Deciding when to make an internal investigation independent

February 2019 | SPOTLIGHT | BOARDROOM INTELLIGENCE

Financier Worldwide Magazine

February 2019 Issue

One of the most critical decisions, with respect to conducting an internal investigation, arises prior to the investigation even starting – can the organisation rely on internal staff and counsel to get to the bottom of the problem or will the seriousness of the issue warrant an investigation conducted by independent, outside counsel? The answer will dictate the amount of expense dedicated to the inquiry, it will impact the integrity of the investigation’s findings and it will direct the future of the company.

When an issue arises, whether it is insider abuse, fraud, whistleblower complaint or workplace harassment, senior management and boards need to quickly understand the facts and circumstances, as can best be determined, prior to taking any remedial action or communicating to shareholders, customers or the government. Because the retention of independent outside counsel to conduct an investigation can be costly and disruptive to the business, it should only be pursued when necessary. However, independent investigations remain the most effective way for responsible companies to learn the objective facts, strengthen internal controls to prevent future incidents, make referrals to law enforcement, cooperate with government investigations and further demonstrate the company’s culture of compliance to key stakeholders through public relations and disclosure obligations.

The culture of compliance demonstrated by conducting a thorough independent investigation is also formally and informally considered by government agencies when determining the appropriate monetary penalty. For example, under the US Sentencing Commission’s Organisational Sentencing Guidelines, used by the Department of Justice (DOJ), whether the company maintained an effective compliance and ethics programme is an element of the culpability score used to calculate the penalty amount in a criminal resolution. Specifically, the Sentencing Guidelines state the following as an element of an effective compliance programme: “[a]fter criminal conduct has been detected, the organisation shall take reasonable steps to respond appropriately to the criminal conduct and to prevent further similar criminal conduct, including making any necessary modifications to the organisation’s compliance and ethics programme”.

When can investigations be handled in-house?

Less impactful issues or issues that may not have a material financial or reputational impact on the company are commonly reviewed in-house and do not require the added assurances provided by an independent investigation. If an issue does not implicate senior management or the board, it may be sufficient to conduct the investigation under the supervision of company executives, the full board, a division manager or the business unit where the perceived issues may have occurred. For example, it would make little sense for a company to expend resources on outside counsel every time the company reviews a suspected violation of company policy by a business line employee that would not be reportable to any government agency or law enforcement. Similarly, isolated allegations of workplace harassment among middle management may not rise to the level of potential wrongdoing that justifies the disruption of having outside professionals investigate company employees.

To tailor a company’s approach to internal investigations, senior management and the board of directors should establish policies and procedures that instruct company personnel on how to evaluate issues that come before them and elevate them to the highest levels of executive management and the board of directors, as appropriate, so that the parties can make an informed decision on how best to investigate and remediate the perceived issue. A thoughtful approach to investigations can avoid expensive, time-consuming and disruptive reviews.

When should a company turn to outside counsel?

If a more serious issue arises where the board of directors becomes concerned that senior management alone cannot conduct an effective investigation, conducting an independent internal investigation can provide the board of directors, the audit committee or a special committee of the board of directors with a set of facts and conclusions from an independent source, which can then be used in a number of ways to protect the company, its employees and its shareholders. Instances where an independent investigation may be warranted include whistleblower complaints relating to misconduct of executive management, indications of potential criminal liability that may lead to government investigations, systemic violations of company policy affecting the company’s customer base, significant data breaches or accounting or financial issues. In almost all circumstances where companies suspect that alleged misconduct or wrongdoing could directly or indirectly implicate members of senior management or the board of directors or be indicative of insider abuse, steps should be taken to initiate an independent investigation.

Under such serious scenarios, regulators and law enforcement officials typically favour independent investigations, as the degree of independence is more likely to produce results and findings that are not influenced or compromised by company insiders. Indeed, it is common in government investigations for cooperation credit to be afforded to a company that can demonstrate that it conducted an independent review, initiated by its board of directors or a subcommittee of the board, and that, as a result of the independent review, the issue was thoroughly remediated and the company was in a position to cooperate with the agency’s investigation. Moreover, in the financial services industry, regulators view proactive internal investigations as an indication of good corporate governance, and failing to undertake such investigations may form the basis for examination criticisms of management or concerns related to the safety and soundness of the institution.

Initial steps toward establishing an independent investigation

As the first step in initiating an independent investigation, it is important to establish the facts that will allow for informed decision making by the board of directors. Answering the question of ‘who is the client?’ can be complicated, particularly when there are allegations of misconduct by management or the company. The client may be the company, the board of directors, a committee of the board or a special committee created for the investigation, depending on the allegations. Special consideration should be given when establishing the investigation structure to determine whether there is a need to establish an independent board committee. In particular, special committees are appropriate where the board of directors is comprised of a majority of inside directors or where the alleged misconduct may implicate some of the directors, either by one or more directors engaging in the issues under investigation or by merely having prior knowledge of the issues.

Once the client is identified and the attorney-client relationship is formalised in writing, all communications relating to the investigation should be made directly to the client, with possible reporting to broader groups at the direction of the client. For example, if the client is the audit committee of the board, all updates and communications should be made via teleconference, in-person meetings, emails or memoranda to only the members of the audit committee. At the audit committee’s direction, updates may be provided to the full board or members of senior management. Under this structure, the client holds the attorney-client privilege, which means that only the client may make a determination to waive privileged information or findings and disclose it to a broader audience, such as law enforcement or the full board.

Investigations often develop over time

Of course, the initial facts known to the company do not always tell the full story. It is critical for maintaining successful governance and compliance programmes that senior management and the board of directors remain educated in the area of internal investigations, which will position them to identify when situations develop into more serious matters requiring independent investigations. Indeed, it is common in large corporations for an issue to arise which, based on the facts initially known, would not rise to the level of seriousness requiring an independent investigation. However, once the company digs deeper, a more systemic or even criminal conspiracy may be exposed.

For example, imagine during a routine audit review that a bank discovers that certain customer intake forms were uploaded into the customer information file without any of the necessary information, and that the internal audit team’s review identified the perceived compliance lapse only with respect to one business-line banker. Based on these facts, it would be reasonable to hypothesise that the blank forms resulted from a breakdown in internal controls, and the bank would be justified in conducting an internal review, without outside counsel, to remediate the issue. Imagine now that in the course of remediating the issue the bank conducts a limited email review and discovers the following message sent from one business-line banker to another: “I just add the blank forms before the end of the month n fix it later…u get a bonus n the customer never knows…our COO said it was ok”.

Suddenly, there is an indication that there is a scheme to make false entries into the books and records of a financial institution and that an executive may have knowledge of such a scheme. Astute in-house counsel and senior management will recognise the importance of such a development, follow existing company procedures for escalating serious issues and engage outside counsel at the earliest stages of the investigation in order to establish the correct structure and preserve the investigation’s integrity.

Conclusion

Responsible companies will evaluate the particular facts and circumstances of each investigation in a thoughtful and methodical manner in accordance with set policies and procedures that dictate the proper channel for investigating the issue. For certain issues, it is appropriate and even responsible for companies to conduct investigations with in-house counsel and staff, saving on legal expenses and minimising disruption to the business. On other more serious issues, independent investigations led by outside counsel may be appropriate, designed to effectively remediate the issues, achieve full cooperation credit with the government, and to assure continued customer and shareholder satisfaction.

Michael A. Mancusi is a partner and Kevin M. Toomey is a senior associate at Arnold & Porter. Mr Mancusi can be contacted on +1 (202) 942 5302 or by email: michael.mancusi@arnoldporter.com. Mr Toomey can be contacted on +1 (202) 942 5874 or by email: kevin.toomey@arnoldporter.com.

Michael A. Mancusi and Kevin M. Toomey

Arnold & Porter