Areas of Practice - Internal Corporate Investigations continued....

Internal Corporate Investigations – Overview
The following basic procedures are generally applicable to most internal corporate investigations.  However, every situation is intensely fact specific and we urge you to contact Walther Law P.C. to schedule a free consultation regarding your case.  Please select from the list that follows to see a short summary of the various steps in the typical investigative process.

Initial Steps

A. Reporting the Allegations and Issues to the Appropriate Party. If the issues or allegations have the potential to be material to the entity, a business leader or attorney who learns of the issue should consider whether to immediately notify the Audit Committee of the Board of Directors or the highest governing body of the organization. The Audit Committee’s independence from company management can help ensure that the investigation will not be unduly influenced by management who could have been involved in the matter being investigated. Less serious allegations may be reported through normal reporting channels, to the legal department, or through the Company’s fraud or ethics hotline.

B. Identifying the Investigation Leader. When it is determined that an investigation should be conducted, a qualified individual should be designated to lead and to be responsible for the investigation. The choice may depend on the seriousness of the allegation. Generally, the more serious the allegation, the more formal and independent the investigation may need to be. For minor routine matters, it may be appropriate for the investigation to be conducted by a leader within the business unit involved. For more significant issues, it may not be appropriate for the business unit to investigate itself due to apparent conflicts of interest. In such situations, the investigation may be assigned to a leader in another department such as Human Resources, Legal, Compliance, Internal Audit, or Corporate Security. For serious issues, such as misconduct by a senior executive, or a matter involving potential criminal liability, the investigation may be guided by the General Counsel, a member of by the Board of Directors, the Audit Committee, or a Special Committee of the Board, who will direct outside legal counsel conducting the investigation. This is particularly important in the absence of internal resources that are very experienced at a) conducting workplace investigations; b) understanding how to obtain and protect evidence in support of potential regulatory action, criminal or civil litigation, or c) conducting sensitive interviews with all level of personnel, including senior management.

Internal investigations can at times be resolved more efficiently and with lower risks of litigation for improperly conducting the investigation when overseen by independent outside counsel with investigation experience, in tandem with outside experts, such as auditors, investigators and forensic computer specialists. This is almost always the case if potential wrongdoing by high-level officers is being investigated. Some regulators have made it clear that they give more credence to investigations conducted by outside attorneys.

When the allegation raises potential legal issues, the investigation should be under the direction of an attorney. The use of an attorney to provide legal advice in anticipation of litigation generally allows the investigation to be protected from disclosure under the attorney-client privilege and the attorney work product rule. Nevertheless, if outside legal counsel is to lead the investigation, a corporate leader with significant authority in the company still should be appointed to assist outside counsel throughout the investigation. This corporate leader may be the head of Internal Audit, Human Resources, Compliance or Corporate Security, or the General Counsel or a deputy. Designating a corporate leader with sufficient stature and appreciation of the investigative process can be critical. The corporate leader should communicate the importance of the investigation and the necessity of complete cooperation to the employees who may be interviewed, or from whom records or information may be sought. This will help the attorney and investigators working at the attorney’s direction achieve the best results. The corporate leader can also emphasize that there will be no retaliation or reprisals for cooperating with the investigation. The corporate leader also can help free up employees’ time to gather records and participate in interviews.

C. Determining the scope of the investigation.
The investigation leader’s initial task will likely be to determine the investigation’s initial scope. This generally includes identifying the relevant time frame, the key individuals involved, and locations or sources of potential evidence. Generally, the investigation should be limited to the particular allegation that has been made. However, the investigative scope may need to cover other tangential facts that should be assessed to mitigate further risk to the company. The scope should be sufficiently broad to accurately obtain all the facts to: a) confirm or refute the allegation, and b) provide a foundation for remedial measures, if appropriate. If the company ultimately intends to seek credit for its diligent investigation efforts from the government, the scope should be broad enough to cover areas of interest to the government.

D. Records freeze order and data acquisition.
If word of an investigation is prematurely leaked within the organization, valuable electronic and hard-copy documents may be removed, destroyed or altered. Determining what records may be useful and isolating them or discreetly obtaining copies can help protect the organization. If certain materials cannot be obtained without compromising the existence of the investigation prematurely, consideration should be given to alternate ways to protect them until they can be safely obtained. It is also important to create a list of potential witnesses or “parties of interest” (hereafter “Key Players”) and consider securing electronic images of their server files, email files, or individual laptop/desktop hard drives. Where the investigation can be disclosed internally, it may be critical to quickly secure certain highly important and relevant records, even if on a limited basis. Experienced attorneys know that it is easier to explain a “bad document” than to justify its untimely destruction. Many corporations have a document retention policy and destruction schedule. Potentially relevant records – electronic and paper – should be identified and removed from the normal record destruction schedule. Also, key current and former employees who may have knowledge or relevant records regarding the incident should be identified and given a copy of the freeze order.

Likewise, company employees responsible for electronic databases and business file records should be identified (hereafter “Information Custodians”). These are employees with technical ability to harvest e-mails and relevant records stored in systems such as Microsoft Outlook, and document management systems like SAP, the company Intranet, Instant Messaging, Shared Drives, etc. The freeze order should describe the potentially relevant records, or categories of records, that are subject to the freeze. It may be necessary to consult select Key Players and Information Custodians to prepare this description.

The freeze order may also notify employees that they may be asked to participate in a witness interview as necessary to locate records. If the investigation is to be privileged, this notice should state that employee interviews are necessary to provide legal advice to the company in anticipation of litigation. The notice should clearly state that both the inside and outside attorneys represent the corporation and not individual employees. The notice also should state that employee cooperation is required, and that they must keep the interviews confidential.

E. Investigation plan and timeline. Consider establishing a plan and timeline that includes each step that will be taken and a target completion date for each. Consider how each phase of the investigation supports the next step. The investigation plan states how the investigation will be conducted, and generally varies in complexity depending on the circumstances.

Elements present in a typical plan may include:


Overview of the allegation or event being investigated, including a summary of the laws or company policies that have allegedly been violated. If appropriate, include potential legal defenses or mitigating circumstances that may be relevant.

Summary or chronology of the facts known thus far.

List of the opposing parties with contact information. (e.g., regulatory body or attorney that issued the subpoena).

Legal issues to be researched and a completion date.

Sources of information, including the records to be reviewed and their locations.

Plan and timetable for gathering and reviewing records.

Consideration of the practicality and benefits of using early case assessment (ECA) procedures and technology to locate relevant emails and other information.

Effective ECA strategy can help identify potential interview targets that might otherwise be overlooked, and shape the scope and focus of the interviews to be conducted.

Initial list of Key Players and Information Custodians should be developed.

Co-workers who may have worked where the alleged misconduct occurred should be considered.

The plan should include the order for interviews and a timetable to complete.

As a general rule, consider interviewing first those who may help locate records and provide background information.

During interviews, witnesses should be asked to identify any other people who may be able to provide relevant information.

Individuals not interviewed may be asked to prepare and sign a written statement of any facts they can contribute.

If possible, consider postponing key interviews until the documents have been reviewed.

A communication plan
describing to whom and with what frequency the investigation leader or attorney will report the status of the investigation.

Preparation of a final report.

The plan might be modified as the investigation proceeds, and the factual chronology may be supplemented with new facts.

New witnesses could be added to the interview list, while others dropped.

If the investigation was triggered by a subpoena or discovery request, the scope of the request may be narrowed by agreement, eliminating the need to review and produce certain records.

Legal research may reveal additional defenses or potential counterclaims that should be pursued.

RETURN TO topics

Gathering Records

Identifying the kinds of records considered to be “in scope” in any investigation is important. Following is a list of the types of records and information that might be considered relevant.  It is not intended to be all inclusive.

  • Company rules, policies and procedures
  • memoranda or notes regarding the incident
  • time cards, logs or diaries
  • expense reports and receipts
  • communications to employees – including historical email files
  • prior complaints
  • personnel and security files
  • managers’ notes and files
  • samples of the employee’s and others’ work for comparison
  • analyses prepared by the subject and maintained in shared servers, network files and personal hard drives
  • When in doubt, err on the side of obtaining/preserving more potentially “perishable” (subject to easy destruction or alteration by investigative targets) data or documents than fewer. In some instances, it might be better to have data and not need it than to need data and not be able to get it.

    To improve odds that all requested records are located and gathered, consider meeting personally with employees who will search for records. At these meetings, discuss the records freeze order, and learn the individual employee’s record retention practices, including e-mail retention.  Consider showing examples of responsive documents, and giving employees a plainly written list of records and categories to search for.

    When records are ready to be gathered from employees, a records index or table is prepared.  The index should list each employee or custodian, assign file numbers, indicate the location the records originated from and have space for inserting comments.  All records to be turned over to an opponent are generally Bates numbered in some fashion. Once documents have been numbered, the index should then be updated with the identification numbers.

    For larger investigations, consider retaining a vendor who specializes in early case assessment, electronic discovery and litigation support.  There are many.  These vendors provide data acquisition, processing, copy, scanning and tiffing services, numbering, and are able to load electronic records onto web-accessible searchable databases and provide auditable “first level review” services.  Because they specialize in this area, these vendors can often manage these functions more efficiently, cost effectively and with better project controls than law firms. RETURN TO topics

    Reviewing Records

    The primary objective of the record review is to identify critical documents as soon as possible.  The record review can be as revealing and important as interviews.  With large scale reviews, again consider retaining outside vendors or contract attorneys for the first level review to reduce expense.

    For large scale matters, the review team should be fully briefed on the issues, the governing law, and potential claims and defenses.  They should be given a “review protocol” in writing that instructs how the documents should be tagged.  Some typical tags include: privileged document, responsive, non-responsive, hot document, needs further review.  Also, tags naming each Key Player to be interviewed are often used.  Witness files are later created containing documents related to each interviewee, and these files are reviewed and an interview outline is created for each interview.

    As important documents are identified, these “hot documents” are typically loaded onto an electronic file or database and copies are put into a binder in chronological order.  An index summarizing each “hot document” is included in the front of the binder.  The hot documents binder becomes a useful tool during witness interviews, and when reporting the results of the investigation.RETURN TO topics

    Witness Interviews

    Careful preparation for witness interviews is very important. Time and resources are conserved when witnesses are interviewed just once. However, multiple interviews of the same witness sometimes are unavoidable, as new facts or theories surface during the investigation.  Nevertheless, careful preparation can substantially limit the need for multiple interviews. 

    Following are some practice tips to consider:

    • Review legal research related to the issues being investigated.  Understanding the legal framework gives interviews focus. It allows one to place newly learned facts in proper legal context – either supporting or refuting a claim or defense – like hanging ornaments on a Christmas tree.

      Thoughtfully prepare an interview outline.  This can help ensure all important topics are covered and improve efficiency.  Review documents related to the witness (witness file) before the interview, and use key documents to fill in the interview outline. The outline, however, should include appropriate key topics even though there may be no specific documents to show that interviewee.  If standard questions are used for multiple witnesses, the answers can be compared and contrasted.

      Consider giving copies of documents to be used in the interview to the witness in advance.  Then, the witness will not need to spend valuable interview time reading documents. Attorneys, and investigators working at their direction, should give an Upjohn warning.  See Upjohn v. United States, 449 U.S. 383 (1981).  Employees should be told whom the attorney represents (e.g., the corporation, and not the employee individually), that the privilege belongs to the corporation, and that the corporation may waive the privilege and disclose the substance of the interview to third parties.  A recent decision by the Ninth Circuit U.S. Court of Appeals highlights the importance of the Upjohn warnings.  After the Upjohn warning is given, questions typically focus first on the employee’s background and employment history with the company as well as any reporting responsibilities.  These non-threatening questions can put the witness at ease.

    • Where appropriate and feasible, two individuals should conduct the interviews, one to lead the questioning, and the other to take notes.  The note taker may later act as the “prover” if the witness tries to recant the testimony. The order of interviews can be important. First and foremost, under no circumstances should the subject of an investigation be interviewed prematurely. This is the most frequent and most significant mistake made during the early stages of a poorly conducted investigation, and can be devastating in terms of successfully concluding the investigation. Telling an investigative target even a few details of the allegations that might have been asserted against him or her and asking for an explanation, before necessary investigative procedures have been performed, can ruin an investigation. Interviewing a subject or witness after reviewing initial documentation allows the interviewer to gain a better feel for the interviewee’s knowledge and candor, and can help the interviewer to control the interview. Secure a handwritten, signed statement from any witness or subject if appropriate and possible.RETURN TO topics

    Final Report

    The report of the investigation may be either written or oral depending on the circumstances and the desired outcome.  A well-written report discussing facts and law that is provided to an investigating agency may be essential to dissuade government attorneys from prosecution.  On the other hand, the same report may be turned against the client, and in the process, privileges may be waived and the report could become a weapon against the company in later litigation by third parties.    Under certain circumstances, (often determined by industry or whether the company’s equities or debt are publicly traded) the company may be legally required to self report under agency regulations.  A written report of investigation could be very helpful if the company was the victim of fraud and wished to disclose the crime to law enforcement for possible prosecution. Similarly, the company may decide to make an insurance claim which would likely entail a written disclosure.  The company may also choose to self-report to obtain leniency under the Federal Sentencing Guidelines if there is potential for a criminal prosecution against the company.  And where the outcome of an independent, competent investigation shows that the company acted properly, it may be prudent to have a thorough written report.  On the other hand, if there is no legal obligation or strategic reason to disclose, the company may choose to keep the final report oral to help maintain confidentiality under the attorney client privilege while it implements remedial measures.  Thus, whether the final report is to be oral or written deserves careful consideration. Some writers suggest that oral reports are far preferable to a written report.

    If the report is to be written, it should be drafted in a manner that reduces risks of inadvertent waiver of the attorney client privilege and work product protections.  It should state clearly that it is attorney work-product and contains attorney-client privileged information, that its purpose is to provide legal advice to the corporation in anticipation of litigation, and the attorney’s legal analysis and thought process should be evident throughout.  The report should state the objective of the investigation, should distill information learned from document reviews and interviews (avoiding verbatim statements) in a balanced and objective manner.  It should state the attorney’s factual analysis and legal conclusions, and remedial recommendations.  The report should be distributed to a very limited audience with instructions to keep it strictly confidential.RETURN TO topics


    Each investigation is different, of course, and should be tailored to the specific situation based on sound judgment and common sense.  But for many investigations, the fundamental steps outlined above can help facilitate an effective investigation, and help avoid common pitfalls, including subsequent litigation resulting from mistakes during an initial investigation.  With more than two-decades of experience in the conduct and supervision of complex domestic and international investigations, Attorney Mike Walther can provide corporate clients the expertise and discretion they demand.  Remember, it’s about more than winning a lawsuit or identifying a dishonest employee.  It’s about preserving the irreplaceable good reputation of your business.
    RETURN TO topics


    Contact Us

    Phone Johnstown: 814-254-4979
    Phone New Orleans: 504-571-9215

    FAX: 866-260-7252
    Facebook Linkedin