Corporate internal investigations – what you need to know if your business is international

March 2021 | EXPERT BRIEFING | FRAUD & CORRUPTION

financierworldwide.com

Businesses with operations in more than one country need to be aware of the exposure they face when conducting internal investigations. Such investigations raise unique challenges, including a need for the investigators to familiarise themselves with the substantive and procedural laws of a foreign jurisdiction, grappling with sometimes competing obligations or prohibitions under the laws of different countries, and the need to carry out internal investigations in locations often far afield from the core of a company’s operations.

This article sets out some of the critical threshold considerations that a corporation must address at the outset of an internal investigation, with particular focus on issues unique to cross-border investigations.

Identify the subjects and scope of the investigation

Identifying the who, what, where and how pertaining to any investigation is a key step to organising how to go about conducting one. This is especially the case for cross-border investigations where it is particularly important to identify the applicable domestic and foreign laws that might be relevant to either the misconduct at issue or the investigative process itself.

The ‘who’ to be investigated, both at an entity and individual level, is critical for several reasons. First, determining the relevant corporate entity within a business subject to investigation is necessary in order to define clearly who the ‘client’ is for the purposes of the matter. The careful delineation of exactly who the client is matters for a number of reasons, including determining who in the business is vested with the authority to oversee and instruct on the investigation, establishing whether local laws require any particular governance structure, preserving the attorney-client legal privilege, and, most fundamentally, assessing which countries’ substantive laws will apply to the issue at hand.

It is equally important to identify the employees and officers who are implicated in, or otherwise relevant to, the conduct under investigation. As early assessment of relevant and implicated individuals will help to establish at the outset of an investigation where and how to deploy investigative resources and what steps a company can take early on, such as disciplinary procedures or evidence preservation, that could later have a major impact on the outcome of the internal investigation or any external law enforcement inquiry.

Identifying the ‘what’ that constitutes the alleged misconduct at issue and the ‘where’ of its location are also fundamentally important at the outset of an investigation. Making these determinations will help a company identify the scope of the problem at issue, will help to establish working parameters for any internal investigation, and will help the company and its counsel to assess the problem with a focus on the applicable laws of the relevant jurisdictions. Identifying conflicts in relevant laws, for example whether or not a particular payment was authorised under local law, will help to shape advocacy in other jurisdictions in which law enforcement has asserted essentially extraterritorial jurisdiction over the conduct at issue as, for example, UK authorities often do pursuant to the UK’s Bribery Act.

Answering these threshold questions should allow a business to better define ‘how’ it should carry out its internal investigation to ensure that the scope, aims and means deployed in the investigation are neither too broad nor too narrow, and that proportionate resources can be committed to the investigation, including whether external counsel and experts should be retained. Best practice is to frame this ‘how’ within a written-investigation plan to ensure all of the relevant stakeholders, both within a company and with respect to its outside counsel, are operating under the same approach.

Establish an investigation team

Another critical initial step in any cross-border internal investigation is the appointment of a person or persons responsible for conducting the investigation. Establishing a clear, delineated chain of responsibility and authority will help to ensure efficiency and accountability, and avoid missteps. Such an appointment can range from appointing a single person to the creation of a cross-functional team that can include in-house counsel, company officers, executives, IT and HR representatives, as well as external experts such as an external legal team and forensic experts.

Companies often have the understandable temptation to keep potential misconduct close-hold and in-house, particularly if the business has its own internal legal component. However, given myriad and severe consequences, including potential corporate and personal criminal liability that can flow not only from the misconduct under inquiry but also the manner in which that conduct is investigated and addressed, that instinct should be stress-tested at the earliest opportunity.

Specifically, a business should carefully assess cost considerations of an internal investigation against the legal and financial risks of a law enforcement inquiry overall in determining whether to engage experienced external lawyers to handle the matter. This is especially important in the cross-border context. Apart from having external counsel that can properly navigate the likely maze of applicable local laws, having people on the ground with local expertise and familiarity with local law enforcement or regulatory authorities can have an outsized impact on any investigation and possible related enforcement action.

Legal privilege

In conducting cross-border investigations, understanding and appreciating the respective contours of the attorney-client privilege in respective jurisdictions is a critical component of protecting that privilege, and through it, the company’s best interests. An inadvertent waiver in one jurisdiction could have devastating consequences for a company and trigger an erosion of the privilege’s protection in other jurisdictions.

Rules and approaches to privilege vary dramatically from country to country and from common law to civil law jurisdictions. In a cross-border investigation, a business should anticipate, as a given, that there will be material differences. These differences can impact how the privilege can be established and maintained, how to preserve the ability to properly waive privilege (which may become a prudent step when reporting and cooperating with enforcement authorities), how and whether it applies to foreign or in-house lawyer’s work, and how and whether it applies at all in the context of internal investigations. No internal investigation in any country should begin without first getting confidence and clarity in how to navigate these and other privilege-related tripwires.

Preservation of and access to documents

An immediate step any business should take when learning of a potential issue is to preserve any documents possibly relevant to the matter under investigation. Failure to do so, particularly if allegations of document spoliation or destruction arise, can result in serious damage to reputation and credibility and, as a worst-case scenario, criminal liability. A business’ information officer should be quickly interviewed to determine the types of records that the company maintains and stores, and where and how these records are stored.

This will enable the business and investigative team to take necessary steps to ensure that these records are properly preserved, and to then collect these records for the purposes of the investigation. This process usually includes sending a written notification to any employees who might hold relevant documents to put them on notice that documents must be preserved. This of course has to be weighed against the risk of tipping off staff about an investigation.

A predictable layer of complication added to this in the case of a cross-border investigation comes from the fact that an increasing number of jurisdictions have data protection laws that can impact how a business can go about preserving, accessing and producing documents. This analysis should be undertaken as a priority by subject matter experts given that these laws are complex, are triggered the moment any data is ‘processed’ and can saddle a company with liability for breaches. For example, in some European jurisdictions, data laws prevent data removal from that jurisdiction absent specific approvals.

Reporting

A question frequently faced at some point in any internal investigation is whether a business is legally required to, or strategically benefitted by, reporting the fact of its investigation and the suspicion of underlying misconduct to authorities.

This question is complicated in cross-border investigations. First, countries’ laws vary greatly, and are often inconsistent, about requiring the reporting of certain misconduct. Even when reporting is not legally mandated, many countries’ enforcement authorities either encourage proactive self-reporting of issues that can in turn mitigate the chance, or severity, of enforcement action, or they operate self-reporting programmes that can lead to immunity from prosecution.

Again, given how these requirements vary between countries, understanding how they apply to any internal investigation is a threshold question that will help to ensure that a business both complies with any mandatory requirements and avails or avoids any strategic benefits or pitfalls from self-reporting.

Employee interviews

While the scope and methodology for employee interviews will often evolve as an investigation progresses, the vast majority of internal investigations will require at least some employee interviews. In planning and preparing for any such interviews, an investigative team usually begins with employees who are likely to be purely fact witnesses and who are not implicated in any potential misconduct. These employees can provide background knowledge and expertise regarding the subject-matter at issue and the information they provide will help shape ongoing decisions on additional interviews, evidence collection and other critical topics. Once these employees are interviewed and the relevant documents are obtained, investigators can then move on to interview employees who may be involved in the conduct at issue.

Employee interviews give rise to a host of legal issues, many of which are complicated in a cross-border investigation by differences in laws. For example, a business will need to assess whether it is prudent or even required to provide or ensure an employee has been given an opportunity to appoint their own independent legal counsel – in jurisdictions like the US it is not uncommon for a company to appoint an independent pool of counsel to advise respective employees involved in an investigation.

The variety and disparity between countries’ employment laws is another area where a business should look before it leaps. Not only should a business review employment agreements for terms that may help or hinder the conduct of interviews, but relevant employment laws should be mapped out to determine potential issues. For example, issues around whether employees can refuse or be compelled to be interviewed, whether there are any steps a business must take before interviewing an employee, and what remedial steps can be taken against an employee who is either uncooperative or suspected of committing or believed to have committed some form of misconduct. Many jurisdictions also have specific whistleblower and anti-retaliation statutes that apply to employees that need to be analysed as part of any internal investigation.

How to avoid common pitfalls

With the benefits of operating across borders come risks. The need for there to be an internal investigation can often arise quickly and then require a swift and proactive response. It is when acting in haste that a number of the common pitfalls can arise. The key to a successful investigation is planning and having the right experts in place in each jurisdiction.

Jason Cowley and Francesca Titus are partners and Andrew Thornton-Dibb is an international attorney at McGuireWoods. Mr Cowley can be contacted on +1 (212) 548 2138 or by email: jcowley@mcguirewoods.com. Ms Titus can be contacted on +44 (0)20 7632 1685 or by email: ftitus@mcguirewoods.com. Mr Thornton-Dibb can be contacted on +1 (202) 857 1724 or by email: athornton-dibb@mcguirewoods.com.

Jason Cowley, Francesca Titus and Andrew Thornton-Dibb

McGuireWoods