Internal investigations involve a number of judgment calls, and the reaction to those judgment calls by interested parties such as government agencies, regulators, auditors, and shareholders are not always predictable. Nevertheless, the following are a few pointers to address issues that often arise during the course of internal investigations:
Identify, preserve, and collect relevant information early and document this process
Relevant information often includes data other than email and hard copy documents. It can include items such as telephone records, text messages, instant messages, shared network files, backup data, internet search histories, databases, voicemails, and other data that may only be accessible through a forensic examination of a device.
Adhere to the agreed upon investigative structure unless a formal decision is made to change it.
If, for example, investigative counsel is reporting to the Audit Committee, the General Counsel should not direct the activities of investigative counsel.
Act on allegations of wrongdoing promptly.
A company is usually well served by gathering the facts and determining an appropriate response quickly. For example, the company may need to take action to stop the potential wrongdoing as quickly as possible, and it may be in the company’s interests to self-report a potential violation if it is mandatory and before the relevant regulator learns about it through other means.
Set a realistic time frame for completion
While companies should move swiftly to investigate allegations of misconduct, they should also set realistic timelines for completion.
Develop a clear plan prior to embarking on a substantial data review project
Even in situations where timing is critical, the investigative team is often better served by spending time up front planning any data review. Launching into a data review without a clear plan may cause the reviewers to miss relevant information, review irrelevant information, and create more issues (and expense) in the long run.
Carefully plan the interview process
Interviews are stressful for employees and multiple interviews of multiple employees will damage employee morale. Where feasible, review all relevant information prior to conducting interviews to reduce the chance of multiple sessions. Allow or encourage employees to retain separate independent counsel. Avoid conducting interviews alone and carefully document the information provided. It is important to get answers to all relevant questions, but it is also important to be polite. Keep in mind that it is not uncommon for whistleblowers to claim that a confrontational interview itself is retaliatory conduct in violation of a whistleblower statute.
Do not unintentionally waive the legal advice privilege (or attorney-client privilege) and obtain board consent for intentional waivers
In some circumstances privilege waivers are appropriate, but such a waiver should usually be approved by the board in advance and efforts should be made to avoid unintentional waivers.
Pay attention to various interested constituencies during the investigation
It is often important to communicate with various constituencies other than the client through the course of an investigation. Outside auditors, for example, should normally be kept in the loop on procedural steps the company is taking to investigate any accounting issues since the auditors will need to be comfortable with the findings. Similarly, if the investigation starts with an internal complaint, consider communicating with the complainant. If the complainant is aware that the company is conducting a thorough and independent investigation, the complainant may forgo reporting externally.
Be sensitive to data protection and state secrets laws in other jurisdictions
Many countries often have data privacy or state secrets laws intended to protect company employees and sensitive information. Consult with a local practitioner prior to collecting or reviewing data to ensure that data privacy and state secrets laws are being complied with.
Know your regulator
Different government agencies and regulators have differing views on what constitutes an effective investigation and what constitutes appropriate remedial action. Consider which government agencies or regulators are likely to be involved and consider retaining professionals with direct experience working with these bodies.