One of the most difficult questions a management team sometimes faces is whether – absent a legal, regulatory or statutory duty to do so – a company should conduct an internal investigation. The answer is relatively easy in most countries if a law enforcement agency is knocking on the proverbial door, the company receives a mandatory demand for information or a press report about possible misfeasance is published. A more difficult question can be posed, however, if the compliance issue that has arisen seems unlikely to be detected. In the latter situation, at least some in company management may believe it best to let the apparently sleeping dog lie.
Whether to undertake a voluntary internal investigation is one that, for many years, has caused company management teams to scratch their collective head. This article describes some of the advantages and disadvantages of undertaking a voluntarily initiated internal investigation. We also consider ways in which a company can mitigate the costs and other risks of any internal investigation the company’s management team is considering.
In some cases, of course, a company-led investigation may be required by regulation or statute. In the UK, for example, a regulated financial services firm must implement systems and controls appropriate to its business, which may include a requirement to undertake regular audits of the firm’s business operations. In the US, to cite a further example, US government contractors and companies operating in certain other sectors (eg, aviation, health care) must undertake an investigation upon their receipt of credible evidence of certain types of wrongdoing.
Government mandated investigations as well as the periodic audits authorities repeatedly have encouraged that are not undertaken in response to discrete reports or some other indication of past misconduct are beyond the scope of this article.
Benefits of conducting an internal investigation
In a perfect situation, an internal investigation may reveal no area of concern, allowing the company’s management team to sleep soundly in that knowledge. When that is so, the investigation often can be encapsulated in a short report summarising the scope of the investigation that was conducted and the conclusion or conclusions that were reached – a report that can be shared in certain circumstances with prospective investors, shareholders, customers and other current and prospective business partners. A report of that sort also may be of value to a company as it seeks certain types of regulatory approval. But even when areas of concern are identified, a properly scoped and managed voluntarily initiated internal investigation can benefit the company in a variety of ways. In particular:
- A company that responds promptly and effectively to reports or other indications of possible misconduct is demonstrating its commitment to compliance, thereby increasing its position in dealing with potential investors, current and prospective shareholders, current and prospective business partners, regulators/prosecutors and, not insignificantly, its own employees. Many companies now require those with which they do or are considering doing business to establish and implement compliance enhancing policies and procedures. Conducting a voluntary internal investigation in response to a report or other evidence of past misconduct can and often has provided clear confirmation that the particular company does not have its compliance head in the sand.
- With the ever-increasing number of whistleblower reports that companies, regulators and others are receiving – including as a result of widening access to social media – companies cannot safely assume that their misconduct will remain buried forever. Internal investigations can assist companies identify and remediate such problems before they reach crisis proportions. Undertaking a voluntary internal investigation also can place the company in the driver’s seat in making a series of potentially critical pre-investigation decisions, including determining the investigation’s structure, scope, timing and cost.
- A voluntary internal investigation also can enable a company to reduce the likelihood of future, even more damaging, misconduct. The scale of the wrongdoing that has occurred and the company’s response can affect – for better or worse – the view that is taken, including by regulators/prosecutors, in assessing the company’s culpability for the misconduct that occurred and the risk of future company misconduct. Law enforcement agencies often can be convinced to overlook or respond with a mild sanction to an isolated bad apple while responding more severely if presented with evidence suggesting that the whole barrel is bad.
- In many jurisdictions, including the UK, the expeditious completion of a voluntary company led investigation, along with appropriate remediation and self-reporting, have played a central role in determining whether a company should be invited to participate in negotiations leading to a court approved Deferred Prosecution Agreement or faced criminal prosecution. The same has been and continues to be true under US Department of Justice guidance, which lists a series of factors – including undertaking an internal investigation, appropriate remediation and voluntary reporting of misconduct – as entitling a company to a presumption in favour of either no prosecution or a deferred prosecution.
- Related to the above, because a voluntary internal investigation can expedite the discovery of wrongdoing, thus preventing the wrongdoing from continuing or spreading to other parts of the business, any civil penalties may be reduced. For example, an accounting fraud in one part of a listed company’s business likely will expose the company to less liability to shareholders who suffer loss as a result than if the fraud is found to have been long standing or endemic. Moreover, the findings of a voluntary internal investigation can enable a company to remediate proactively the harm it has caused to its customers and other stakeholders, thereby potentially staving off future litigation and irreparable harm to customer relationships.
- Finally, but not all at inconsequentially, undertaking a voluntary internal investigation and otherwise responding appropriately to misconduct, can demonstrate a company’s commitment to compliance in a way that speech alone, even from the highest levels of company management, cannot. That in and of itself tends to reduce in incidence of future misconduct, thus protecting or even enhancing the company’s future business prospects.
Risks of conducting a voluntary internal investigation
With so many advantages to undertaking a voluntary internal investigation, why do companies sometimes agonise over the decision to do so? There are a number of reasons:
- Legal professional privilege and confidentiality. In some jurisdictions, the product or result of an internal investigation may not be protected or be protected fully by legal professional privilege or confidentiality. That is particularly so if the investigation is not structured in a manner that maximises the company’s professional privilege interests, including vis-à-vis both regulators/prosecutors and potential civil litigants. The circumstances in which privilege may not apply include (depending on the governing jurisdiction) investigations undertaken by non-lawyers, when litigation was not in prospect at the time of the investigation, when the dominant purpose of the investigation was something other than litigation (ie, employee disciplinary reasons) or when the company has taken a public position expressly based on the investigation’s findings/conclusions.
- ‘Trampling the crime scene’. In some jurisdictions, undertaking a voluntary internal investigation – especially one taking first accounts from potential future witnesses or not adequately protecting from destruction or alteration pertinent hard copy or electronic documents – may risk future allegations of ‘trampling the crime scene’ if wrongdoing is subsequently identified and reported. In some cases, the company or individuals undertaking the investigation may face an allegation of witness tampering, obstruction or perversion of justice.
- Cost and diversion of resources. Particularly in difficult circumstances such as during the Covid-19 pandemic, which has stretched the resources of so many companies, conducting on a voluntary basis a potentially costly internal investigation – an investigation that can consume precious management time – may be one of the last things the company’s management team wants.
- The investigation actually identifies a problem. A voluntary internal investigation may confirm instances of wrongdoing, including wrongdoing going beyond that originally suspected. That tends to lead to a related question: namely, what to do about the misconduct that has been confirmed. Again, depending on the jurisdiction and the sector in which the company operates, the decision whether to report may be easy. Regulated firms in the UK, for example, are required to report to the UK Financial Conduct Authority ‘anything relating to the firm of which that regulator would reasonably expect notice’.
- Other post-investigation obligations. Even if the company has no mandatory duty to report, a company that identifies wrongdoing must consider a range or other issues: including strengthening its compliance programme and disciplining pertinent staff. The company also must consider whether the misconduct has resulted in potential breaches of financial covenants or other contractual obligations to which it is a party. In addition, past misconduct from which the company has profited may raise money laundering concerns the company will need to address.
- Risk of follow-on enforcement action or litigation. Related to the above, assuming the misconduct that has been identified must be reported to a regulator or other law enforcement agency, the results of the internal investigation that was conducted sometimes can prompt an enforcement action against the company and/or the individuals who have caused or contributed to the misconduct. It also will tend to force the company’s hand in dealing with any contract-based reporting or other obligations the company has assumed vis-à-vis one or more of its business partners, which may or may not result in the filing of civil lawsuits against the company.
Mitigating the risks
The decision whether to initiate a voluntary internal investigation is not always an easy one, depending as it does on a variety of circumstances, including the governing jurisdiction or jurisdictions, the sector in which the company operates and the expectations of company stakeholders. Increasingly, however, companies are finding that turning a blind eye to misconduct can and often does beget even more problems, including future misconduct threatening in the worst case a level of vulnerability that imperils the company’s viability.
Many of the risks set out above can be mitigated by properly scoping, staffing and executing a voluntary internal investigation, including by:
- Structuring the investigation. Relying upon those with little or no investigatory experience risks the creation of documents that will prove damaging in the future. That is a particular danger if the investigation is structured in a way that does not protect the company’s right to assert legal privilege with respect to the investigation work products (eg, interview summaries) as well as the conclusions that were reached. Failing to structure an internal investigation in an appropriate manner also can expose the company to future claims of obstructing or perverting the course of justice. In addition, those who are not fair and objective – and conflict free – risk tainting the integrity of the investigation. Companies therefore should vet carefully the members of any internal investigation team being assembled for competence, absence of actual or apparent bias and legal privilege status.
- Scoping the investigation. Poorly scoped investigations are likely to stray into extraneous issues, result in the company incurring excessive costs, take an inordinate amount of time, interfere with the achievement of other company priorities and be an unnecessary drain on management time. Any internal investigation that is conducted should be scoped carefully, focusing inter alia on the issues to be investigated, individuals to be interviewed, documents to be reviewed and overall remit of the investigation team.
- Documenting the fact-gathering process. How the particular investigation was conducted should be documented in an appropriate manner – a manner that, if possible, is agreed in advance. That includes documenting how relevant documents were collected and the substance of any interviews that were conducted. The information collected and documents that are collected via an agreed documentation plan, even if the plan is subject to mid-investigation refinement, is likely to be very important in enabling the company and/or its representatives to explain why the investigation was conducted as it was and defending against any allegations that the investigation ‘trampled the crime scene’.
- Documenting the investigation findings. Myriad issues will need to be considered as the investigation proceeds. Those issues typically include whether a written investigation report should be prepared at all; the level of detail to be included in the report, if a written rather than an oral report is delivered; to whom the report, whether written or oral, is given; whether the report should include remediation recommendations; and whether any interim remediation steps should be taken. The foregoing as well as a host of other issues should be considered carefully before the investigation actually commences, in part to avoid the inadvertent creation of future disclosure, confidentiality and/or privilege problems.
Conclusion
The decision as to whether to undertake a voluntary internal investigation doubtless will continue to vex corporate boards. Corporate boards called upon to make that decision are entitled to be provided – or should undertake themselves – a comprehensive, nuanced assessment or the investigation pros and cons, an assessment that takes account of the company’s long term interests and objectives. If undertaken, the investigation should be scoped and structured with care from the outset, with consideration being given inter alia to preserving the company’s legal privilege rights as well as the possible need to require both interim and post-investigation remediation of any wrongdoing that is determined to have occurred.