Internal investigations and regulatory inquiries are a major source of concern for corporate legal staff—and the COVID-19 pandemic isn’t helping matters any. That’s according to the Norton Rose Fulbright Litigation Trends Survey 2020, which found that, compared with other types of legal disputes, investigations and regulatory matters were the second-highest cause for concern. Additionally, almost half of respondents—45 percent—reported that they expect COVID-19 issues to drive an increase in their volume of disputes throughout 2021.
That’s why we’re taking a deep dive on internal investigations in this two-part series. Part one looked at what corporate internal investigations are, when they’re warranted, and why they’re both important and potentially risky. This article, part two, builds on that foundation to address exactly how organizations should approach investigations. We’ll outline the five critical stages of any workplace investigation and point out some best practices to guide you in your next investigation.
Contents:
An overview of internal investigations
5 steps and best practices for effective corporate internal investigations
1. Planning: Setting the scope of the investigation
2. Preserving evidence
3. Deciding who should conduct the investigation
4. Fact-finding: Reviewing evidence and interviewing witnesses
5. Reporting the investigation’s findings
Final Thoughts
An overview of corporate internal investigations
As we discussed in part one, an investigation is like an informal, internally managed litigation matter. It’s not bound by court rules or procedures—in fact, there’s no one way to handle every potential complaint—but, as with a court case, it starts with an allegation of misconduct, moves through a fact-finding stage, and culminates in a decision that may or may not include a “sentence” of consequences. Not every complaint leads to an investigation: sometimes a company may decide that a claim is so unsubstantiated, or its allegations so minor, that it does not warrant further inquiry. But the comparison to litigation matters is useful because a corporate internal investigation involves an ediscovery-like fact-finding exercise that includes both reviewing documents and interviewing witnesses.
Handling complaints effectively with comprehensive internal investigations can have numerous benefits, such as:
- preventing the reoccurrence of problem behaviors through personnel actions, additional training, or changes in policy;
- avoiding criminal or civil liability for the organization or its officers;
- helping the company prepare for a formal governmental investigation, a litigation matter, or an appropriate settlement; and
- maintaining the business’s reputation and protecting against bad publicity.
Investigations can also be expensive and risky. Not only can they take a considerable investment in dollars and hours, but they can be demoralizing for staff, leading to a disengaged or suspicious workforce. It can also be difficult to protect the attorney-client privilege during an investigation and to maintain compliance with data privacy laws and restrictions on cross-border data transfers. On the whole, though, those risks are lower than the potential harm that can result from not doing an investigation or from doing a hasty, slipshod investigation.
Let’s take a closer look at how a corporate internal investigation unfolds and what you should do at each stage.
5 steps and best practices for effective internal investigations
Once a company or its corporate legal department decides to begin an employee investigation, there are five key stages to completing the inquiry: defining the extent of the investigation, preserving necessary evidence, designating who will manage the investigation, assembling and reviewing evidence, and then reporting on the results and, perhaps, acting in response. We’ll break down those five stages in more detail along with best practices for each step along the way.
1. Planning: Setting the scope of the investigation
The scope of an investigation depends in large part on its context. It can often be determined by consideration of the same factors that the company weighed in deciding whether to conduct the investigation in the first place. How serious is the alleged misconduct? What’s its potential impact on the company? How likely is it to be a reoccurring situation? Carefully defining the scope helps with keeping an investigation on schedule and within budget. If an investigation is too broad, it can drag on for months or even years, costing the company entirely too much. On the other hand, a too narrowly scoped investigation can miss real issues, such as related violations or whether supervisors or high-level officers or board members were aware of the situation.
It’s not uncommon for an investigation to uncover multiple issues. In one recent case, Deutsche Bank AG paid over $130 million to settle two separate investigations: a DOJ case involving violations of the Foreign Corrupt Practices Act and an SEC inquiry into commodities fraud. Regulators found two separate schemes during their investigation: one “to conceal corrupt payments and bribes made to third-party intermediaries by falsely recording them,” and “a separate scheme to engage in fraudulent and manipulative commodities trading practices.” Looking at a concern too narrowly can cause a company to completely miss evidence of other misconduct.
Best practice: Once you’ve determined the scope of the investigation, set a realistic but not generous timeframe for your investigation. If you don’t have an expected end date, an investigation might linger on, continually turning over new evidentiary stones and looking for needles in haystacks. Keep it focused and prompt by knowing from the outset when you’ll wrap it up, and you’ll have a better chance of avoiding “scope creep.”
Scoping and planning out an investigation includes an assessment of available evidence, including financial records, employment records, internal communications, and so on. Be mindful of data privacy issues, especially those that might occur in different jurisdictions or across borders. It’s also worth remembering that scope is an ongoing question: while you need a rough idea of the extent of an investigation to complete the next two steps, those steps may also inform the intended scope, necessitating adjustments.
Best practice: Don’t assume you know what happened until you’ve investigated a matter. It can be easy to overlook evidence or downplay its significance if you’ve assumed—consciously or otherwise—that you know how the matter is going to end.
2. Preserving evidence
You cannot conduct a meaningful investigation without evidence. That’s why you must take immediate action to preserve potentially helpful information as soon as you identify it. This is likely to begin, as we noted above, during the planning stages, but don’t delay. Any information that is potentially relevant to the claim—that is, anything that will help you get to the bottom of the accusation—must be protected from alteration or destruction.
Best practice: Suspend your normal retention and information-disposal procedures and place a legal hold on any evidence that is relevant to your investigation, just as you would do in eDiscovery if you were notified of a pending or anticipated litigation matter.
While you’re preserving evidence, cast a wide net so you don’t miss anything. Include these items:
- emails, text messages, and other communications, both internal and external;
- files and documents, both electronic and hard copy, for any involved employees;
- meeting notes; and
- corporate records such as personnel files, timesheets, accounting records, and so on.
Using technology that can assist in the preservation of data is key here. Both automated document retention and destruction policies, as well as intention user deletion, can have a significant negative impact on your efforts to collect evidence. Legal Hold solutions are able to not only notify data custodians of their obligation to preserve evidence but also to preserve content that might otherwise be deleted.
Not only will you need this information for your corporate internal investigation, but government agencies and private litigants will also demand this information if the matter proceeds to a regulatory inquiry or a litigation matter. For example, the DOJ is investigating whether Elon Musk’s company SpaceX discriminated against non-U.S. citizens by refusing to hire an applicant. As soon as the DOJ’s Immigrant and Employee Rights division notified SpaceX of the investigation, it also “requested that SpaceX provide information and documents relating to its hiring process,” among other evidence.
3. Deciding who should conduct the investigation
There are two separate questions regarding who should be in charge of an investigation. First, should the company have its in-house counsel handle the inquiry or involve outside counsel? And if the company retains outside counsel, can it use its usual firm or should it look for an unassociated firm or one that specializes in the particular conduct alleged?
Companies often want to keep investigations in house to keep both costs and disruption to a minimum. For smaller and less-concerning investigations, this is likely fine. But for serious allegations or those that involve someone in a relatively high position within the company, it’s a better idea to hand the matter over to outside counsel that do not routinely represent the firm. Regular counsel are more likely to be—or at least to be seen as—sympathetic to a longstanding client or to have conflicts of interest.
In a recent news story about a hostile work environment lawsuit against the video game developer Riot Games, the company noted that “a special committee of its board of directors is conducting an investigation with the aid of an outside law firm in an effort to ensure impartiality and transparency.”
Best practice: Be mindful of conflicts of interest, both real and perceived. If in-house counsel or regular outside counsel are friends with a supervisor or high-ranking employee who is accused of wrongdoing, you should hire a different firm to manage the investigation. Even if counsel truly are impartial, it may not look that way to an outsider.
Attorney-client privilege is also more easily protected with outside counsel, simply because it is easier to establish that the company has retained counsel for legal advice and not for a business purpose. In that same vein, outside counsel, rather than the company, should hire any necessary experts, to make it clear that those experts are also aiding in legal preparation rather than in a business activity.
Best practice: Outside counsel are also likely to be more experienced with various types of alleged wrongdoing, especially if you select counsel who specialize in the sort of complaint you’ve received.
4. Fact-finding: Reviewing evidence and interviewing witnesses
Once you have your investigation planned out, you’ve preserved relevant evidence, and you’ve decided who will be in charge of the matter, it’s time to get into the real work of investigating: assembling and interpreting the facts that will inform you about what really happened. This consists of two main tasks: reviewing documentary evidence and interviewing witnesses.
First, you’ll want to collect all of the relevant information you’ve identified. Note that as you review that evidence, it will likely point you toward additional information that may be useful. You don’t want to go down every rabbit hole, nor should you ignore related information.
To make it easier to manage the volume of documentary evidence you’re likely to encounter, leverage your existing eDiscovery tools. Document review can be the most time-consuming and expensive part of most investigations, but automated eDiscovery technology can dramatically lighten the load by weeding out clearly irrelevant documents and helping more substantive information float to the top of the pile.
eDiscovery solutions that employ automatic classification of content can substantially light the review process by sifting junk out of the potentially relevant pile.
Best practice: Don’t blow your budget on document review. As in eDiscovery, reviewing documents can be the most expensive part of an investigation. Use your eDiscovery technology to quickly eliminate irrelevant documents and focus on those that are most helpful.
Once you have a pretty clear picture from reviewing documents, you’ll be ready to move on to witness interviews. Have an attorney interview witnesses to ensure that you preserve attorney-client privilege, but be sure your employees know that the attorney is there on behalf of the company, not the witness. To that end, counsel must provide what are known as “Upjohn warnings” to explain their duty and the attorney-client privilege they have with the company.
Best practice: Review any related documents before you interview a witness—that way you’ll be prepared to confront them, if necessary, with evidence that contradicts their version of events, and you won’t have to call them back for a second interview.
5. Reporting the investigation’s findings
Your investigation isn’t complete just because the fact-finding portion is done: you still need to decide how you will report your findings and what the company is going to do about any founded allegations.
Your report should include:
- a statement about the initial allegation;
- a discussion of how the investigation proceeded;
- details about what the investigation found;
- a review of the relevant laws, regulations, or company policy and how that authority applies to the discovered facts;
- a recommendation regarding the company’s response; and
- a summary of required next steps in terms of disclosures and regulatory inquiry or litigation management.
That said, you may or may not choose to issue a written report. If you do, note that you may be required to share it with regulatory authorities or even potential litigants. Instead of a written report, you may elect to have counsel make an oral report to the board.
You must also decide, at the conclusion of an investigation, how the company will use the new information it has gained. Your responses could include disciplinary action for the involved employee(s), additional training and education to avoid any reoccurrence of the misconduct, or a change in your corporate policies and procedures.
While you may be tempted not to take any action even after a founded complaint, you should be careful to evaluate the message that it would send to do nothing. This will, of course, depend on how serious the wrongdoing was, how long it went on, and how strong the evidence of that misconduct is. You should also evaluate what collateral consequences are likely, what deterrent effect, if any, your action will have, and how your response—or lack thereof—will influence any later litigation or regulatory inquiry.
Best practice: Make sure you’re hearing about allegations and complaints before they blow up into lawsuits and federal investigations. Implement an anonymous employee hotline and be sure you’re not penalizing people who are vocal about problems or issues they see.
Final thoughts
Effective internal investigations are the key to minimizing risk
As long as there is employee misconduct—which is to say, forever—companies will need to be prepared to investigate allegations of wrongdoing if they hope to minimize the damage to their reputation, their bottom line, and ultimately their very existence. While corporate internal investigations are complicated and infinitely variable, there are common stages that must be completed in an effective investigation and best practices that will steer you on the right path regardless of the specific details of a claim. Using eDiscovery tools and techniques is a straightforward way to control the costs of document review during internal investigations—and ZyLAB is here to help.
