Q&A: Coordinating cross-border investigations in 2021
February 2021 | SPECIAL REPORT: CORPORATE FRAUD & CORRUPTION
Financier Worldwide Magazine
February 2021 Issue
FW discusses coordinating cross-border investigations in 2021 with Rahul Mukhi at Cleary Gottlieb Steen & Hamilton LLP, Andrew Butel at Kirkland & Ellis International LLP, Kerstin Wilhelm at Linklaters LLP, Robert Sikellis at Novartis, and Sarah Foley at Patterson Companies, Inc.
FW: What do you believe will be the key trends and developments likely to emerge in the cross-border investigations arena in 2021? What factors are set to shape the number and nature of investigations undertaken?
Butel: Law enforcement agencies, including the Serious Fraud Office (SFO), are increasingly placing emphasis on understanding corporate compliance processes and ensuring these are fit for purpose. As part of this, there appears to be a trend toward holding gatekeepers, such as in-house counsel and compliance officers, more to account. This includes law enforcement agencies seeking to interview gatekeepers as part of their investigations, whether as a fact witness or to understand corporate policies and procedures. Where this increased external focus drives companies to implement compliance enhancements, including monitoring systems, this has the potential to flag potential wrongdoing for investigation at an earlier stage.
Sikellis: One key trend to keep an eye on is whether the impact of the coronavirus (COVID-19) pandemic will be lasting. From an external standpoint, it does seem that COVID-19 has impacted enforcement authorities’ ability to investigate and bring cases as quickly as they might have done before the pandemic. Once the pandemic ends, it is likely that investigations will increase as a result. From an internal standpoint, it will be interesting to see whether some of our practices will be permanently changed. For example, conventional wisdom has always been that face-to-face interviews are preferable, but COVID-19 made that very difficult or impossible. The proliferation of videoconferencing helped mitigate this, and many people became quite comfortable conducting interviews this way. I suspect that this will remain an option even post-pandemic, and that we will find the right balance between speed and cost savings versus the benefits of being ‘on the ground’, depending on the circumstances of each investigation.
Mukhi: The key trends moving forward will largely revolve around the way investigations are conducted. The restrictions imposed by the COVID-19 pandemic have made it clear that many important aspects of an investigation, which traditionally required travel and in-person contact, can be conducted with little disruption using remote platforms. For example, by using technologies such as Zoom, most interviews can be conducted efficiently through remote means. Now that we are accustomed to using these virtual platforms, clients and regulators may expect broader use of these remote technologies absent specific reasons that require investigators to be present in-person.
Wilhelm: Throughout 2020 we saw increasing levels of cooperation and the adoption of joined-up approaches between global regulators and law enforcement agencies, which resulted in rising numbers of large-scale and complex cross-border investigations. There is no sign of this trend slowing in 2021. Across the globe, we are also expecting to see a continued focus from enforcement agencies on anti-money laundering (AML), bribery and corruption, greater interest in the individual prosecution of senior management involved in illegal activity, conflicts of interest, cyber security and tax evasion. The COVID-19 pandemic will continue to impact investigations across the globe, with enforcement agencies and national judicial systems having to continuously grapple with social distancing requirements – with certain jurisdictions impacted to a greater extent than others. Furthermore, the incoming Biden administration in the US is likely to make white-collar crime and related regulatory enforcement more of a priority. This could involve enhanced enforcement directed at, among other areas, financial services company practices, insider trading and other securities matters, corporate crime and environmental protections.
Foley: Developments that may emerge in cross-border investigations include organisations proactively revisiting their approach to how investigations are conducted given the current pandemic-impacted working environment. This includes evaluating how allegations of misconduct are received by a company to ensure that the methods leveraged to report concerns are available and easy to access by employees and third parties, regardless of their working location. In addition, we are likely to see scoping to capture all relevant risks and staffing needs. There is also a need to consider the effectiveness and ability to conduct investigative interviews remotely, thereby making it critical to have effective communication channels and technology that can be leveraged by investigators. In-house investigators must consider these various elements against the backdrop of regulators’ expectations for how companies respond to allegations of and remediate misconduct. As far as factors set to shape the nature of investigations in 2021, a focus will remain on commercial and government corruption, as well as market abuse and misconduct related to COVID-19 conditions, such as fraud associated with the misuse of pandemic relief packages and company assets.
“Employees have become empowered to raise concerns to a company and, as a result, organisations need to be prepared to act quickly when responding to allegations.”
FW: What are the biggest challenges involved in investigating actual or potential misconduct in today’s business world?
Sikellis: One lasting challenge for investigations is the proliferation of data. Personal devices and messaging apps pose challenges in particular, with both companies and enforcement authorities struggling to find ways to preserve, collect and review new forms of communication. Investigators not only must identify the right custodians and search terms to use, but also must identify the means custodians are using for relevant communications. Depending on the form and location of the data, this can pose tricky HR and data privacy issues. An investigator has to find the right balance of reviewing enough data for the investigation to be thorough and reliable, without being bogged down by a seemingly endless stream of data. Relatedly, our world is becoming more and more interconnected, meaning that relevant evidence can be located all over the world. This poses many challenges, from actually trying to locate data and witnesses to addressing the many local laws that might apply to that data and those witnesses.
Mukhi: One of the most significant challenges involved in investigating misconduct in today’s business world is the increasingly expanding and complicated nature of international regulatory regimes. For example, when the US government adopts an aggressive view of its jurisdiction, international companies without a US office, US-based operations or a strong understanding of US law may nevertheless be subject to criminal and civil penalties as a result of any violations they have committed. Without comprehensive and internationally focused compliance initiatives in place, it often becomes difficult to determine which employees were aware of the violative nature of their conduct and which were not. It is therefore critical to bolster compliance programmes and create a culture of compliance on the front end.
Wilhelm: Globalisation has led to more complex business structures. Thus, where misconduct occurs, it is increasingly unlikely that the misconduct will be an isolated incident or confined to a particular jurisdiction. Consequently, the number of cross-border investigations has risen in recent years and dealing with multiple enforcement agencies at the same time has become the norm for multinational companies. Given the risk of enforcement action as well as the significant reputational or financial consequences that may result from a cross-border investigation, it is critical for companies to adopt the right approach from the start and to ensure they are aware of, and prepared for, the legal, practical and jurisdictional obstacles that may arise.
Foley: Prior to the pandemic, it was normal for investigators to travel to conduct investigations and collect relevant evidence. The pandemic has turned this approach on its head and required companies to revisit their investigations programmes holistically, to ensure investigations are conducted promptly and successfully given travel constraints and social distancing – all of which do not afford an opportunity for an internal investigator to sit across the table from their interviewee. Additionally, companies could face challenges with utilising the appropriate technology to plan and execute an investigation, which spotlights the disadvantages of remote interviews and could promote a delay in the company’s response to potential misconduct.
Butel: A consistent challenge is the ever-increasing volume of data associated with investigations. The level of raw data involved can be overwhelming and certainly unmanageable in an efficient manner solely by human review. Coupled with this, employees based around the globe are communicating in an increasingly diverse number of ways – a trend likely to have increased in the current remote environment. This includes messaging applications, such as WhatsApp and WeChat, and workplace communication tools, such as Slack and Microsoft Teams. All of these bring technological and practical challenges to an investigation. Against this backdrop, the investigation must always be cognisant of a complex web of jurisdiction-specific data protection and privacy laws.
“An investigator has to find the right balance of reviewing enough data for the investigation to be thorough and reliable, without being bogged down by a seemingly endless stream of data.”
FW: What kinds of parameters need to be set at the outset of a cross-border investigation? How important is to establish a team or individual to oversee the process and guide its direction?
Mukhi: Properly defining the scope of an investigation at the outset is key to uncovering the relevant information and ensuring that the regulators involved are satisfied with your efforts. This can also help prevent unjustified ‘mission creep’ that increases costs and time, without necessarily furthering the reasons the investigation was initiated in the first place. As a first step, identifying the proper custodians and potential interviewees is crucial. The regulators may already be under the impression that a particular employee will possess information related to their area of focus, but this needs to be tested against the company’s own knowledge. And it is critical to establish an in-house team or individual with ownership and knowledge of the investigation, both to ensure that relevant information is identified, and that the investigation stays on course while being completed in an appropriately efficient manner.
Wilhelm: An initial assessment, to better understand the nature, size and scale of the issue under investigation, is key to any cross-border investigation. It is important then to properly scope the review. Internal investigations can be crucial in resolving issues, managing or avoiding crises and establishing a firm footing for dealing with subsequent regulatory investigations, complaints, litigation or employment issues. Adopting the right governance structure for the investigation and determining who should lead the investigation is equally important. The investigation team should be defined at the outset and thought given to individual roles. The team may require a combination of skills and expertise and there is no ‘one-size fits all’ approach. While internal management can carry out investigations it will be important to consider whether they have the resources and time to do so. Moreover, when involving internal management or employees, the risk that any of them may have been involved in the conduct being investigated, thereby jeopardising the integrity of the investigation, must be carefully considered. Appointing external legal advisers may provide the necessary unbiased view from the outside and may help to protect legal privilege.
Butel: A vital first step involves carefully assessing particular allegations. This includes considering the seriousness of the wrongdoing alleged, employees, business areas and jurisdictions potentially implicated, and whether management is potentially involved. You can then develop a tailored plan for addressing the allegations within a defined scope. Depending on the allegations, the scope may involve reference to, for example, a particular third-party relationship, a specific transaction or series of transactions, or the activities of specific business units or employees. Discipline at the outset can help avoid the delays and additional business disruption stemming from an overly broad or poorly defined scope. Investigation oversight, governance and reporting lines are fundamentally important. This can take various forms and will vary depending on the nature of the allegations and company policies and structures. The key is to retain discipline and coordination – all the more so in the current remote environment.
Foley: Employees have become empowered to raise concerns to a company and, as a result, organisations need to be prepared to act quickly when responding to allegations. Maintaining effective intake procedures and robust investigative protocols is critical to enable a company’s response to concerns. These two elements bolster credibility among employees and help drive consistency as it relates to conducting investigations. Investigative management protocols should align with the organisation’s values and take into account regional and country customs and practices to allow flexibility in approach when considering requirements of a specific foreign jurisdiction. Other elements that are important considerations at the outset of a cross-border investigation include the time frame during which the investigation must be conducted, data privacy, employee notifications, possible disclosures to regulators, and a process to recommend and implement remediation and disciplinary measures. It is very important to establish an investigative ‘lead’ to oversee the investigation – whether that is external counsel or an internal investigator – because of the need that various elements, like labour and employment laws, local customs and investigative strategies, are successfully addressed or adapted by the investigative team.
Sikellis: At the outset, an investigator should create an investigative plan, with a clear mandate and scope. This is critical to avoiding inefficiency and scope creep. Of course, the investigator must also be agile and adjust to new information and situations, but having a clear investigative plan from the outset will help ensure that the investigator identifies and follows through on critical issues. The investigative plan should also have a clear plan for identifying and addressing data privacy issues from the beginning. Appointing a team or individual to oversee the process and guide its direction is very important. Designating an investigative lead will help ensure that the investigation is conducted efficiently. Putting in place a clear oversight mechanism will help keep the investigative team on task and ensure that they are not losing sight of the big picture. Effective communication among the various parts of the team and leadership is important to making sure that the overall effort is effective.
FW: What emerging approaches, strategies and technologies are helping to make cross-border investigations more effective?
Wilhelm: From the regulators’ and enforcement agencies’ perspective, international cooperation promotes fact-finding for all agencies involved. Efficiency is improved through easier and faster ways of sharing information, such as the so-called European Investigation Order, which aims to accelerate requests for mutual legal assistance between member states of the European Union (EU). Outside the EU, the bilateral data access agreement of 3 October 2019 between the UK and the US pursues the same objective of obtaining information faster than has previously been the case. Joint investigation teams, set up by agencies in two or more EU member states to handle a particular cross-border investigation, are another example of the increased efforts to coordinate investigations conducted in parallel across the EU and make the investigations more effective.
Foley: Companies are considering the following as it relates to effective cross-border investigations. Reassessing investigative programmes to make sure the appropriate prioritisation and risk management is applied when a concern is received. Ensuring that allegations are addressed relevant to their seriousness. Remediating misconduct in a reasonably documented manner should the rationale for taking a certain approach be questioned by regulators or other third parties. And leveraging technology to support remote interviews and help achieve the same benefits of being in person, such as videoconferencing that can aid in assessing an individual’s credibility, and sharing documents.
Sikellis: First, making sure that investigations are assigned to the right people with the right resources is absolutely critical to effective investigations. An initial assessment, or triage, of an allegation ensures that it is assigned to the right person, and the right resources are applied. The goal is to find the right fit from the outset so that the investigation can be completed effectively and efficiently. It is also important to take stock of past investigations and incorporate lessons learned into your investigative approach. Was there something that worked well that should be incorporated into future investigations? Did we hit a roadblock that we can be on the lookout for? By leveraging past experience, it is possible to build a repertoire of best practices to address recurring issues. Ultimately, this should make investigations more effective.
Butel: In terms of technology, myriad solutions are on offer to analyse different types of data in increasingly sophisticated ways. The key is to understand the data available, its potential relevance to the investigation and the insights it may be able to offer. For example, the approach to interrogating structured data, such as accounting system data, would be different to a traditional email review. As with any technology, the output should be balanced with human oversight and review to support a robust and defensible methodology. The approach to cross-border investigations which involve, or have the potential to involve, law enforcement agencies will necessarily vary from case to case. Obviously, facts are always different, the company’s posture may differ and, as multijurisdictional investigations increase, the jurisdictions involved are increasingly likely to be different. However, there are some general takeaways emerging where the ultimate goal is a deferred prosecution agreement (DPA). The key strategy here is one of cooperation and a significant consideration is precisely what that entails in the specific circumstances. In August 2019, the SFO released its ‘Corporate Co-operation Guidance’ which sets out a non-exhaustive list of indicators of good practice in relation to issues such as the preserving and providing of material to the SFO. However, the guidance is not prescriptive and makes clear that each case turns on its facts. All of the DPAs the SFO has entered into to-date have emphasised the importance of cooperating. This has generally included conducting an independent investigation, disclosing facts and documents to the SFO, making individuals available for interview, and extensive remedial measures including dismissing those involved in the misconduct. However, other cooperation strategies will continue to turn on the specifics of each investigation.
Mukhi: Adapting to the use of new technologies and incorporating them into investigatory efforts is a necessity. Virtual videoconferencing platforms may largely replace the need to conduct employee interviews in person. In the US, there has also been an increase in formal presentations to regulators taking place using these platforms. While we anticipate each case to vary in a post-COVID-19 world, an increased understanding of these platforms and a willingness to learn and adapt to other technologies as they are made available will be necessary. There is also continued increase in the use of AI-based technologies for cross-border investigations, particularly in those with a large volume of documents to be reviewed. Technology-assisted review (TAR) tools that employ a continuous active learning model can provide effective review of a larger document population while requiring significantly less review hours than a more traditional, linear document review.
“Establishing regular lines of communication between the client, lawyers, forensic accountant and other key parties to an investigation is more important now than ever.”
FW: What impact has coronavirus (COVID-19) had on processes and procedures for conducting cross-border investigations? How have investigators adapted to the pandemic environment?
Sikellis: There is no doubt that the pandemic has posed numerous challenges for investigations. But overall, investigators have demonstrated an ability to adapt to challenging circumstances and find creative solutions to complex problems. Maybe the biggest impact of COVID-19 is the need to conduct many investigations remotely. Investigators have adapted well, effectively utilising tools such as Microsoft Teams to conduct interviews and other means to collect evidence remotely. Used correctly, remote means of gathering evidence, such as videoconferencing apps, can be highly effective. In cases that demand an immediate response or where cost is an issue, remote interviews may be preferable to in-person interviews, while other cases might require ‘boots on the ground’ to be most effective. Each case will require an individualised determination, but I suspect videoconferencing is here to stay in appropriate cases.
Butel: Investigation processes have generally proved highly adaptable to the pandemic environment – in reality, this has forced us to rely on technological solutions which were used, albeit more sparingly, pre-pandemic. The majority of documents nowadays are held electronically and can be collected and interrogated remotely. Interviews are of course a key part of most investigations and virtual interviews are now commonplace. Thorough preparation has been vital – including conducting ‘dry runs’ of the platform and ensuring all participants are properly briefed on logistics. There are some unavoidable drawbacks, however. For example, despite enhancements in technology, it can be difficult to assess the credibility of a witness in a virtual interview. Post-pandemic, I envisage many investigations adopting a ‘blended’ approach – leveraging the efficiencies developed during this period while retaining the ability to conduct in-person interviews with central witnesses.
Mukhi: COVID-19 has all but eliminated the existence of in-person meetings in many parts of the world. This has altered the communicative dynamic for many investigations and highlighted the need for increased coordination among team members. Establishing regular lines of communication between the client, lawyers, forensic accountant and other key parties to an investigation is more important now than ever. All members of an investigative team, regardless of their location, must remain focused on providing frequent and detailed updates to their fellow team members in order to remain on track.
Foley: Every corner of a business has felt the impact of the pandemic, which has shifted each organisation’s risk landscape and tolerance. As it relates to internal investigative teams, they are also being required to address potential increases in COVID-19-related claims. Investigators have maintained the foundational elements of how to conduct internal investigations and are ensuring that the nuances associated with a disruptive working environment do not impact the defensibility of an organisation’s approach to effectively addressing misconduct. Furthermore, investigators are relying more on technology now than ever when conducting investigations, which has promoted quicker responses to allegations. Lastly, and while it is always important for a company to address each allegation reported to it, many investigators are forced to prioritise investigations that should be addressed immediately given its seriousness versus held for later while additional information is gathered.
Wilhelm: During the COVID-19 pandemic, the conduct of investigations across the globe has been impacted by social distancing and the cessation of regular ways of working. For example, it was reported anecdotally that the UK’s SFO experienced disruption to its document review processes, while restrictions on in-person activities and social distancing requirements impacted investigators’ abilities to collect and assess physical data, such as hard copy documents, personal laptops and mobile phones. Many face-to-face interviews with witnesses and suspects, and searches of properties, also had to be suspended while new procedures were being established. However, this is not reflective of the experiences of all enforcement agencies. The UK’s Financial Conduct Authority (FCA) is reported to have been able to adapt relatively quickly to more virtual ways of working. The Department of Justice (DOJ) and Securities and Exchange Commission (SEC) in the US, for example, on the whole have not had their activities much impacted by COVID-19 and have carried on as normal, embracing virtual platforms where needed.
“Investigation processes have generally proved highly adaptable to the pandemic environment – in reality, this has forced us to rely on technological solutions which were used, albeit more sparingly, pre-pandemic.”
FW: What needs to be done to properly collect, preserve and review information? What impact are software solutions having on this aspect of cross-border investigations?
Foley: At the beginning of an investigation, a company should promptly identify and preserve potentially relevant information. Acting quickly to collect relevant information needs support from internal resources, and oftentimes, the processes used to collect electronic data are currently being managed remotely. Given the remote working environment, many employees may be utilising company-issued devices or personal computers and mobile devices. Therefore, companies should ensure guidelines around the use of these personal devices are in place and make clear that the company may exercise the right to access these personal assets when used for work-related purposes. Furthermore, due to travel restrictions and concerns regarding access to company offices, the collection of relevant hard copy documents is challenging, but, if necessary, the investigative team should provide explicit instructions to employees to preserve this data until a time when it can be gathered. Technology has continued to support companies’ data collection efforts for investigations, and it is important organisations continue to maximise the impact technology can have on remotely gathering data from hard drives and other assets and supporting document review.
Mukhi: Maintaining close contact with members of the investigation’s forensic collection team is key. With travel restrictions, lockdowns and other complications that can impact data collection timelines, it is critical to be aware of any anticipated delays as early as possible, in order for those complications to be communicated to the client and any regulators involved. A technical understanding of your client’s systems is also necessary. For example, while the physical collection of particular devices in one country may be delayed, the review of other cloud-based data can potentially begin sooner. Understanding where and how your client’s reviewable data is stored will maximise efficiency. Any investigation’s scope, review process and other steps must adapt in real time as information becomes available.
Butel: There are fairly well-established best practices that need to be followed to ensure the integrity and defensibility of the approach taken. In practice, this requires close collaboration between external legal counsel, a company’s IT function, and, where necessary, external IT experts. The extent of the information required to be preserved, collected and reviewed will be informed by the scope of the investigation. Particularly in large-scale investigations, this can involve an extensive exercise to ‘map’ data and hard copy materials held in numerous systems and jurisdictions. In terms of technology, there are ever increasing opportunities to leverage technology that deliver both effective results and cost savings. For example, e-discovery software can employ increasingly sophisticated machine learning with the aim of more quickly identifying key documents for review. The key to using technology effectively is understanding its limitations and incorporating a robust, human-led quality control procedure. Technology is a supporting tool to human-led investigations, not a substitute.
Wilhelm: First, the sources of relevant data need to be identified. Typically, this will include emails, phone records and hard copy documents, but also frequently overlooked potential sources of evidence, including metadata from emails or internal chats and CCTV and security logs. Once identified, the data must be collected and secured, which includes considering any potential employment or data protection issues. Companies should ensure that the routine destruction of documents is suspended. They may also consider issuing a document retention notice. Unless the volume of documents to be reviewed is very small, it will usually be advisable to host all of the documents on a specialist review platform. This allows for easier searching, tagging and management of the data and will create an audit trail if questions arise in relation to specific documents. It will also usually be necessary to identify criteria to narrow the scope of review to the most relevant documents. Certain e-discovery vendors may also offer analytics such as concept-clustering or the use of machine learning to identify relevant search terms and documents.
Sikellis: Investigators must quickly identify the most likely sources of information and move to preserve them. Often, that begins with promptly suspending the routine deletion of various electronic sources of information. Next comes the more formal written litigation hold. Properly scoping the distribution of the written hold and the description of the matter in the hold are key. The investigator must then define the parameters of the review – which data will actually be reviewed and whether search terms will be used – and the means for reviewing the data. Although this is the usual sequence of events, investigators must always have an eye out for new sources of data or new search terms and supplement the original collection, preservation and review plan as appropriate. For voluminous document reviews, investigators should be open to utilising TAR. The use of TAR is both art and science, and it might take some time and patience to train the model to produce the right results.
“It is vital to ensure that great care is taken, alongside a comprehensive, systematic and logical approach to avoid breaching any applicable data protection regulations.”
FW: What steps do companies need to take to ensure they comply with data privacy and protection laws? How are these challenges magnified in the context of a cross-border investigation?
Mukhi: Companies should have comprehensive policies dedicated to achieving compliance with data privacy and protection laws. Designated data privacy officers are also becoming more common. To address the complexity of cross-border investigations, companies must contemplate the potential transfer of information to other jurisdictions with differing privacy laws. In practice, this may require obtaining employee consent or other processes to export data. It is also worth noting that some regulators take the position that the mere existence of data privacy and protection laws often cannot shield international companies from their local regulatory obligations to produce documents. For example, companies are often asked to cite specific legal requirements justifying any refusal to provide information and explain why measures cannot be taken, such as redactions of personally identifiable information, to address any data privacy concerns.
Butel: As these laws are jurisdiction specific, a cross-border investigation will inevitably magnify the challenge. A key step is to establish the data map and to keep this under review. This involves, broadly, understanding where potentially relevant data is located and in what format. This can give rise to a number of tripwires and it is important to seek appropriate expert advice, including as to how data may be collected and hosted for review purposes. Of course, any relevant internal company policies must also be complied with. Additional challenges can arise in investigations which involve law enforcement agencies. For example, if an agency in one jurisdiction requests that a company provides material from another, this can give rise to difficult discussions around data privacy constraints.
Wilhelm: Data protection considerations are naturally heightened during a cross-border investigation given that various legal regimes come into play. As such, it is vital to ensure that great care is taken, alongside a comprehensive, systematic and logical approach to avoid breaching any applicable data protection regulations. Typically, there may be restrictions on the collation, review and disclosure of personal information, especially without notice or employee consent, and the transfer of personal data outside of the jurisdiction. Since investigations will inevitably deal with personal data, particularly employees’ data, care must be taken when processing this data and disclosing it to external parties, such as external counsel, service providers, regulators and so on, particularly where consent for such disclosure has not been given.
Sikellis: Complying with applicable data privacy and protection laws is particularly important for companies with global operations. Fortunately, some data privacy and protection issues can be addressed ahead of time through careful planning, such as providing proper notice to employees and data protection authorities of how data may be used for investigative purposes or implementing appropriate intracompany agreements. But every case needs to be assessed to ensure that requirements are being met. This should be done early to prevent roadblocks from derailing an investigation later – or worse, exposing the company to additional potential issues because of shortcomings in addressing potential data privacy issues. When government enforcement authorities are involved, data privacy and protection laws can pose an even bigger challenge. It is important to think creatively about how information can be shared appropriately with enforcement authorities. It is equally important to be transparent with those authorities regarding the steps you are taking to address data privacy and protection challenges.
Foley: Many countries have strict data privacy regulations that could impact the scope of an internal investigation and complying with and understanding these regulations is imperative. The impact these data privacy regulations have on how an organisation conducts investigations in a specific jurisdiction could be one of its largest challenges. Understanding data privacy laws before initiating an investigation is important to not impede your investigative timeline and strategy. Investigators must anticipate any potential hurdles around collecting and reviewing data and employee documents because some foreign countries maintain the view that personal data should be protected regardless of where it is stored, which can impact a company’s ability to conduct a document review from a remote environment.
FW: What essential advice would you offer to companies on coordinating an efficient cross-border investigation that achieves its objectives?
Sikellis: Think ahead – both in terms of designing your investigations procedures and planning for a specific investigation. Ensure that you have the right resources, the right process flow and the right governance systems in place. Ensure that the right people with the right expertise are assigned to the investigation and that the investigation is properly scoped. Ensure that you have addressed local laws and other issues that might impact the ability to carry out the investigation. Ensure that there is clear communication between the members of the investigative team and the people overseeing the investigative function. And, in the case of government investigations, work diligently to try to ensure appropriate dialogue and transparency with the regulator.
Wilhelm: As they adopt an increasingly collaborative approach to the formal and informal sharing of information, law enforcement authorities across jurisdictions are increasingly coordinating actions based on the same underlying conduct and reaching coordinated resolutions. For companies facing an investigation, dealing with the increasing level of jurisdictional alignment by regulators requires a comprehensive cooperation and disclosure strategy right from the outset, one which also considers the particularities of the different legal regimes involved. Any decision to self-report will require a careful assessment of the risks and benefits of self-reporting in light of the relevant facts and the best interests of the company. Companies looking to reach a settlement should try to achieve some finality by seeking to settle with all potential enforcers at the same time, which may – depending on the regulators involved – also mitigate the ‘piling on’ of penalties.
Foley: Our current environment has introduced new challenges to how organisations conduct investigations, but companies should recognise that the use of technology and adjustments to investigative strategies can be enablers. As a result of the pandemic, companies have positioned employees to be able to effectively work remotely, which allows changes to investigative protocols to be adopted somewhat seamlessly. Internal investigators should continue to be flexible and practical in their approach and appreciate that adjustments to certain investigative protocols could have positive impacts on crisis management and other exceptional circumstances that could face a company in the future.
Butel: Take the time at the outset to carefully scope and plan the investigation – this can save a huge amount of time and energy down the line – but also recognise that you may need to adapt and adjust depending on where the investigation leads. Clear and effective lines of communication are essential throughout in order to ensure that everyone in the investigation team is on the same page.
Mukhi: Companies conducting a cross-border investigation should allocate the upfront resources required to conduct an appropriately state-of-the-art investigation. There is no doubt that implementing new and unfamiliar technologies to aid the investigation requires time and money. However, in the long run, this will ensure the investigation is completed in the most effective and efficient manner possible.
Rahul Mukhi’s practice focuses on criminal, securities and other enforcement and regulatory matters. He joined Cleary Gottlieb Steen & Hamilton in 2005. From 2010 to 2016, he worked in the US Attorney’s Office for the Southern District of New York as an assistant US attorney. He was a lead prosecutor on significant cases involving public corruption, cyber crime, financial and tax fraud, healthcare fraud, money laundering and international organised crime. He can be contacted on +1 (212) 225 2912 or by email: rmukhi@cgsh.com.
Andrew Butel is a partner in the government, regulatory & internal investigations practice group in London. His practice focuses on representing companies and individuals in investigations across a range of corporate crime matters, including violations of anti-bribery laws and economic sanctions. He can be contacted on +44 (0)20 7469 2271 or by email: andrew.butel@kirkland.com.
Dr Kerstin Wilhelm is co-head of the German crisis management & compliance group. She is a highly accomplished dispute resolution practitioner, specialising in internal and government investigations, both domestic and cross-border, with extensive experience in dawn raids. During a secondment to the investigations in-house team of a large international US-based technology company, she gained additional experience in conducting internal investigations into sensitive matters in a number of jurisdictions. She can be contacted on +49 8 9418 08506 or by email: kerstin.wilhelm@linklaters.com.
Robert Sikellis is head of US litigation for Novartis where his responsibilities include overseeing internal investigations. Prior to joining Novartis, he was chief counsel for compliance at Siemens, where he oversaw all internal investigations. He started his career as a prosecutor in Massachusetts. He can be contacted on +1 (862) 223 0780 or by email: robert.sikellis@novartis.com.
Sarah Foley is deputy compliance officer and director, compliance for Patterson Companies, Inc. In this role, Ms Foley has responsibility for the company’s global ethics and compliance programme, initiatives and strategy. She can be contacted on +1 (651) 405 5116 or by email: sarah.foley@pattersoncompanies.com.
© Financier Worldwide
THE PANELLISTS
Cleary Gottlieb Steen & Hamilton LLP
Kirkland & Ellis International LLP
Linklaters LLP
Novartis
Patterson Companies, Inc.
Q&A: Coordinating cross-border investigations in 2021
Regulators on red alert: a tough year ahead
Conducting better business bribery risk assessments with corruption typology
An increase in workplace fraud
Crime fighting across borders: what every corporation needs to know
Germany’s draft Corporate Sanctions Act
New world, new regulations and new behaviours in the pharmaceutical industry