Since 2001, public companies have retained law firms to conduct thousands of internal investigations of suspected wrongdoing by executives or employees. Lawyers can debate and disagree about the ten most important practices for conducting internal investigations, but the Ten Commandments outlined here have proven the test of time to the author, despite their seeming basic nature or common sense.

I. Thou Shalt Fully Consider the Scope and Independence of the Client Engagement and Investigation, and Reevaluate as Necessary.

Once counsel has determined who the client is – whether that is the company, the Board of Directors, the Audit Committee, a Special Committee or another body or an executive – counsel must, with that client, determine the scope of the engagement and investigation. This will depend in large part on the nature of the principal and essential allegations. While an investigation must focus on those allegations, counsel must also be mindful of any relevant or related conduct. Of course, the client has a certain interest in ensuring that an investigation does not lose focus and wander into irrelevant inquiries. But, if an investigation does not pursue logical avenues and the company or committee later seeks credit from the government for its diligent efforts, it may, for example, find a dissatisfied or underwhelmed prosecutor or regulator. The Department of Justice and the Securities and Exchange Commission will carefully review the original scope of an investigation to see if it was reasonably calculated to address corporate misconduct by the alleged malefactors. If the government attorneys conclude the client or its counsel put blinders on, or otherwise too narrowly focused the inquiry, they will give the company little or no credit and direct the company to conduct usually far more costly and extensive investigation. Both counsel and client should take care in drafting any engagement letter and related resolutions and minutes as, in time, prosecutors, regulators, auditors and others may seek to review or challenge a narrow scope of investigation and engagement authority.

II. Thou Shalt Take Immediate Steps to Secure and Preserve All Potentially Relevant Documents – Hard and Electronic – and to Make Sure All Appropriate Personnel Are Advised of the Importance of Not Destroying Potentially Relevant Documents

Many corporate investigations are greatly impeded when employees knowingly or inadvertently dispose of relevant documents, such as emails and personal notes, in the wake of learning of the investigation. These actions compound the employee’s and the company’s potential exposure in three ways. First, they undermine counsel’s efforts to gather all relevant evidence and investigate and understand the merits of the allegation. Second, they may establish evidence of a new crime – obstruction of justice – if there is a government investigation. Third, they may prove the intent necessary to establish an essential element of an underlying crime under investigation, as one does not usually conceal or destroy something unless someone has something to hide. The best practice is to promptly and immediately advise in writing all appropriate management and employees to preserve all potentially relevant records – hard and electronic forms – and for those persons to confirm to a specific manager that they have done so. If an investigation becomes public or is voluntarily disclosed to the government, one of the first questions from a prosecutor or regulator will be: what did the company do within the first 24 hours to preserve and protect its electronic data and secure hard documents from employees and officers? If the company does not have a good answer, the government attorneys may well conclude the outside counsel and general counsel did not know what they were doing, or worse, were not serious about gathering relevant evidence in the investigation.

In fully advising a client about voluntary disclosure and corporate cooperation, counsel must explain exactly what true quality cooperation entails. It is not simply a week of lawyer meetings and a few interviews at the Department of Justice, the Securities and Exchange Commission, or a U.S. Attorneys’ Office.

III. Thou Shalt Keep the Client Regularly Informed of the Law and the Likely Course, Progress and Results of an Investigation

Not only is it a good practice to keep the client updated on the law, the likely course, the progress and, of course, the results of an internal investigation, the Department of Justice and Securities and Exchange Commission will be most interested in the process of an investigation if it becomes public. The government attorneys want to make sure that there is substantial corporate oversight and, if possible, that an independent body, e.g., independent directors, is being kept abreast of factual and legal developments and, in particular, any potential misconduct by senior management. In the wake of Sarbanes-Oxley, Audit Committees and QLCCs have increased responsibility and authority to engage in dependent counsel and expert assistance during the course of an investigation. Both the Department of Justice and the Securities and Exchange Commission will want to make sure the Board members and any duly authorized committees are exercising that authority. Regular or special minutes should reflect the progress of an investigation and build a record demonstrating sound process – that independent overseers are diligently monitoring the progress and results of the investigation and regularly interacting with counsel conducting the investigation.

IV. Thou Shalt Take Prompt and Effective Measures to Stop Illegal Conduct

If counsel and the client conclude there has been illegal conduct, then they must take prompt and effective measures to stop it. This advice seems basic, but it is surprising how many employees do not understand that the “stop it” message was meant for them, their business unit or region, or even that the company was really serious. Invariably, a few employees take a straightforward directive not to meet with competitors to mean “be more careful” or discreet in questionable conduct. The message to stop problematic or illegal conduct must be firm and unequivocal – and directed to all appropriate managers and personnel. Senior management will best know how to convey the message in their organization, but convey it they must. Sometimes management will want to limit the message for fear that it will leak out to persons who will use it against the company. Whatever the reason for limiting the original instruction, the consequences of failing to stop illegal conduct are invariably very painful. If the misconduct continues, one of the key objectives of an investigation uncovering problematic conduct – remediation – is defeated. As important, any resolution with the government where the illegal conduct continues will be much more costly. Finally, the government may conclude that the senior officers responsible for terminating the illegal conduct conspired to make it appear that the misconduct had stopped, well knowing and desiring that it would continue.

V. Thou Shalt Advise Employees and Others of Whom Counsel Represents, to Whom the Attorney-Client Privilege Belongs and Who May Waive It

Ethical rules require counsel to make clear who they represent at the outset of interviews. In internal investigations, there is a constant risk that officers and employees will assume that company’s counsel represents them when that is not the case. This can result in litigation when the company or the government seeks to use the employee’s interview statement. Increasingly, the government has sought to call investigation counsel as witnesses, so the investigation lawyer who has failed to give officers or employees these ethical warnings can expect some difficult cross-examination in a courtroom. While the warning may cause employees to refuse to talk (and to thus face discharge for refusing to meet and discuss company business), counsel must still give the Upjohn warning. See Upjohn v. United States, 449 U.S. 383 (1981). If a company is cooperating with law enforcement authorities and there is an agreement or expectation that the company will share the substance of internal investigation interviews with law enforcement authorities or the memoranda of interviews themselves, then counsel should advise employees that waiver of the privilege is likely, probable or near certain.

In internal investigations, there is a constant risk that officers and employees will assume that company’s counsel represents them when that is not the case. This can result in litigation when the company or the government seeks to use the employee’s interview statement.

VI. Thou Shalt Be Firm and Fair in Conducting Witness Interviews

This commandment may seem self-evident. Still, there are counsel who conduct interviews as interrogations and begin interviews with a complete theory in place and a determination to prove it. Counsel should keep an open mind and give witnesses the opportunity to share their knowledge and best recollection of events. This fair practice can sometimes lead to legal, local or equitable explanations or defenses that counsel might never have considered. Where possible, witnesses should be provided in advance with copies of relevant documents, such as calendars, e-mails, invoices and letter correspondence. This practice is fair and avoids the waste of time resulting from the witness’s necessary reading and studying of a document he has not seen in years, or perhaps ever. If employees are recalcitrant or uncooperative, counsel and the client shall be fi rm and make clear the importance of the inquiry to the company and the need to learn promptly the employee’s knowledge of relevant facts. The goal of a corporate internal investigation remains to obtain, as efficiently as possible, accurate and reliable first-hand information about an allegation and, where the allegation proves valid, to implement timely remedial measures, including as appropriate disciplinary action (see the Ninth Commandment). Fair and firm witness interviews help serve this objective.

VII. Thou Shalt Review and Respect All Relevant Laws and Policies

This is seemingly yet another self-evident commandment, but surprisingly some investigation counsel do not know the underlying statutory or common law of the allegations they are investigating, relevant company and government policies and practices and important laws and policies of relevant foreign jurisdictions. For example, in fully advising a client about voluntary disclosure and corporate cooperation, counsel must explain exactly what true quality cooperation entails. It is not simply a week of lawyer meetings and a few interviews at the Department of Justice, the Securities and Exchange Commission, or a U.S. Attorneys’ Office. It frequently involves a multi-year, time-consuming and management distracting effort involving dozens of extensive document requests, numerous officer and employee interviews in the U.S. and abroad, electronic data searches, translation of foreign documents, and even cooperation in civil litigation. General Counsel or others will want to carefully review insurance policies, press releases, and securities disclosures to make sure all statements are timely, accurate and consistent with applicable corporate policies and the law. It is best if the proper spokespersons for the company are identified early and the entire team is aware of those persons and has their contact information. Various audiences – see the Eighth Commandment – will be scrutinizing public statements, and some may seek to maximize their own agenda from inconsistent company statements. It is important to know and respect the laws, including the U.S. Sentencing Guidelines, the laws of other countries, applicable privileges (e.g., attorney-client, work product, auditor), foreign data privacy laws of other countries and data transfer issues. These laws and policies should be analyzed early and shared with the client so all can make an informed decision.

It is surprising how many employees do not understand that the “stop it” message was meant for them, their business unit or region, or even that the company was really serious. Invariably, a few employees take a straightforward directive not to meet with competitors to mean “be more careful” or discreet in questionable conduct.

VIII. Thou Shalt in Representing the Client Remain Mindful of All Audiences and Constituents in Drafting Presentations or Reports and Making Recommendations

A decade or so ago, the audience of a corporate internal investigation was most often the senior management and, occasionally, the board of directors. Today, in the wake of Sarbanes-Oxley, the trend towards voluntary disclosure and the increased premium on corporate governance, the ultimate audience – whoever the client is – has grown to include shareholders, lenders, auditors, competitors, insurers, customers, vendors, prosecutors, regulators, the media, citizen groups, and even potential civil plaintiffs. It is wise to draft and review any reports or PowerPoint presentations with each relevant audience in mind. As important, counsel should consider whether any contemplated remedial measures will adequately address the interests of important stakeholders or constituents.

IX. Thou Shalt Discipline Wrongdoers

In the wake of willful misconduct, a company should take appropriate disciplinary actions against officers or employees. Potential sanctions include a written reprimand, transfer, demotion, compensation or bonus adjustment, suspension or termination. What is appropriate action will, of course, depend upon the facts and circumstances. If the employee knowingly engaged in conduct that violates the Company Code of Conduct or worse, federal criminal law, and the company looks the other way, does nothing or procrastinates, then the company and its senior management may later pay a heavy prosecutorial, regulatory, public relations and/or personal price.

X. Thou Shalt Implement Effective Remedial Measures and Regularly Review the Progress of Their Implementation

Most responsible public companies promptly investigate allegations of misconduct, determine whether willful misconduct has occurred and, if so, initiate appropriate disciplinary action. Most also commit to implementing sound remedial measures. The frequent rub, however, is that new unrelated events and priorities take over – acquisitions, restructurings, poor financial results, product roll outs, cost-cutting programs, management changes – and the earlier commitment to implement quality remedial measures fades. Sophisticated management teams and boards of directors will regularly review remedial measures as part of their agendas, and ensure that proposed or promised measures have been fully implemented. Absent a clear timetable of officers and employees tasked to perform the annual assessment and to complete remedial measures, many companies allow remediation to slip, and the penalties for recidivists are invariably severe. Amen.