By now, everyone is familiar with the stories in the press about prosecutors and regulators. On the one hand there are swingeing budgets cuts, stripping them of resources and affecting their capacity to investigate. On the other, record fines are being handed down and they are taking every opportunity to remind us that they are effectively managing these cuts, and are still investigating and prosecuting not only individuals but also companies who break the law.
In July last year, the Serious Fraud Office (SFO) issued guidance on its approach to dealing with overseas corruption. This guidance encouraged companies to approach the SFO directly to report corruption in exchange for a negotiated settlement that would provide the company with certainty of outcome and the possibility of a civil rather than a criminal penalty.
Now more than ever, companies need to self-regulate and self-investigate before the regulators come knocking at the door with a warrant. If companies uncover anything untoward they need to act fast to understand what is going on within their organisation, whether there have been any breaches of regulations or criminal law, how to manage the associated risks and whether to self-report to the authorities.
If an internal investigation is not properly managed, any disclosure from a whistleblower or routine visit from a regulator could result in stratospheric problems for the company and for any individuals involved, many of which could have been avoided if the company had identified the areas of risk at an earlier stage.
The objective for a company is to take control of the issues if malpractice is suspected, and identify the possible liabilities to which the company may be exposed and the extent of any possible damages incurred, including damage to reputation and potential shareholder action. Getting it wrong can cause even more problems, so companies should have a formal investigations policy and procedure in place, which would include the following key considerations.
1) Planning
Ask some preliminary questions. Do we need to investigate at all? What is the purpose of the investigation? Do we have the internal resources and expertise to conduct the investigation? Are there any conflicts of interest between the internal investigators and the people under investigation? Is there a risk of law enforcement authorities becoming involved? Do we have any duty to self-report to the authorities?
If the investigation is likely to be complex, involves the actions of senior personnel, has an international dimension, or involves regulatory breaches or criminal offences, it is likely that you will need specialist external advice and assistance from the outset.
If you decide to investigate, it is important to ensure that the investigating team has a clear understanding of the intended scope and time frame of the investigation. An initial investigation plan should be prepared.
Internal investigations require a range of specialist skills, from a co-ordinator who will project manage the investigation, delegate tasks, co-ordinate the feedback and produce the final report, to those who will interview witnesses or manage electronic information. You should make sure that these skills are available to the team before commencing an investigation, and then plan to act fast to bring the investigation to a swift conclusion. Any delay could mean that crucial information and evidence is lost.
2) Preservation of evidence
The hard work put into an investigation may be damaged by failing to preserve evidence. It is likely that you will need to demonstrate where a particular document came from, or the date stamp and time of an e-mail from a particular person’s computer. Make sure you handle and record all data gathered from the investigation properly. Failure to preserve documents may have serious consequences, including regulatory sanctions and criminal charges of obstructing justice.
3) Interviews
You will be best placed to interview senior employees or directors once you have thoroughly gathered facts and information first. Interview junior employees first, as they are likely to be more flexible and available to you.
All interviews will be conducted by, or at the direction of, the investigation co-ordinator – preferably in conjunction with external lawyers where appropriate. The co-ordinator will be free to decide whom they want to interview, to preserve the independence of the investigation.
No matter what you think material reviewed suggests to you at an early stage of the investigation, you will get nowhere if you are aggressive or accusatory in your interview technique. You will get the best response from interviewees when you are courteous and patient, and above all listen to their responses.
4) Flexibility
Investigation plans should remain flexible and be able to cope with a change of direction. The scope of the investigation may change once you start to analyse documents or speak to staff. You may end up not investigating the original area of interest, or its scope may increase in size if you find that you have only scratched the tip of an iceberg. You cannot constrain the investigation once it has begun and should make sure you follow up all lines of enquiry.
5) Legal professional privilege and confidentiality
The availability and existence of legal professional privilege will be an important factor in the conduct of an internal investigation. Although the company may later elect to waive privilege, it should nonetheless aim to have a choice about whether to disclose the findings to the authorities.
Litigation privilege can protect documents and communications that are prepared in contemplation of litigation where advice and assistance is sought from lawyers. If privilege is not available, then working papers and reports on the investigation will not be protected from disclosure to the regulators should such information be sought.
Privilege and confidentiality are complex areas, especially where investigations involve more that one jurisdiction. In many cases instructing external lawyers can be the best way to preserve the rights of the company and its employees.
Keep as much information as possible under your hat. If you are able to claim privilege, the wide distribution of any communications and reports could destroy that privilege as any claim to confidentiality will have been undermined. External breaches of confidentiality and leaks to the press are also a risk if too many people know the details of an investigation. Consider who really needs to be included in e-mail distribution lists, or who really needs to read the final report, and keep the number involved to a minimum.
6) Reporting findings
On completion of any investigation, but prior to a final report, the key findings should be discussed by the senior in-house lawyer and the board of directors to decide what action should be taken and whether findings need to be disclosed externally.
Any final report should be reviewed in draft form and any recommendations followed up. If external lawyers are instructed, the final report should be prepared by them and structured so as to maximise the likelihood of preserving privilege. For example, if possible and appropriate, interweave facts and legal advice so that they flow one from the other. The report should be marked ‘privileged and confidential’, although this will not itself guarantee privilege status.
A combined lawyers and accountants ‘fact-finding’ report may not be privileged. If so, the investigation co-ordinator should consider obtaining a separate accountants’ report or separating the legal advice from the fact-finding element of the report.
Only authorised, numbered copies of the report should be made. A record should be kept of who they are loaned to, and they should be capable of being recalled at any time.
7) Contact with the regulators
Internal investigations may be done in conjunction with a regulator if they are already looking at the business. They may ask to engage external investigators to ensure that the final report is independent. If the communication channel to the regulator is already open, make sure this is controlled through a single, senior point of contact. Allowing any member of the team, or even the business at large, to speak freely to the regulator would be a source of risk to the business.
If the regulators are not yet involved then a careful consideration of external notification requirements needs to be considered at the beginning of the investigations procedure. It may even be necessary to notify the police. Where such consideration results in a decision not to notify, it should be kept in mind that questions may be raised at a later date in relation to the timing or absence of a notification. Even if the investigation has been handled internally, specialist external legal advice would be recommended at this point.
Conclusion
It is always worth considering the investigation of any allegation or discovery of malpractice. It is no longer acceptable to sweep such matters under the carpet. Taking stock of the problem early on and deciding how the investigation should proceed is essential. Failure to manage the situation properly could have a devastating effect. Simply dabbling in an investigation could ultimately lead to the company losing any benefit that might be available. If in doubt, speak to a specialist adviser at the earliest opportunity. The results of a properly managed investigation can be the key to improving a company’s management and compliance practices, or defending it against civil or criminal litigation.