Companies must select a truly independent individual to lead the investigation.
A vivid example of a company getting it wrong is Rupert Murdoch’s News of the World, which touted its 2007 internal investigation as proving that phone-hacking was ‘not widespread’, according to the New York Times. When the explosive phone-hacking scandal broke a few months ago, however, it proved the 2007 investigation was, at best, a failure.
Companies would be wise to re-examine their approach to internal wrongdoing, particularly in the brave (and bountiful) new world of whistleblower legislation. As required by the Dodd-Frank financial overhaul bill, the SEC has finalized rules for rewarding whistleblowers with bounties of at least $100,000 for original information that leads to a successful prosecution and $1 million or more in penalties. Since whistleblowers need not use the company’s internal compliance program to qualify for the bounty, companies cannot count on getting the whistleblower’s information first.
Against this uncertain new backdrop, companies not only need to be reviewing their compliance programs, but also need to be prepared to launch an effective internal investigation at any time. So what is the best way to handle these difficult situations?
Al Gagne, director of ethics and compliance for Textron Systems, has been involved in hundreds of internal investigations at his company. Textron Systems is a $2 billion subsidiary of the $10 billion defense contractor Textron Inc. Gagne agreed to discuss best practices and pitfalls from his experiences with Corporate Secretary, but emphasizes that he is not a spokesman for Textron.
Gagne’s investigations have ranged from simple allegations of a hostile work environment and petty thefts to allegations of fraud and possible Foreign Corrupt Practices Act violations. At times he has handled investigations at other companies within Textron Inc. He explains that in those situations, he was brought in ‘to provide independence and objectivity to a particular situation’ or ‘just to help someone who might otherwise have been perceived as being too close to the matter being investigated.’
Gagne states that ‘one of the key components of a credible investigation is to have someone who can be completely independent.’ Similarly, Toby Thacher of full-service investigative firm Thacher & Associates stresses that independence is crucial. ‘We must maintain our independence in both methodology and in the preparation of our final report,’ he says. ‘In the event that independence becomes impossible to maintain, you have no alternative but to resign.’
Things haven’t always gone smoothly during the 15 years that Thacher has been investigating allegations of kickbacks, discrimination and harassment, procurement fraud, hostile work environments and theft of trade secrets. ‘We were involved in one investigation where we believed there was criminal activity on the part of one of the corporate officers, which needed to be reported to the SEC and prosecutors,’ he recalls. ‘We asked for permission to tell the audit committee, but the client refused. Our only alternative was to resign from the investigation.’
Independence is a must
Unsurprisingly, prosecutors care deeply about the independence of an investigation. One current federal prosecutor with about a decade of experience emphasizes, ‘The big concern I have when I hear about an internal investigation is whether or not it’s a whitewash.’
The prosecutor says that he looks at the investigation itself to assess its independence. ‘What I don’t want to see is an internal investigation where the people who are conducting it are directly answerable to the people suspected of misconduct,’ he explains. ‘The real test of independence is whether they’re conducting a real investigation without regard to whom it might implicate or how serious the conduct is that they’re trying to minimize.’
The question of who conducts the internal investigation really makes a difference, the prosecutor says: ‘One thing that is helpful is to see lawyers on the other side of the table who have some government experience, because that suggests they have sensitivity to what our concerns as prosecutors might be.’ He also prefers to see outside counsel conducting the investigation rather than an employee of the company, unless a high-level executive is leading the investigation. ‘When I’m talking to an employee, I’m always concerned that the employee is worried about pleasing his or her boss more than doing the right thing by the company, because those can be two very different things,’ he explains.
Have an action plan
Beyond deciding whether or not the investigation will be independent, companies must make several other early choices. Gagne has this advice: don’t jump in without an action plan.
‘You have to take each allegation at face value and with good intentions,’ he says. ‘You want to put together a plan about how to do the investigation. The details of an investigation depend on the seriousness of the allegations, the credibility of the witnesses and the strength of the physical evidence. I like to look at documentation before conducting interviews. Sometimes that’s enough to find the smoking gun needed to confront the employee and take appropriate corrective action.’
Another key early decision is who should lead the investigation. Gagne warns of the pitfalls of having the wrong person in charge: ‘One of the biggest problems would be allowing an unqualified person to conduct an investigation without the right resources. For example, if there’s an allegation of sexual harassment by a supervisor, an inadequately trained investigator might confront the supervisor without first having interviewed other witnesses.’
Good investigations can call for a broad variety of skills, requiring an entire team. ‘An investigative consulting firm like ours can be uniquely valuable for conducting investigations because of the integrated team we provide,’ says Thacher. ‘We have lawyers, accountants, forensic auditors, forensic engineers, analysts and other specialists.’
Another crucial early decision is how to go about preserving evidence. ‘The minute there’s a hint that an internal investigation is necessary, it is crucial to preserve evidence and send the message throughout the company that all evidence – documents, electronic files, telephone records – needs to be preserved,’ Thacher says.
Thacher warns that employees might try to destroy evidence, but says it’s almost impossible to do it in such a way that it cannot be recreated. ‘Any hint that evidence was destroyed can be devastating to the company,’ he notes.
Jon Abernethy (pictured left), counsel at Cohen & Gresser and a former assistant US attorney in the Southern District of New York, advises:
‘Notifying employees that they must preserve any potentially relevant documents will help protect the company from a possible obstruction charge in the event that there is ever a claim that documents were discarded or destroyed.’
A more subtle concern that arises at the very beginning of the investigation and runs throughout it is what to put in writing. While investigations are generally carried out through attorneys to ensure their results are protected by attorney-client privilege, a company interested in getting credit for its cooperation from regulators or prosecutors may decide to give up that privilege. ‘It was once standard for prosecutors to demand a waiver of attorney work-product/attorney-client privilege to give credit for cooperating,’ says Jason Brown, a partner at Ropes & Gray. Brown adds that over the past three to four years prosecutors have stopped demanding the waiver up front, ‘but they still consider such a waiver a real sign of cooperation.’
The anonymous federal prosecutor confirms that take, saying: ‘It’s always within the discretion of the company to waive attorney-client privilege, and my experience is that when they do that, it often leads to the most productive relationship.’ So a company intending to seek credit for its investigation and its cooperation might want to operate as if it doesn’t have attorney-client privilege from the outset.
When to alert regulators
Another issue is deciding on the right time to call outside counsel and prosecutors or regulators. Gagne, perhaps because of Textron Systems’ resources and the type of matters he usually investigates, says he frequently completes investigations without outside counsel, and notes that the decision about whether to involve them or notify prosecutors belongs to general counsel. In short, Gagne says, ‘It’s all about bringing the right resources to address the specific risk area.’
Unsurprisingly, outside counsel and prosecutors both want the call to be made at the very beginning. Brown explains, ‘Defense counsel wants a call from the company right away if possible, but because of cost or pride there’s a tendency on the part of companies to think that they can handle the investigation when they can’t fully do so. But it’s not that costly to bring in outside counsel early on for advice about the type and scope of the investigation and how to conduct it, even if the company then runs the investigation itself.’
The prosecutor warns that late notice can deprive law enforcement of its best investigative tools. ‘If the conduct is ongoing or more recent, we may not want to alert the people we’re investigating that we’re investigating them,’ he explains. ‘If everyone’s on notice that the conduct is being investigated, there’s a whole range of tools that the prosecution’s not going to be able to use, such as wires, wiretaps and confidential informants. And those tools often lead to the best evidence.’
While the prosecutor acknowledges that ‘generally corporations want to do the investigation, get their heads around what happened and how deep it goes and then call the prosecution,’ that approach ‘may be OK’ only ‘if the conduct at issue is entirely historical.’ The prosecutor’s bottom line: ‘When somebody walks into the corporate secretary’s office and reports misconduct, the corporate secretary is going to call the company lawyer and whoever else needs to know, but one of the first calls should be to the government. He or she is playing with fire because we may already know about it.’
Another hot issue is interviews. ‘Careful thought must be given to the timing and sequencing of interviews,’ says Abernethy. ‘One thing you have to be mindful of here is the risk that the passage of time will cause people’s memories to fade. If, as is often the case, you have millions of documents to review, you don’t necessarily want to wait until that review is completed before beginning to talk to key people. That said, you don’t want to go into interviews without having reviewed at least the most important documents.’
Brown similarly stresses how crucial it is to get interviews right. ‘A prosecutor won’t appreciate it if he thinks witnesses have been tainted,’ he remarks. ‘For example, if a higher-up in the company talks to a lower-level employee and the employee gets the idea to say things differently as a result, it looks like coaching.’ Similarly, Brown says, ‘water cooler talk has to be stopped.’ Group interviews should never be done because everyone’s recollection will be tainted by the testimony of others.
Record-keeping can be key
Corporate secretaries, because of their role at board meetings, are often privy to a lot of information about an ongoing internal investigation. At companies where the corporate secretary is the head of the ethics and compliance function, the corporate secretary or those to whom he or she reports may be running the investigation. But at all companies, there is one core corporate secretary duty that can have a major impact on the success of the investigation: record-keeping.
Gale Ennis, a partner at WilmerHale who has investigated both large and mid-sized firms for accounting fraud and stock option and financial statement disclosure issues, says: ‘Right now, at some companies, it may take months to get minutes finalized and recorded. It seems like a formality, but it becomes quite important if there’s an enforcement action.’ Ennis explains that ‘It’s often critical to know who learned what when, and how they learned it, so it really helps if minutes and records are organized.
‘When you’re trying to do your regular internal investigations job and recreate corporate history at the same time, it can be a very expensive undertaking.’
The backdrop to any internal investigation is the ongoing compliance program. Thacher advises that companies have ‘a good compliance system with strong internal controls. A good code of ethics isn’t enough.’ He says that while companies must monitor compliance on an ongoing basis, their role should not be to act as a cop, ‘but rather as a vehicle by which internal problems can be identified and addressed. The controls have to work for the employees and not prevent them from doing their jobs effectively.’
Compliance programs need to be reviewed against the Dodd-Frank whistleblower rules. Dodd-Frank is still so new that it’s not clear what the ground rules are, much less how they may change in the near future. As a result, Ennis says, ‘Companies need to review internal compliance and ethics programs every quarter to half-year, because with the unsettled legal ground, there’s going to be important developments to react to.’
Gagne sums up internal investigations this way: ‘Companies don’t want criminals and thieves working for them. It’s important for companies to weed out those employees as quickly as possible and work with the appropriate government agencies when necessary to help them prosecute.’
Internal investigations checklist
• Don’t ignore the problem, and don’t panic. Take the allegations at face value
• Remember that Dodd-Frank imposes a 120-day window to carry out the investigation, and act accordingly
• Whether from inside or outside counsel, get legal advice
• Decide if the investigation should be independent or defense-oriented; consider the likelihood of getting credit for an    independent investigation
• Decide what expertise and resources are needed; decide if it is time to call outside counsel, prosecutors or an investigative consulting firm
• Create an action plan – figure out what interviews will be necessary, what order they will be done in, and what must be reviewed before doing the interviews
• Preserve evidence
• Follow the investigation where it leads, revisiting the choices about calling outside counsel, outside experts and prosecutors as appropriate.
