Internal Investigations: A Top 10 Checklist

Client Advisory

What to do when the whistle blows? One of the numerous direct results of the Sarbanes-Oxley Act of 2002 has been a dramatic increase in the number of internal investigations instigated by public companies or their auditors, often initiated by an actual or self-assumed whistle-blower, and usually involving some initial frantic scrambling since the facts often erupt with intense and unexpected pressure on all involved to do the work not only with the thoroughness required, but also under extreme time pressure.

The first days of organizing an internal investigation can indeed be chaotic. Based on our experience, careful advance preparation can be invaluable if and when the need arises, and even if the Company is not prepared in advance, the following ten areas will require virtually instant attention as the investigation is formulated and gets under way. Some of these areas are obvious, others less so, but all of them will surface immediately as urgent tasks for the working group to accomplish on virtually simultaneous tracks.

1. Anticipate, and Constantly Reevaluate, the Alternative Outcomes. While it is impossible to know where the investigation eventually might lead, at the very outset of the investigation, and constantly as it proceeds, the client and counsel must consider the effects of the various alternative possible findings, and make contingency plans. Depending on the investigation’s results, what regulatory requirements might be triggered? What representations to auditors and possibly others might be required under Section 10A or otherwise, and exactly how will those representations read? What effect will there be on present or prior financial statements? What disclosure obligations might the investigation itself require? Advance planning and candid discussions of contingencies can create significant benefits, regardless of the outcome. Many effects will be inevitable, but others might be contained or managed, depending on the facts, and the more advance thought the better.

Consider as well the available insurance coverage, in place and archived, which might be available, and timely take care of any required notices to carriers.

As the investigation proceeds, interim reports to law enforcement, regulators, auditors or others might be triggered in advance of the final conclusions, and it is important to consider the probably inevitable loss of control over the investigation which such disclosures likely will prompt. There may also be a choice of law enforcement or regulators, and a decision whether to direct the issues to one or another, and to vary the handling of required notifications according to circumstances.

2. The Working Group. At the outset, it is critical to identify the client to whom the investigators will report. Under Section 10A of the 1934 Act, the Audit Committee or the full Board is the usual overseer, but this can vary if, for example, significant numbers of those constituencies are targets of the claimed transgressions. Once the client is identified, the Working Group can be formed. Within the Company, designating the Working Group might not be as easy or obvious as one might think, especially if logical members are conflicted because of the nature of the investigation. If the Company has a Qualified Legal Compliance Committee, that might be the appropriate manager of the investigation, especially if the matter being studied involves financial issues or actual or alleged irregularities which might have been reviewed in the past by the Audit Committee. But QLCCs are still fairly rare. Remember that to be fully effective under Sarbanes-Oxley, the QLCC must be in existence already and should not be formed solely for the purpose of the investigation.

3. Define the Purpose and Scope. It will likely be impossible to draw a precise ringed fence around any internal investigation at the outset, but try to secure at least general agreement regarding the purpose and scope of the investigation. Investigators must be free to go where the investigation takes them, and it is critical that all the key players sign on to that approach. If the client and Company management are not committed to an unfettered investigation, there is no reason to proceed.

Often the usual “bottoms-up” approach of the typical investigation can be adjusted somewhat in the event that managers believe that some other approach would avoid unnecessary disruptions to the business and accomplish the same result. But remember that if the investigators believe that their process is being restrained without very good reason, then the investigators themselves may feel constrained to step away or to take other action, with the possible result of a less than complete investigation, or worse. Usually these issues can be resolved with a reasonable approach which fairly considers the demands of the business, but the thoroughness and independence of the investigation cannot be compromised in the name of business expediency. It is also common for a thorough investigation to disclose other, often entirely unrelated, deficiencies or other areas where inquiry or at least management attention might be directed (which can be a substantial benefit to the company). It is always appropriate to review at the outset what will happen if and when this occurs.

4. Take Care to Try to Protect the Privilege. For various reasons, the internal investigation often is best accomplished by independent counsel to the Audit Committee or other similar committee of the Board of the Company, acting with such outside advisors as the facts may require. Typically, the retention letter with the outside law firm will set the structure contemplated by Upjohn Co. v. United States, 449 U.S. 383 (1981) and U.S. v. Kovel, 296 F.2d 918 (2d Cir. 1961). Basically, the outside law firm assumes primary responsibility for carrying out the investigation, with the firm itself retaining and controlling any forensic accountants or other experts deemed necessary.

5. But Assume the Privilege May Not Be Available Going Forward. While the investigation will be conducted with care taken to protect confidentiality, including specific confidentiality agreements wherever a logical party (including a government agency) to such an agreement comes on-scene, there is never complete assurance that the attorney-client privilege or the attorney work product privilege will be respected in any subsequent litigation or proceedings. The McKesson line of cases teaches that even confidentiality agreements with regulators may not protect the privilege against later private litigants. In these and other cases, the privilege may be deemed to have been waived, or may have to be expressly waived in whole or in part in order to conclude the investigation or to satisfy the expected requests for waiver from any regulatory agency which becomes involved in the investigation directly or indirectly, and is unwilling to agree to confidentiality.

Therefore recall the doctor’s mantra: “First of all, do no harm.” Take care to the maximum possible extent not to create documents through inadvertence or inexperience that might later cause confusion or worse. Witness interviews, for example, should have careful notes taken by an experienced lawyer, and if separate notes are taken, any inconsistencies should be reconciled while memories are fresh. Possibly innocuous documents or references should not be given undeserved importance by an inexperienced working group member. Ensure that attorney notes and other attorney work product, are carefully segregated from any files which might be made available to outside parties.

6. Capture the Records. As early in the process as possible, get an understanding of the Company’s IT and records-retention protocols, and then capture the records for later review. There should be an appropriate reminder to the logical audiences that regardless of the Company’s records retention policies, all records relating to the subject matter of the investigation should be preserved until further notice.

E-mail of course is a particularly sensitive, and often very complicated area. What are the current e-mail retention and deletion policies? What computer hard drives and back-up media should be copied, secured, or confiscated at the outset? As early in the process as possible, get an understanding of the Company’s IT and records-retention protocols, and then capture the records for later review.

There should be an appropriate reminder to the logical audiences that regardless of the Company’s records retention policies, all records relating to the subject matter of the investigation should be preserved until further notice.

If the auditors, or regulators, are involved in the situation, be sure that they concur with the document and e-mail capture and retention plans, and that they also agree with the reasonableness of the recommended approaches.

And remember that chain of custody can sometimes become a critical issue, especially if an investigation might ultimately result in criminal proceedings.

7. The Schedule; The Working Group Directory; and Other Procedures. Set a Schedule, agreed to by all of the relevant constituencies, for the investigation. The Schedule will inevitably be altered to meet the circumstances, but aggressive requirements at the outset will help substantially to focus the effort.

Have it clearly understood how reports are to be handled -- to whom should outside counsel first report, and how often, and then to whom should other interim reports be directed? And this is obvious, but prepare and constantly update a detailed Working Group Directory with Office, Home, Vacation, Mobile Numbers, etc. Caution whomever is preparing the Directory to be very careful confirming third-party contacts since that could affect confidentiality. Check the availability of key personnel and assess the effects of unavoidable absences.

8. Agree on the Formats. As early as possible, there should be discussion with the client concerning the format for the eventual reports, as well as the approach to witness interviews and document summaries. For example, will the final report be written or oral or both? To what extent will witness interview notes, and other attorney work product, be available, and consider again the privilege issues. Will certain key questions be posed to everyone? Should there be a consistent template for all interviews? Who should take notes, and who should not? ? It is best to consider these matters early, but the investigation team may need to revisit them throughout the course of the investigation, depending upon what the investigation reveals.

9. Costs and Budgets. Have a candid discussion, internally and externally, regarding the expected costs of the investigation, and of ways to keep costs under rational control while still being assured of a thorough investigation; otherwise the entire exercise could be jeopardized if later cost controls affect the integrity of the process or of the report.

10. Expect the Unexpected, and Plan for It. This final checklist point only sounds internally inconsistent. Every internal investigation will disclose facts, open areas for inquiry, and otherwise suggest new paths entirely unexpected at the outset. So there must be thought given to the best way to collect and deal with these eventualities. Often this exercise will return to the same core group within the company which began the investigation, but they must always keep in mind the absolute requirement of open and candid communication within the investigation team. Within this Group, there can be no surprises.

With Sarbanes-Oxley and Section 10A now a fact of modern corporate life, the internal investigation, which often quickly becomes an external investigation by counsel and other experts new to the company, is an event to be expected and planned as would any other common business contingency. Advance attention to this checklist above may well expedite and improve the process, and decrease the burden for everyone involved.

Questions regarding this advisory should be addressed to Robert A. McTamaney (212-238-8711, mctamaney@clm.com)

Carter Ledyard & Milburn LLP uses Client Advisories to inform clients and other interested parties of noteworthy issues, decisions and legislation which may affect them or their businesses. A Client Advisory does not constitute legal advice or an opinion. This document was not intended or written to be used, and cannot be used, for the purpose of (i) avoiding penalties under the Internal Revenue Code or (ii) promoting, marketing or recommending to another party any transaction or matter addressed herein. © 2012 Carter Ledyard & Milburn LLP.
© Copyright 2006