Triaging, scoping and managing investigations: Making difficult decisions

We have set out below ten top tips on triaging, scoping and managing investigations. These points focus on the difficult decisions that are faced during the course of an investigation in relation to what you are trying to achieve, how best to investigate and when to stop.

1. Fundamentally, the purpose of an investigation has to be established in order to properly scope and manage the investigation. Time spent agreeing the terms of reference will always be time well spent.
2. The purpose of an investigation will depend on the context and the scope of the investigation should be driven by its purpose. Some investigations will be focused simply on establishing the facts of what happened and who was involved; others will also be focused on controls failings; while others will be conducted in order to understand legal/regulatory risk, maybe with a view to reporting to a regulator or prosecutor (and potentially with a view to obtaining cooperation credit).
3. Increasingly, regulators and prosecutors are expecting more of investigations: they want to see root cause analysis and remediation of controls. Authorities are also increasingly assessing compliance programs and culture in the course of their own investigations (see for example the SFO’s recent guidance on the evaluation of compliance programs (see link to our more detailed article).
4. Investigations also have an important role to play in evidencing an effective compliance program (see for example the DOJ’s March 2019 guidance): they are arguably the acid test of a company’s culture.
5. Whatever the particular drivers of the investigation, the focus should be on conducting a proportionate and defensible independent investigation which protects the interests of the company rather than “catching the bad guys.”
6. Triaging can present challenges, because by its nature decisions are made on a limited amount of information. A clear and documented process is vital, focusing on: (i) the nature of the issue or allegation; (ii) the worst case scenario; (iii) the current and potential evidence available; and (iv) ensuring that investigations are conducted by the right functions/external advisors.
7. The purpose of the investigation should feed into decisions as to the procedure for an investigation and who conducts it, for example, the number of interviews, and the nature and scope of data review. In some cases it may be appropriate to conduct interviews before or instead of data reviews (although there are risks in this approach).
8. Approaching the investigation in stages is likely to yield the best results and help keep the investigation focused. Diarizing investigation scoping meetings can help to ensure that the scope is reassessed as you move through an investigation.
9. US authorities will expect to see a robust and independent investigation conducted by specialists. Assertions of privilege are far more readily accepted than in the UK.
10. In deciding when to stop investigating, you need to be in a position to be able to justify the decision to stop to others, including regulators, and have enough information to implement any remediation or other follow up steps. The key question is: have I done enough to manage the risks facing the company?