Corporate investigations: key issues for boards and in-house lawyers

With the steady increase of global regulation and enforcement across all industries in today’s commercial world, the conduct by companies of independent and credible internal investigations is swiftly being recognised as a standalone area of expertise.

Internal investigations may be necessary in a number of circumstances, such as the discovery of possible wrongdoing within the company; potential or pending civil litigation; or the receipt of a notice from an investigative or prosecutorial authority or regulator, for example, the Financial Conduct Authority, HM Revenue & Customs or the Competition and Markets Authority. Investigations need to be efficient, proportionate, systematic and professional in order to produce reliable and credible results while staying within the company’s legal budget (see box “Preliminary questions”).

This article outlines the key considerations that a company needs to bear in mind once it has decided to conduct an investigation, including:

EFFECTIVE PROJECT MANAGEMENT

The conduct of investigations can be complex, time-consuming and disruptive to business operations and personnel. It is therefore important for investigations to be managed proportionately, effectively and systematically. A well-prepared general counsel or head of investigations will:

• Create an investigation plan.
• Fully consider the scope of the investigation.
• Have an investigation protocol in place.
• Use the right team, considering investigator independence and the rules on privilege.

The efficient management of the investigation process can improve the quality of investigation results, better equip all involved to answer to regulators, and shorten the time taken and the disruption to the business, therefore reducing both financial and reputational costs.

Investigation plan

Planning and control are essential to effective investigations, and a well-written investigation plan creates a roadmap for the investigators to follow. This is particularly important when dealing with complex, multi-jurisdictional investigations. As investigations, by their very nature, are likely to result in some surprises, it is difficult to write a plan that encompasses all possible permutations and combinations. However, there are a number of common features of an investigation plan that experienced lawyers should be able to formulate (see box “Investigation plan checklist”).

Formulating the scope

Identifying and formulating the scope accurately is probably the key element of managing investigations. The US Department of Justice and the US Securities and Exchange Commission have both publicly cautioned against needless prolonging or diversions when it comes to internal investigations. Again, while it is difficult to predict accurately all the ramifications of an investigation, it is essential that the scope of an investigation is limited to the pertinent allegations and does not expand the investigation without a clear need to do so. It is always possible to broaden the scope of an investigation at a later stage, if that proves necessary, whereas it is much harder to curtail the scope once an investigation has begun. Even if the investigation is regulator-driven, the investigation need only be expanded under the explicit behest of the relevant regulators and, where possible, the parameters of the extended scope should be negotiated with the regulators to limit prohibitive or unreasonable expansion. Clear timelines should be set up and a review made of the milestones that have been reached, which should act as built-in safeguards against the scope becoming too wide. Milestone reviews should permit sufficient flexibility to cope with any unexpected events or change in the scope or course of the investigation.

Investigation protocol

A well-prepared organisation will already have command and control structures in place before the need to investigate arises, and a clearly enunciated investigation protocol should be designed for this purpose. It is important to designate the relevant department that will handle investigations, such as legal, compliance or audit. In all cases, it is prudent to appoint the general counsel or head of investigations as the ultimate manager of the investigation as this will improve the prospects of asserting legal professional privilege over aspects of the investigation (see “The right team” below). It is also useful to establish steering committees or working groups in order to assemble the right combination of expertise. At times, various experts and third parties may have to be appointed. A formal investigation protocol dealing with all of these issues carries the advantage of securing the blessing of the business and respect for the governance structure for the investigation.

The right team

It is important to have a strong team running the investigation, from project manager to interviewers and data reviewers. Once assembled, the team should draw up the investigation plan and proceed to carry out the investigation as quickly as possible, ensuring that relevant evidence is preserved at the outset. Effective project management must then continue throughout the conduct of the investigation, both in terms of overseeing the overall process as well as monitoring and managing each stage. On completion of the investigation, the key findings should be discussed by the board and senior in-house and external lawyers to determine the next steps. If a published report is considered necessary, this should be drafted by external lawyers if possible and structured so as to maximise the likelihood of preserving privilege. Authorised, limited copies of the report should then be distributed and the company should ensure that its recommendations are implemented and monitored going forward. Investigator independence. A key component of a successful investigation is the independence of the investigating team. This is absolutely essential to achieve results and mitigate any internal failings, as well as to establish credibility in the eyes of the regulators and, increasingly, the public (see box “Reputation risk”). One of the key factors to consider is whether to call in external investigators. While this decision is often cost-driven, the independence of external investigators is key to removing the taint of competing interests. A case in point is that of General Motors, which hired its own general counsel, Michael Millikin, to investigate the ignition-switch defects that led to multiple crashes and resulted in a mass recall of cars in 2014. This move was widely criticised, especially when the company’s own legal department came under attack for allegedly having prior knowledge of the defects. While it can be tempting in a stressful situation to contain serious issues within the business, in-house teams must be wary of perceived and actual conflicts of interest. If an internal investigation is criticised or its credibility is challenged, there is the possibility of additional costs and disruption to the business from a second, regulator-led investigation. This can usually be avoided by appointing external support at the outset. An externally managed investigation using some in-house resources is potentially a balanced approach for certain investigations. Using external lawyers is also often beneficial if the investigation is complex, involves the actions of senior personnel, has an international dimension, or involves potential regulatory breaches or criminal offences. Privilege. In mainly common law jurisdictions such as the UK, the US, Hong Kong and Australia, legal professional privilege is recognised by law in order to enable organisations to instruct their lawyers and to receive legal advice freely, without the fear of having to disclose that legal advice to a third party; for example, to a regulator or to a claimant in litigation (see feature article “Legal professional privilege: practical tips for in-house lawyers ( www.practicallaw.com/2-531-6847) “). Other, mainly civil law, jurisdictions such as the People’s Republic of China (PRC) and many EU member states do not recognise privilege as a legal right. In the context of multi-jurisdictional investigations, those companies operating under the laws of civil jurisdictions often see a value in asserting legal privilege over their investigations by having reports of the investigation prepared in jurisdictions where privilege may be claimed; such as in Hong Kong for PRC investigations. Companies in those countries where the concept of privilege is not recognised, such as the PRC, still have the benefit of laws and regulations that specifically provide for the confidentiality of those documents and communications that arise and occur between a qualified lawyer (that is, a lawyer who meets specific qualification criteria prescribed under applicable Chinese laws and regulations) and his client, in the course of the law-practice activities of that qualified lawyer. Alternatively, they have the opportunity to claim confidentiality and retain all written material pertaining to the investigations in the offices of an external lawyer. As demonstrated above, in many cases, instructing external lawyers is the best way to preserve privilege, as some communications created by in-house lawyers will be covered by privilege but others, such as documents concerning business advice or administration, will not be privileged (Three Rivers District Council and others v The Governor and Company of the Bank of England [2004] UKHL 48; see News brief “Legal advice privilege: here to stay ( www.practicallaw.com/4-103-2418) “). This distinction is not always easy to make and any uncertainty could lead to the unintended loss of privilege. Although a company may later elect to waive privilege, it will usually prefer to control this choice (see feature article “Waiver of privilege: all is not lost ( www.practicallaw.com/0-579-7885) “). Companies should also remember that in European Commission competition law investigations, communications with in-house lawyers are not privileged (Akzo Nobel Chemicals Ltd and Akcros Chemicals Ltd v European Commission C-550/07P; see News brief “Legal professional privilege: in-house lawyers out of luck ( www.practicallaw.com/7-503-4280) “). Privilege cannot be claimed unless the document or information remains confidential. Great care should be taken to limit the number of internal and external people involved in the investigation and to avoid any leaking of information outside of that group.

A MULTI-JURISDICTIONAL MINDSET

As many businesses expand to establish and grow worldwide, it is almost inevitable that investigations will span multiple jurisdictions. Most growth is now located in emerging markets, which are traditionally perceived as being more at risk of corruption and bribery. It is therefore important for in-house lawyers to be aware of local risks associated with these markets, for example the state secrets laws in the PRC, and how to mitigate and manage them, particularly in the context of conducting effective investigations.

Emerging markets

A report published in July 2015 by FTI Consulting, a global business advisory firm, highlighted the various risks faced by companies that do business in traditionally high-risk jurisdictions (www.fticonsulting.com/~/media/Files/us-files/insights/journal-articles/fti-journal-risk-research-project.pdf?la=en). For example, it found that 83% of the multinational companies it surveyed have suffered significant losses in emerging markets since 2010, and the average cost per company over the last five years was $1.38 billion. In 99% of all incidents that involved a loss, the cause was either a regulatory, a bribery or fraud, or a reputational issue. In the context of an investigation, the damage has often already been done so the key is to mitigate and ameliorate the lapses in control.

Cultural context

When conducting an investigation, companies need to be aware of cultural and legal differences that exist between the relevant jurisdictions. Boards and in-house lawyers must be knowledgeable or at least well-informed about specialised, location-specific rules in respect of issues related to global investigations, such as data protection and employment laws. It pays to retain external local lawyers who understand both the global requirements as well as the local issues. They can assist in more quickly identifying the red flags and can interpret any culture-specific factors relating to the improper conduct, which can be critical to the team’s ability to get quickly to the bottom of the issues. Conducting interviews in the local language can save considerable time and assist to capture nuance. In addition, being attuned to cultural sensitivities can help avoid mistakes that, while seemingly minor, lead to obduracy or non-co-operation on the part of an interviewee.

Culture-sensitive cohesive policy

Excellent communication, collaboration and cohesiveness across geographical borders is essential when conducting a global investigation. Promoting shared objectives, understanding and processes will ensure strategic clarity, allow a single voice for internal reporting and avoid the duplication of work or, worse, conflicting findings. Again, however, it is vital that cultural and linguistic differences are accounted for, such as having policies translated into the local language. Training, a key feature of any robust compliance programme, should also be conducted in the local language. In addition, reporting lines should take into account what employees would feel culturally comfortable with. For example, in the PRC, employees defer most to their immediate line manager, and breaking that chain of command in order to discover fraud or corruption may prove difficult if there is no awareness of that cultural deference.

Regulator relationships

It is important for companies to establish good relationships with regulators in all jurisdictions around the globe. These relationships usually arise from the running of multiple investigations and the associated constant contact with these regulators. This is one of the reasons that many companies opt to work with external lawyers when conducting internal investigations. Having vast experience in the field, global firms are typically extremely invested in their relationships with regulators, including those in the countries where local enforcement is on the rise, such as the PRC. External lawyers also have the ability to align international authorities’ schedules and deal with their conflicting styles. A system of contemporaneous disclosure renders the investigation process much more efficient by cutting down on time, as well as helping to contain the company’s regulatory exposure.

TECHNOLOGICAL SUPPORT

Advancements in technology facilitate many areas of an investigation. With effective use of technology in the investigative process, companies will find it possible to conduct the investigation across multiple locations, allowing members of the team access to the key documents, investigation plan, progress reports and findings at the touch of a button, wherever they may be located. A major technological advancement that can be used in investigations is technology-assisted review (TAR). With TAR, instead of scores of contract lawyers poring over documents, computer algorithms analyse subsets of data using predictive coding to highlight key terms in hundreds of thousands of documents (see Know how article “Judicial approval for predictive coding: canvassing opinion ( www.practicallaw.com/2-521-5179) “). In a 2013 report lodged with the US National Security Agency, statistics show the stark increase in efficiency and reduction in costs when TAR is used compared to human labour (https://ralphlosey.files.wordpress.com/2015/02/predictive_coding_nsa_gibson_future_small.pdf). Using predictive coding, 1.5 million documents were correctly analysed in 14 days, using one reviewer, for a total cost of $48,375. In contrast, traditional methods of contract lawyers visually reviewing documents resulted in only 660,000 documents being reviewed, at a cost of over $6 million. TAR is currently being used in co-operation with US regulators, yielding significant benefits in time and cost and is likely to represent best practice in the future. Some law firms have also developed their own technical solutions to support the investigative process. For example, a firm can use a tailor-made technology platform to maximise client involvement in investigations by allowing clients to access documents remotely and view real-time information on costs and progress to date. These platforms can also be used for costs projection purposes and to support internal lawyers in reporting regularly on the progress of an investigation. Internal technology systems may offer similarly effective platforms for communication and data management.

COST-EFFECTIVENESS

A key driver of decisions in investigations is the delicate balancing of cost control with the need to conduct thorough investigations. This is a bigger consideration than many in-house lawyers realise: business revenues are struggling among competitive pressure; there is increasing shareholder focus on controlling costs; boards are looking to deliver return on equity by large-scale cost strategies; and all budgets, including legal and compliance, are reducing. With recruitment freezes, the same budget is being spread over an increasingly wide range of problems. This is a challenge for every company, whether big or small. In this, as in everything else, the planning and review process is of key importance. In-house lawyers should negotiate the optimal use of external lawyers to set up a cost-effective partnership. A serious investigation will cost money, but it is money well spent in the context of the fines that could be levied and the damage to brand and reputation. Above all, companies need to make sure that they learn from the mistakes of the past and deliver properly embedded change in order to avoid the need for expensive and time-consuming investigations. They need to invest in sound governance and control mechanisms that encompass legal, compliance, audit, HR, physical security and cyber security issues. Companies should be wary of getting distracted by growth and must retain their focus on maintaining the health of the company by using appropriate policies, procedures, and auditing.

Preliminary questions

At the start of any potential internal investigation, some preliminary questions should be asked:

• Is the investigation necessary?
• What is the purpose and scope of the investigation?
• What are the company’s objectives?
• Who should have oversight of the investigation?
• Who are the stakeholders?
• Are there any conflicts of interest or other risks to consider?
• How should confidentiality be controlled, such as the legitimate exclusion of certain individuals?
• What are the company’s duties, for example, to self-report to the authorities?
• Is it necessary to appoint external lawyers or can the investigation be run in-house?

Investigation plan checklist A well-formulated investigation plan should:

1. Set out the intended scope and timeframe.
2. Incorporate milestone reviews to assist the investigators in keeping costs and unnecessary digression in check.
3. Articulate the company’s strategy, which is critical to setting the tone of the investigation.
4. Consider and address all phases of the investigation.
5. Identify the relevant individuals for the purposes of data collection and interviews.
6. Identify the initial documents and data to be collected, and a clear policy for their treatment.
7. Set out the policy for the preservation of legal professional privilege.
8. Discuss potential contact with the regulators and the parameters for doing so.
9. Formulate interview plans for relevant individuals.
10. Discuss the method and delivery of reporting.

Reputation risk

One area of risk management that is often overlooked by in-house lawyers is damage to reputation or brand. A company’s reputation is vital to its value. In October 2014, Deloitte published a global survey on reputation risk, in which more than 300 executives from companies in every major industry and geographic region were interviewed (www2.deloitte.com/content/dam/Deloitte/global/Documents/Governance-Risk-Compliance/gx_grc_Reputation@Risk%20survey%20report_FINAL.pdf). The key findings were indicative of how important reputation has become to companies: 87% of those surveyed rated reputation risk as more important than other strategic risks, with 41% of respondents that experienced a reputation risk event saying that a loss of earnings or loss of brand value was the key impact. Ethics and integrity, or the lack of them, was by far the greatest risk to reputation. These findings underscore the importance of managing the impact of an investigation on a company’s customers and shareholders. It is vital to devise a media and communications strategy that addresses shareholder concerns and regulatory impact, as well as employee and customer concerns. It is also important to hire competent and experienced internal and, if needed, external media and communications advisers who are ready to handle media comment and speculation, and demands from the regulators, investors and customers.