether the investigator has a role in decision making, and evaluating whether this might compromise their independence.

In-house solicitors acting as internal investigators can come under pressure from senior leaders which can compromise the integrity and outcome of an investigation. If this is the case, they should resist being pressured or persuaded to act without independence, and consider reporting the conduct or behaviours experienced. It is imperative that in-house solicitors should feel confident in their position to:

i. give independent, objective advice to their client, bearing in mind that this may not necessarily be who commissioned the report; and

ii. act free from bias, e.g. an individual should not be involved where an investigation concerns issues which may have an impact on that individual as an employee.

Where such independence cannot feasibly be provided by an in-house solicitor, appointing an external law firm to investigate can mitigate against any potential conflicts of interest or bias.

2. Support

The SRA acknowledges that an investigation can be difficult for all those concerned and everyone should receive an appropriate level of support including any whistleblower or other person reporting the issue, witnesses and the subject of the investigation. This should include being alert to red flags that indicate any individual is at risk (recognising the emotional and psychological effects that may arise) and making sure the process is fair and communicating the support available.

3. Evidence

It is vital to get evidence gathering right during an internal investigation bearing in mind that the SRA may assess the integrity of the evidence collected including how it was obtained, stored and disclosed.

Where interviews are conducted as part of an internal investigation:

i. reasonable adjustments and accommodations should be made where appropriate;

ii. consideration should be given to whether, and if so how, to share notes or transcripts of interviews with the subject and the process for seeking agreement to the record of their evidence; and

iii. where a relevant individual cannot be interviewed (e.g. they have left the organisation) this should be clearly recorded to ensure transparency as to which evidence has been relied upon.

With other forms of contemporaneous evidence:

i. underlying documents and data (including metadata) must be preserved, getting IT support where needed; and

ii. consideration should be given to the forms of data being gathered given certain forms may be more time sensitive than others (e.g. CCTV footage).

4. Notifying the SRA

The SRA (or another approved legal services regulator if appropriate) must be notified promptly of any facts or matters that are reasonably believed to be “capable of amounting to a serious breach of regulatory obligations or that [the SRA] need[s] to investigate or otherwise exercise [its] regulatory powers. (Paragraphs 7.7 and 7.8 of the Code of Conduct for Solicitors and 3.9 and 3.10 of the Code of Conduct for Firms)”. The SRA encourages erring on the side of caution but acknowledges that whether or not to report will ultimately be a judgement call dependent on the relevant facts. The SRA recommends including the following in any report:

i. the date of the incident or a timeline of the relevant issues;

ii. how and when you became aware of the incident or issues;

iii. which parties are involved;

iv. any action taken to date to address the issue, and where relevant across the organisation as a whole;

v. any potential impact;

vi. whether insurers have been notified;

vii. any remedial actions taken and next steps; and

viii. the current stage of the investigation and timeline for its conclusion.

If any help is needed in reaching a decision whether to make a report, the guidance highlights the SRA’s Professional Ethics helpline, as well its Red Alert line, through which a confidential report could be made.

Even where the SRA is satisfied a robust internal investigation has been conducted with evidence having been properly obtained, the SRA may still wish to independently investigate to gather additional evidence or examine a matter with its own different lens. A settlement agreement would not preclude the SRA from investigating and confidentiality agreements cannot restrict employees from making protected disclosures.

E. Actions

Practical steps for in-house solicitors to take include:

• Reporting and investigations protocols: Take stock of the extent to which current internal written protocols and guidance cover the topics on which the SRA has provided guidance and whether any new materials are needed. Review any existing written policies and procedures and keep them under consideration as issues emerge and lessons are learned. Potential enhancements might include: ensuring guidance is provided on escalation routes in particular scenarios; how in-house lawyers should deal with privileged information including when reporting; the nature of the support provided to those involved in an investigation; and in what circumstances external advice might be needed to assist those conducting the investigation, considering reporting obligations and making decisions in relation to their colleagues;

• The wider internal eco-system: Consider the extent to which other policies and procedures may tie into the reporting and investigation protocols such as those relating to whistleblowing or speak-up procedures, employment matters and regulatory engagement or notification. The various materials need to be co-ordinated and consistent to provide a robust framework. Is it clear, for example, who will conduct each type of investigation and how internal functions will keep each other appropriately informed. The investigations guidance highlights that those involved in or leading an internal investigation may want to check whether their firm or organisation has any policies and/or procedures on handling confidential and sensitive information and personal data, which is relevant to the investigation process;
• Training: Provide training to all those involved in identifying issues or receiving reports or conducting internal investigations and making decisions. Those tasked with considering outcomes may need advice to assist with achieving consistent and proportionate outcomes and may need access to records of prior incidents;
• Governance and management information: Consider appropriate escalation routes for in-house legal and how investigations will be managed and reported on within the governance framework, allowing for any conflicts of interest and confidentiality concerns. One question to consider is how your organisation would satisfy the SRA or another regulator that adequate procedures were in place and that appropriate outcomes had been delivered. Take stock of the management information that is provided to the Board or relevant committees in connection with escalations and internal investigations and whether this is adequate in terms of identifying themes/lessons learned. You may want to take a look at our briefing note on how you can improve your firm’s governance and learn lessons from regulatory enforcement.