This list outlines steps to take when confronted with an external regulatory investigation or the need for an internal self-directed investigation.

Before an Investigation/Inquiry

  • ☑ Prepare: Before any investigation arises, have a Crisis Management Plan in place. The plan should include a Response Plan and an Evidence Retention Plan as described below.

At the Outset of an Investigation/Inquiry

  • ☑ Assess: Gauge the nature and scope of the problem presented and carefully consider any possible broader liability issues or exposure. Considerations may include:

    • Whether the problem presents any multi-jurisdictional implications
    • The persons involved and their proximity to the problem
    • Whether an internal self-directed investigation is necessary.
  • ☑ Engage: Consider whether to immediately engage external counsel to provide advice and support throughout the process. In the case of an internal investigation, early retention of external counsel may assist in limiting independence and privilege issues that may arise during the investigation.
  • ☑ Restrict: Consider any practical or legal impediments that would prevent or limit internal discussion and disclosure of the investigation itself.

    • Begin on a strict "need to know" basis.
    • Consider who may already know and who needs to know, and consider confidentiality measures to prevent further dissemination
  • ☑ Unify: Centralize the investigation response leadership. Liaison with police or regulators, where possible, should be through a single point of contact.
  • ☑ Strategize: If they do not already exist as part of your Crisis Management Plan, develop a Response Plan and an Evidence Retention Plan. Consider tailoring these plans to the matter at issue.

    For the Response Plan, considerations may include:

    • Deadlines for collection and delivery of material in response to regulator requests
    • Conflicts of interest, independent legal advice and cost payment issues
    • Coordinated defences and joint defence agreements
    • Use and retention of experts.
    For the Evidence Retention Plan, the goal is a comprehensive and prompt process for gathering and retaining documents. Considerations may include:

    • What steps are necessary to suspend routine data retention practices?
    • Whether to restrict system access
    • Whether to obtain advice on data preservation, recovery and custody.
  • ☑ Implement: Put the plans into action, following the written procedures that you have set out. Consider documenting the steps taken to preserve records, including electronic data.
  • ☑ Communicate: Consider developing and implementing a media strategy.
  • ☑ Prevent: Consider any disciplinary issues arising from the investigation.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.