When a company learns that there may have been serious misconduct within the organisation, one option is for it to conduct its own internal investigation to establish what has happened, who is liable and how to make sure that it does not happen again. A company investigation may take place either instead of or in tandem with an investigation by the police or other investigating authority.
An investigation could be triggered by a suspected fraud by an employee upon the company, or its customers or suppliers. Perhaps an employee has potentially engaged in criminal conduct such as bribery or corruption in the course of his or her work, or has been stealing from the company or its clients. It could be that the alleged misconduct is widespread throughout the organisation and senior management are facing scrutiny.
It frequently falls to the company’s GC to manage the investigation process and it can be a daunting prospect. Here are some of the points which you should address at the outset.
1) Get the right team in place
Assemble a small group to conduct or manage the conduct of an investigation. This is likely to include senior representatives from HR, legal compliance and IT and someone at board level, preferably a non-executive director. You should take a wide view of the alleged misconduct and ensure that no one with direct knowledge of, or supervisory responsibility for, the potential wrongdoing forms any part of the investigation team. All decisions taken by the team – to act or not to act – must be scrupulously documented, together with reasons.
Any document or communication covered by privilege is protected from disclosure in any subsequent English legal proceedings, so ensure that all your communications in respect of the investigation attract privilege. Note that since the Eurasian Natural Resources Corporation decision in May 2017, lawyers have been exercising greater caution when generating documents in investigations as, if that decision stands, it will be more difficult to claim litigation privilege in respect of such material.
2) Prioritise evidence preservation
This is key to a successful investigation. It is also critical to any future criminal, civil or disciplinary proceedings. If the investigation is being conducted in anticipation of a formal investigation by the police, regulator or other investigative agency, it is expected that the company will take every reasonable step to secure any potentially relevant material and may be heavily criticised for any failings, similarly if civil proceedings are anticipated.
Consider how to secure evidence without alerting suspects. Will specialist IT consultants be needed?
The main steps will include preserving relevant hard copy material, imaging all relevant electronic devices and securing all relevant centrally-held material including personnel files, compliance material, risk reports, CCTV footage and any store of recorded telephone calls. The company must also suspend any email deletion or file destruction policies pending the outcome of the investigation. Online email and storage accounts should also be identified and secured where possible.
Once this is complete, the process of evidence review can begin.
3) Define terms of reference
The objectives and the scope of the investigation must be identified and agreed at the outset. The terms of reference will set out clearly what has been alleged, the matters to be investigated, the parameters of the investigation, proposed investigative steps and the proposed timescale for the conclusion of the investigation.
If the investigation is to be limited to certain jurisdictions, date ranges or areas of the business, this should be made clear. If, during the course of the investigation, other matters arise which merit consideration, the terms of reference should be formally extended.
Defining the terms of reference in this way should assist in keeping the investigation focused and avoid ‘scope creep’. Further, the terms may in due course be disclosed to an external investigating authority to demonstrate that the company has taken an appropriate approach to the investigation.
Consider privilege when setting the objectives: litigation privilege only applies if litigation is the dominant purpose of the investigation.
4) Comply with data protection obligations
The company will be the ‘data controller’ (as defined under the Data Protection Act 1998) for the purposes of the investigation and will inevitably be required to ‘process’ (meaning gather, review and potentially disclose) data, including ‘personal data’, in the course of the investigation.
The Act does not prevent the company from gathering, reviewing or disclosing personal data for the purposes of a legitimate investigation but the processing of this data is subject to certain safeguards. The company must consider and, importantly, document whether its intended use of personal data meets one of the listed conditions under the Act. Such processing may fall within the ‘legitimate interest’ criterion: this requires the company to balance the legitimate interest of the company in making use of the data as against the impact of such use on the privacy interests of the individuals concerned. Under the 1998 Act it may be possible to rely on employee consent to process data but once the GDPR comes into force it will be difficult, if not impossible, to rely on this.
5) Protect whistleblowers
An investigation will often be triggered by one or more of the company’s employees blowing the whistle on alleged wrongdoing. Also, during the course of the investigation, employees may make disclosures which mean that they gain whistleblower status.
Whistleblowers benefit from strong legal protection against dismissal or other detriment. They must therefore be handled with the utmost care. The relevant legislation is technical and specialist advice should be sought. Generally speaking, the disclosure of information has to be made internally within the company in order for protection to apply, although in some circumstances disclosures to third parties, such as regulators, are also protected. Whistleblowers do not have to show the information is true and do not even need to make the disclosure in good faith.
6) Get employee interviews right
It is advisable to liaise closely with any external investigator already involved prior to conducting any interviews with staff as it may object to the company doing so before it has conducted its own interviews.
Refusal by an employee to obey a lawful and reasonable instruction is gross misconduct entitling the employer to dismiss without notice or compensation. An employer’s instruction to attend an interview as part of an investigation will normally be lawful and reasonable. However, while an employee who is a potential suspect and decides not to co-operate with the process could face disciplinary action, in practice the sanction of dismissal is one that he or she may well already face in connection with the substantive issue. Careful consideration should be given to suspending an employee as doing so without good reason can amount to a constructive dismissal but, in most cases requiring a significant investigation, the need to minimise the risk of evidence destruction will in itself be good reason to suspend.
Interviewing employees is an area fraught with difficulty. You should distinguish those individuals who are not suspected of any involvement in wrong-doing with whom background or fact-finding interviews may be conducted, from those who may be inculpated in potentially criminal activity. If the decision is made to interview those potentially involved in criminal activity, great care must be taken. If an external investigating body is involved, it will not wish any such interview to prejudice its own potential investigation or prosecution. It may request that the company refrain from interviewing such individuals or only to do so under criminal caution in order to maximise the possibility of the contents of the interview being admissible in any subsequent criminal proceedings. Specialist advice should generally be sought.
The rationale for the inclusion (and exclusion) of individuals on the interview list, and the basis of interview, must be carefully recorded.
When it comes to the interview itself, remember that you may only have one chance – prepare fully, ask the right questions, take a full and proper note of all questions and answers and retain the original notes.
7) Consider exposure to civil claims
If wrongdoing by the company or its employees/agents has caused loss to a third party, the risk of a civil claim needs to be considered at the earliest opportunity. The company could find itself on the receiving end of a freezing order, search order, disclosure order and/or a delivery up order, all of which will cause disruption to the business. Alternatively the company may wish to use these tools against the wrongdoer who has caused loss to the company. By identifying the risk and potential financial exposure, an appropriate strategy can be put in place.
The matters under investigation may relate to a commercial contract that the company has entered into with a third party. If it appears that there has been a material breach of such a contract, it will be important to review the termination and notice provisions at the earliest opportunity to assess whether protective measures can be put in place.
It should also be borne in mind that any non-privileged material generated by the investigation is likely to be disclosable to other parties in the event of civil litigation arising from the matters under investigation. The safest course is to assume that any such material will be seen by external parties and to plan accordingly.
8) Be proactive in handling internal and external communications
It is desirable to keep the matters under investigation confidential; the fact of a fraud perpetuated against or within the company can damage the company’s reputation. However, this may be impossible and the priority is to manage the messages being sent internally and externally to minimise the damage.
Employees will be unsettled and may need reassurance. Consider holding a town hall meeting as well as writing formally to all employees summarising the position and giving specific instructions in writing regarding evidence preservation and confidentiality.
If the matter becomes public knowledge, your business partners are likely to have concerns and questions which need to be answered in a calm and consistent manner.
If the issue is not public knowledge, assume it may become so at any time. In anticipation, the company’s communications team should prepare clear press statements which may need updating as the investigation progresses.
9) To self-report or not?
The company may require specialist legal advice on whether to report, to whom and in what timescale. In some cases, reporting is compulsory. Examples include:
- Potential laundering of funds – Suspicious Activity Report to the National Crime Agency;
- If company is FCA-regulated – may be an obligation to notify the FCA regarding any concerns regarding clients’ funds or the conduct of approved persons within the organisation. Similar consideration apply with other regulators including the PRA, SRA and ICAEW;
- If company is publicly-listed, there may be an obligation to make certain disclosures to the market.
Careful consideration must be given to the question of whether matters should be reported to the police. There have been cases in which employers have been criticised in employment tribunals for referring malicious or baseless allegations to the police, causing considerable stress to the employees concerned, when they should have dealt with the issue internally.
10) Minimise commercial disruption
It is easy to lose sight of this in the throes of an investigation, but the business still has to run. Do not underestimate the time and resources required to complete a full and proper investigation. The key to balancing the demands of an investigation with those of the business is to devote proper internal and external resources to the investigation and to outsource where necessary.
Finally, try to work to an end date so that closure is in sight. The aim is a focused investigation with a defined scope and a conclusion. Handled correctly, an internal investigation can be a positive tool and a business can emerge stronger.