Overview
One of the most difficult questions faced by any management team is whether, absent a legal, regulatory or statutory duty to do so, its company should commence an internal investigation. The answer is simpler when a law enforcement agency is knocking at the company’s door, when the company receives a request for information to which it is compelled to respond or when it is the subject of a whistleblower or adverse press report. However, it is perhaps far less simple when an investigation is being voluntarily contemplated to assess the general health of the company. What happens if an issue is identified that might otherwise have remained undetected, that leads to significant costs, demands on management time, adverse press and, perhaps worse still, regulatory sanction or criminal prosecution? Might it be better to let sleeping dogs lie?
The question as to whether to undertake a voluntary investigation is one that, for many years, has caused management teams to scratch their collective heads. Given the issues that have affected many companies as a result of the worldwide COVID-19 pandemic, the question is increasingly being raised. As a result of the effects of COVID-19, some companies were rushed into decisions that they might otherwise have spent more time considering, compliance processes were shortened or even overlooked, and employees were afforded more opportunity to take autonomous decisions, often within the less supervised confines of a remote environment. Is 2021 the time to revisit some of the decisions that were made over the past year and to lift up the floorboards?
In this article, we suggest some of the advantages and disadvantages of undertaking a proactive, voluntary internal investigation. We also consider some of the ways in which a company could mitigate those potential disadvantages.
We note that, in some cases, an investigation may be required by law, regulation or statute. For example, in the UK, a regulated firm in the financial services sector is required to ensure that there are systems and controls in place to control its affairs effectively which may include a requirement to undertake regular audits of its business and in the US, government contractors and other regulated sectors (e.g., aviation, health care) are required to initiate an internal investigation upon receipt of some level of credible evidence. However, whilst many of the same considerations discussed herein apply to these circumstances, these types of investigations are outside the scope of this article.
Benefits of Conducting an Internal Investigation
In a perfect situation, an internal investigation reveals no areas of concern and allows the company’s management team to sleep more soundly in this knowledge. They form the foundation of a short report that evidences the scope of the work carried out and that no issues were identified: the perfect scorecard to show to prospective investors, shareholders, customers, counterparties and regulators.
Even absent the perfect-world scenario, however, a properly scoped and managed internal investigation can realise many benefits for the company. In particular:
- A company that proactively assesses its business is more appealing to potential investors, shareholders, financiers, counterparties, regulators and employees. Many companies now require companies with which they do business (be that by way of takeover, merger or joint venture, or in a financial or buyer/seller relationship) to confirm that the company is compliant with all relevant laws and regulations and has a strong compliance culture including having adopted a periodic programme of internal reviews, audits or investigations. No company wants to do business with, and no individuals want to be employed by, a company that could one day be found to employ illegal or unethical business practices.
- An internal investigation can allow a company to get ahead of any problems, and to accurately and in its own time assess the wrongdoing. With the increase in the number of whistleblower reports and access to social media in which individuals can share their concerns, problems within companies rarely remain buried forever. Internal investigations assist companies to get ahead of an issue, to gather information about the facts giving rise to the issue, to develop a potential defense and to remediate the issue as quickly as possible, without the stress and time pressure of a regulator or overzealous journalist breathing down their necks. As further set out below, getting on top of the issue and proactively reporting it can also greatly assist the company in any future criminal enforcement or civil action.
- The problem can be nipped in the bud before it infects the organisation more broadly. Not only is the scale of the problem likely to be a significant determining factor in deciding whether the wrongdoing needs to be reported (be that to stakeholders or to law enforcement agencies), a significant aggravating factor in almost every civil or criminal action is where the wrongdoing is pervasive across the business. A law enforcement agency might be persuaded to overlook one bad apple but will likely need more persuasion where the whole barrel is bad. Moreover, proactive remedial action - including by providing extra training to staff and updating policies and procedures - may support a reduction in civil and criminal penalties levied against the company by the government or the judiciary.
- A company that self-reports to law enforcement agencies and regulators is likely to receive credit for doing so. As a general point, by undertaking a proactive investigation, the company demonstrates that it takes its compliance responsibilities seriously and wishes to conduct itself as a good corporate citizen. This is likely to be music to the ears of most regulators and prosecutors, and at least starts any discussion on the right footing. At best, it might also support a declination or deferral by the relevant law enforcement agency. In many jurisdictions, including the UK and US, a company that self-reports to a law enforcement agency information that was previously unknown to the agency will receive credit, be that by way of less stringent sanction or a reduction in the financial penalty. By way of example, in the UK, self-reporting is one of the factors that plays heavy in the consideration as to whether the company should benefit in entering into a Deferred Prosecution Agreement (or face criminal prosecution). The same is true in the US, where recently issued Department of Justice Guidance instructs that proactive, voluntary reporting of corporate misconduct will, when accompanied by ongoing cooperation and remediation, give rise to a presumption that the company will receive a declination from prosecution.
- The results of the investigation can also support a reduction in civil liability. Related to the above, because an investigation can allow a company to identify wrongdoing earlier and to prevent the rot from continuing over time or spreading to other parts of the business, any civil penalties may be reduced. For example, an accounting fraud in one isolated part of a listed company’s business will likely expose the company to less liability to shareholders who suffer loss as a result than if the fraud was endemic across the whole company. Moreover, investigational findings could enable the company to remediate proactively the harm it has caused to its customers and other constituents, and thereby potentially stave off future litigation and further harm to customer relationships.
- Legal professional privilege and confidentiality. In some jurisdictions, the product of internal investigations may not be protected by legal professional privilege or confidentiality. This means that the work product generated by the internal investigation (for example, notes of interviews, any report on the findings, etc.) may be disclosable to law enforcement agencies in any future enforcement action or to future civil litigants. The circumstances in which privilege may not apply includes (depending on the relevant jurisdiction) where the investigation was undertaken by non-lawyers, where litigation was not in prospect at the time of the investigation, where the dominant purpose of the investigation was something other than litigation (e., employee disciplinary reasons), or when the company takes a public position that is expressly based on the investigation’s findings/conclusions.
- Conflicts of interest. Conducting an internal investigation – particularly with no or limited involvement from external lawyers or investigators – risks a situation where those who are undertaking the investigation are also involved in the alleged wrongdoing. For a company to feel secure in the process followed in any investigation and the conclusions, the investigation should be undertaken by objective and impartial investigators.
- “Trampling the crime scene.” In some jurisdictions, undertaking an internal investigation – especially one which involves taking first accounts from potential future witnesses or altering the forensic soundness of documents - may risk future allegations of “trampling the crime scene” if wrongdoing is subsequently identified and reported. In some cases, the company or individuals undertaking the investigation may face an allegation of witness tampering, or obstruction or perversion of justice.
- Cost and diversion of resources. Particularly in difficult circumstances such as during the COVID-19 pandemic when resources are stretched and often directed at keeping the company’s doors open, an investigation which demands financial investment as well as management time can be the last thing that anybody wants. Poorly scoped and managed investigations can incur significant costs and demand the attention of management and staff.
- The investigation actually identifies a problem. The real risk of an internal investigation is that it identifies some area of wrongdoing (and worse still, some significant wrongdoing), be that what was originally being investigated or some additional issue. Depending on the issue identified, this can lead to the next most difficult question faced by a management team: namely, what to do about it. Again, depending on the jurisdiction and the sector in which the company operates, the decision as to whether to report may be easy. For example, in the UK, regulated firms are required to report to the UK Financial Conduct Authority “anything relating to the firm of which that regulator would reasonably expect notice.” As discussed supra, in the US, government contractors and other regulated companies face similar requirements. However, absent a legal or regulatory duty to report, a company that identifies wrongdoing has a range of other issues to consider: strengthening compliance programmes, disciplining staff, reporting the issue to shareholders, investors, counterparties, etc., and/or, at least for publicly traded companies, additional disclosures of and corrections to public securities filings. The issue could also result in a breach of contract, financial covenant, etc.
- Risk of follow-on enforcement action or litigation. Related to the above, assuming that the issue has to be reported to a regulator or other law enforcement agency, it could give rise to an enforcement action against the company or associated individuals, with the inherent costs, publicity and risks of prosecution or sanction that are associated with this.
- Thinking carefully about the individuals who will carry out the investigation. Individuals with little or no investigatory experience risk creating documents that will prove to be damaging in the future if not correctly covered by applicable legal privileges, and could also expose the company to future claims of obstructing or perverting the course of justice. In addition, individuals who are not fair and objective – and conflict free – risk tainting the integrity of the investigation. Companies should therefore vet carefully the members of any internal investigation team, for both competence and the absence of actual or apparent bias.
- Protecting confidentiality and legal professional privilege. It is not only important to decide the individuals who will carry out the investigation, but also the individuals to whom the investigators will report. In many jurisdictions, a loss of confidentiality (by, for example, reporting the results of the investigation to a third party) will result in a loss of legal professional privilege too. In addition, the wider the audience, the more likely the company is to face a leak outside the company.
- Properly scoping the investigation. Poorly scoped investigations are likely to stray into extraneous issues, blow the budget out of the water and never end. It is crucial that any investigation is properly scoped to include the issues being investigated, the individuals to be interviewed, the source of documents to be reviewed, and the remit of the investigation team.
- Documenting the process and fruits of fact-gathering. This includes detailed documentation of how relevant documents were collected (g., from where, the collection method used, etc.) and the substance of any interviews. This audit trail is likely to be very important in explaining the scope of the investigation in the future, and in defending any allegations that the investigation “trampled the crime scene.”
- Documentation of the investigation’s ultimate findings and conclusions. Considerations are likely to include should there be a written report or should it be delivered orally only? To whom should the report be delivered? Should any report cover facts only or also make recommendations? It is important that these factors be considered at the start of the investigation, so as not to inadvertently create disclosure, confidentiality and privilege issues going forward.
