Every company, large or small, will eventually face a problem
that requires an internal investigation. Boiled to its essence, an
internal investigation is really nothing more than a way to obtain
information to avoid or solve problems. But performing an effective
investigation requires experience and skill. Not surprisingly,
there is ample literature on how to conduct an effective
investigation and best practices in doing so. Far less common, but
equally important, are the questions a company's
decision-makers — whether a CEO, compliance officer, or
in-house counsel — should ask before an investigation begins.
Those questions are critical, however, because their answers will
affect the course of the investigation — and ultimately its
results.
Here are six that are part of an effective inquiry:
1. What risks does the company face?
This is the simplest but most important question. If a problem
poses only a minor risk, it may not merit a full-scale
investigation, a significant time investment, or use of outside
counsel. But risks can be hidden. For example, a run-of-the-mill
employee complaint may on the surface appear to be a routine human
resources problem. On closer examination, however, the allegations,
if substantiated, might reveal a compliance breakdown or a more
systemic issue, leading to potential company liability. Or the
complaining party may be a potential whistleblower who could prompt
a government investigation.
Depending on the company, one of two obstacles to proper risk
analysis occurs. Larger companies will likely have compliance
officers, in-house counsel or outside attorneys who can adequately
assess the risk. The obstacle is ensuring that the necessary
information reaches those individuals. For that to happen,
front-line employees must be trained to identify problems, and
there must be a known pathway to communicate and, where necessary,
elevate problems.
For smaller companies, by virtue of their leaner operations,
getting information to the top is usually less of a concern. The
problem instead is ensuring that decision-makers, who often are
generalists and wearing many hats, can recognize and weigh the
issues and risk exposure.
An initial risk assessment, continually reconsidered as facts
become known, should account for as many potentialities as
possible. Properly used, it will drive every other legal and
business consideration in advance of a possible internal
investigation.
2. What is the purpose and scope of the internal investigation?
Once company decision-makers decide to investigate, they must be
clear on the purpose and scope. The purpose may be narrow, e.g., to
determine whether a specific contractor offered a bribe, or it may
be broad, e.g., to review the company-wide anti-corruption
policy.
Scope is related but distinct. It is the body of information to be
gathered, and the steps authorized to gather it. The scope of the
investigation will greatly influence its costs, particularly if
electronic data is involved. A sharply defined scope provides
guidance to the investigators, avoids mission creep, and controls
costs.
Considering short-term costs alone, however, is a mistake. A broad
purpose will almost always require a broad scope for the
investigation to be effective and to produce the information
needed. Credibility is equally important: whether it's the
board of directors, a disgruntled employee, or a federal
prosecutor, they will know a superficial investigation when they
see it — and the long-term costs of a botched investigation
are likely to far exceed the initial savings.
3. Who will conduct the internal investigation?
The advantages of using in-house personnel to conduct their own
investigation are obvious: they are more cost-effective, likely to
be less threatening and disruptive to employees, and generally know
the players, policies and operations of the organization better
than outside counsel.
But risks abound: potentially compromised objectivity, trickier
privilege issues, awkwardness investigating personnel with whom
there is a long-standing relationship, likely lesser credibility
with government officials, and usually less specialized skill in
conducting an investigation. Outside counsel of course pose a
greater initial expense but offer some assurance with respect to
privilege, independence and credibility.
In general, the more serious the risks and the broader the scope,
the more likely outside counsel should be involved. Long-time
outside counsel who have a significant relationship with the
company also may present the same credibility issues as in-house
counsel. Again, as the risks increase, companies should consider
whether separate, independent outside counsel for purposes of the
investigation are advisable
4. What disclosures are required?
The same event that triggered an internal investigation may trigger disclosure obligations and often they are time sensitive. Some are industry- or role-specific such as Federal Acquisition Regulation disclosure rules for prime contractors or shareholder-reporting obligations and Sarbanes-Oxley reporting requirements for public companies. Others may be contract-based, such as insurer contracts with health care providers or hospital credentialing policies with medical practices. Companies may also have insurance to cover internal investigations and have a notice obligation. Finally, notice of potential overpayments from the government can trigger the 60-day window for repayment under the False Claim Act.
5. How will we protect the company and communicate on its behalf?
Protecting the company is a foremost concern, and is intertwined
with how information is communicated. The most obvious example
involves privilege issues. The steps for preserving privilege in an
internal investigation include ensuring that Upjohn warnings are
given, counsel conducts or directs the internal investigation,
third-party contractors (investigators, e-discovery consultants,
etc.) are properly managed by counsel, and privileged
communications — particularly email — are clearly
established.
But protection and communication go beyond mere privilege
concerns. In-house counsel must consider how media issues will be
handled and who will communicate on behalf of the company. Internal
communications to employees and stakeholders also play an important
protective role. Clear information and open lines of communication,
while balancing confidentiality issues, can minimize rumors and
external reports. By contrast, poor communication can stoke
discontent and make things worse. Not every problem and internal
investigation will pose all of these issues, but communication and
protecting the company should always be a consideration.
6. What coverage applies?
The issues giving rise to an internal investigation can often
involve bet-the-company stakes. In those cases, urgent matters can
occupy all of the focus. But early on, companies should also
consider financial issues and whether any insurance coverage
applies to internal investigations. Increasingly, such policies are
available — especially with mushrooming FCA investigations in
health care and other regulated industries. Coverage will of course
depend on policy specifics and often turns on the nature of the
investigation (criminal or civil) and other factual circumstances.
Nonetheless, company decision-makers should consider their
liability coverage, its scope, and whether it may cover or defray
costs associated with an investigation.
Internal investigations by their nature are stressful and fraught
with peril. Asking the right questions at the beginning can put
companies on the path to the best outcome possible.
Republished with permission. This article first appeared in Law360 on December 12, 2014 .
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.