Volkswagen, email hacking, foreign exchange trading—organizations are focused on investigating issues or concerns that have major headlines. In this age of transparency, internal investigations have proliferated across a wide range of industry sectors—financial services, automotive, pharmaceutical, retail and many others.
We have seen multiple enforcement agencies competing to investigate the same matter, appearances before governmental committees, and trial by press. The stakes have never been higher and the importance of conducting an internal investigation in the right way has never been greater.
Yet there is a lack of practical guidance on how to run an investigation in-house.
What should the early phases of a good investigation look like? How to best support boards, general counsels, and corporate executives navigate the myriad, complex issues that arise? These questions often are unanswered.
Facing a Live Concern
The beginning can be the most stressful and perilous phase in an investigation, especially one you are faced with a 'live' concern involving allegations of misconduct that is serious, ongoing and unchecked.
In these situations, your first priority is to consider whether any employees present a significant and current risk to the business, its customers, or perhaps even the markets (think market abuse). If that's the case, you may need to consider initiating a process to suspend them from employment immediately. This is a protective rather than a disciplinary measure, but will need to addressed in consultation with H.R. Typically, unless the evidence is overwhelming, an interview with the employee in question will be necessary first to give them the opportunity to respond to the allegations.
Investigators should also consider whether any employees present a risk to the investigation itself—such as destroying evidence, influencing witnesses or otherwise frustrating the investigation. Again, a suspension may be necessary to mitigate this risk, but alternative options, such as moving the individual to another role, can be discussed with H.R.
What are the immediate priorities for an investigation when there is a live concern?
There can be an overwhelming temptation when an investigation kicks off to dive immediately into the evidence. However, there are a number of serious regulatory, reputational and other risks that you need to consider first. Some key procedural steps early in the process will keep these at bay.
Consider Regulatory Obligations
Perhaps the first priority is to assess whether there is an obligation to notify a regulator or other authority of the matter. Where such an obligation exists, a failure to do so will be grounds for enforcement action in and of itself. More generally, regulators and investigating authorities do not take kindly to finding out about a serious event via a leak or a whistleblower, and firms may want to consider the merits of a proactive approach even when no strict obligation to notify arises.
Control Confidential Information
The next priority is to set about controlling the flow of confidential information. There are a number of reasons for this. First, investigations are likely to generate highly sensitive material relating to concerned individuals. In most jurisdictions there is an overriding responsibility to ensure that such material is protected from access by those who have no legitimate interest in it.
Additionally, external leaks of information relating to the investigation can also be extremely harmful. They are likely to generate unwelcome speculation in the press and deep concern amongst key external stakeholders such as shareholders and regulators.
As a result, some key initial procedures are critical to protect and control the flow of information about the investigation and its findings.
The first is to identify internal stakeholders who have a legitimate interest in the investigation and place them on a confidentiality list. This list will define who has access to information about the investigation and who does not. The identity of these stakeholders will vary from case to case, but they often include general counsel, senior management from the affected business areas, compliance officers and H.R. staff.
Once you have defined who should have access to sensitive information, then the next step is to ensure that they understand and commit to their obligations to keep information confidential. This is best achieved by requiring them to sign a memo setting out the confidentiality requirements. You should be careful, however, not to seek to fetter any obligation or right that employees may have to report the matter to a regulator or other authority.
Ensure No Prejudice to the Investigation
It can also be a good idea to provide internal stakeholders with guidance on "communicating in the right way." Many an investigation has been prejudiced by idle gossip recorded on a firm's electronic communications—for instance, when a staff member speculates on email about the relative guilt or innocence of one of their colleagues.
Indeed, in an age of constant social media and the blurring of lines between an employee's personal and company mobile devices, there is a constant and ever-increasing risk that staff will communicate their opinions and thoughts on events well before any conclusions have been reached as to the cause of an event or, for that matter, published.
Plainly this is unhelpful but it can be managed effectively by distributing appropriate guidance at the outset and throughout an investigation, requesting that employees do not speculate on the matter in hand. Where the event under investigation is likely to be the subject of public scrutiny, the guidance should emphasise the need to refer any press enquiries to a designated contact, such as the firm's press office.
Equally importantly, you should consider whether a document hold notice is necessary to prevent the destruction of evidence that could prejudice your investigation. A failure to take appropriate steps to protect evidence can be perceived extremely negatively in the event of accidental or deliberate destruction by someone at the firm.
Lastly, you should consider whether any notifications are necessary under directors and officers (D&O) liability insurance. Typically, D&O coverage will be available to for senior managers and sometimes for the rung below in the event a legal action (including regulatory investigation) is brought for alleged "wrongful acts" by a director or officer. However, failure to make timely notification with the correct information can nullify cover.
Once you've taken these early steps, you're ready to start planning your investigation.
For further information on this and other topics on internal investigations, download Clutch Group's Guide to Conducting Internal Investigations available online.