Remote investigations during COVID-19
November 2020 | TALKINGPOINT | FRAUD & CORRUPTION
Financier Worldwide Magazine
November 2020 Issue
FW discusses the process of conducting remote investigations during COVID-19 with Brian Mich, Ching Liu, Mavis Tan and Michael Zimmern at Control Risks, and Andrew Weissmann at Jenner & Block.
FW: Could you provide an overview of how the onset of the coronavirus (COVID-19) pandemic has impacted the way allegations of corporate misconduct are investigated?
Zimmern: The key word here has been ‘adjustment’. Investigations that were underway at the beginning of the pandemic could not and did not grind to a halt, although, in many cases, the tempo slowed a bit. Many were forced to adapt their procedures and have been able to do that and do it quickly, which has been impressive.
Tan: Clients react in different ways. Not surprisingly, those with the best investigations and compliance infrastructure have been most resilient and adaptable. They have the ability to locate and access data remotely, a network of investigations and compliance professionals able to provide local input and support, and some pre-coronavirus (COVID-19) experience utilising some of the processes that will help to move investigations forward. Where there are challenges accessing data or documents, or where there is limited oversight over local teams, remote investigations have been more challenging. We also find that companies with regional compliance teams are leveraging for more in-country support on investigations in jurisdictions that they are not able to travel to.
“The fact that interviewees are in their homes when being interviewed creates all sorts of challenges from a confidentiality and privilege perspective.”
FW: In addition to traditional scoping considerations, what do investigators need to be aware of when planning a remote investigation?
Mich: The key steps and best practices in conducting investigations have not changed. Companies are still deciding what and when to investigate based on the facts of the case and investigators are still collecting relevant information and data, conducting interviews, reviewing emails and other unstructured data, and reporting to relevant stakeholders. One change that I have seen, though, is that investigations will frequently take longer than they used to, especially in organisations where remote practices are not commonly used or were not used at all prior to the onset of the pandemic.
Zimmern: More time is needed for planning in remote investigations. Common tasks such as identifying documents and resources, gaining access to devices and data, and sequencing the investigative process just take longer. Sequencing can be especially challenging – people are not always readily available for interviews, inquiries relayed to other parties can be delayed, all kinds of things take longer. Just determining what technologies to use and how to conduct remote interviews securely takes a huge amount of time. You really have to focus on the information that is required to complete the investigation, make sure that you have a clear way to obtain it, and, above all, clearly document any new or unusual considerations, including limitations.
Tan: Ensuring clear communication channels, always important in investigations, becomes even more critical when investigations are being conducted remotely. Establishing clear communication protocols and workstreams upfront, including having a dedicated person on the client side obtain and chase down data and documents, is very important.
“Those with the best investigations and compliance infrastructure have been most resilient and adaptable.”
FW: What are the pros and cons of conducting a virtual interview between investigators and interviewees, as opposed to a traditional, in-person interview? What factors might determine whether interviews need to be conducted immediately or deferred to a later date, in person?
Weissmann: Undoubtedly, it is always better to conduct interviews in person. particularly when interviewing someone who has been involved in the conduct that is the subject of the investigation or are, in fact, an alleged wrongdoer. It is simply easier to develop a rapport with the interviewee while, at the same time, assessing their credibility. In those cases, if there is an option to conduct the interview in person or to delay the interview until it can be achieved in person, waiting for the in-person interview would be preferable. That said, for many interviews, particularly those that focus on background or process, a remote interview will be a fine substitute for that in-person interview. Not only has this been the case in the corporate investigations that we have been involved in, the same is true for the government in its investigations. During COVID-19 I think there will be greater progress in corporate investigations at the Department of Justice (DOJ) than individual ones, which can require more intense work with witnesses and the need for in-person interviews. Where movement has been allowed, we have conducted some ‘in-office’ interviews where the only individuals in the office were the interviewee and interviewers separated at a conference room table, which is a good option if all parties involved are comfortable with it. This also allows us to be present in person, with a client in-house investigator participating remotely.
Mich: Preparation, which is always essential to a successful interview, becomes even more vital when conducting an interview remotely. At the same time, no matter how much you prepare, you need to be ready for the fact that an investigation likely will not go as planned. It is important that you document those unexpected occurrences, how they were addressed and the rationale for the steps taken to address them. Careful documentation of the interview process is vital.
Zimmern: The fact that interviewees are in their homes when being interviewed creates all sorts of challenges from a confidentiality and privilege perspective. You can never be 100 percent certain who is present or overhearing the interview. Generally, we have found it much more difficult to recreate a controlled interview environment in a remote setting, meaning that challenges including preventing recording of conversations, managing the sharing documents, addressing translation or language issues and preventing additional people participating in the conversation, are much more common. The benefit is that remote interviews feel like a much more familiar and comfortable environment for many, and so can be attractive to those who feel uncomfortable, including some witnesses and whistleblowers.
“Much of the forensic technology space was already adapting to remote collection and investigation workflows, given the expansive use of cloud technology.”
FW: Could you provide an insight into the challenges surrounding data collection in the COVID-19 era? How are investigators responding and adapting?
Liu: Much of the forensic technology space was already adapting to remote collection and investigation workflows, given the expansive use of cloud technology, but COVID-19 has accelerated that movement and we are seeing both vendors and experts having to devise new and defensible ways to tackle this. For example, working from home has raised questions regarding how devices are used and the data they are accessing. A custodian may be using a personal device at home to access corporate resources and using Teams or Zoom to collaborate. Another challenge is the massive uptake in using corporate instant messaging and video conferencing yielding more data for collection. Conversely, how forensic practitioners navigate their own working from home and remote access poses additional challenges such as security of what they do and how they maintain integrity.
Mich: There are collection challenges relating to both hard copy documents and data. As always, you need to determine what data you need to access and preserve and where it might be held. It can be harder to identify gaps in your data remotely and trickier data sources, such as mobile communication data, social media and messaging apps, pose very specific challenges. Plus, you lose the opportunity to actually walk into someone’s office and see what devices they are using, which can be invaluable. It is also harder to check the authenticity of documents, particularly paper that has been scanned.
Liu: I have seen increased technical creativity from forensic consultants on how to leverage their technical prowess and engaging closely with IT resources to provide agile defensible solutions to remote data acquisition, such as deploying bespoke forensic solutions to collect mobile and cloud data and engaging more closely with stakeholders virtually to ensure an effective hand-holding session for data collection. In turn, the restrictions mandated by COVID-19 have meant acute changes in forensic standard operating procedures to come in line with business continuity protocols during aggressive lockdowns. The old challenges of data privacy and regulations, data export and legal privilege still apply though.
Zimmern: Undertaking investigations remotely will also bring to the fore issues relating to data privacy. The inability to have resources present locally increases the need to move data around, which increases the risk of running afoul of data privacy laws. It is important to work with counsel to understand the rules that apply in whatever jurisdictions you are dealing with and consider how it might impact on investigation approach, including how data will be handled and reviewed.
FW: To what extent has the pandemic forced investigators to find new ways to review, discuss and interpret information from different sources, compared to what would normally happen during a traditional on-site investigation?
Mich: This is one of the areas of greatest innovation for investigative teams and regulators. It is no secret that enforcement authorities have upped their own internal game when it comes to collecting and analysing data, so the expectations are increasing for internal investigative teams.
Weissmann: Recent, revised guidance from the DOJ has highlighted its focus on data analytics. Prosecutors and agents are employing artificial intelligence (AI) and data analytics in their own investigations. These capabilities are even more important when on the ground investigative procedures cannot easily be performed, you do not have the in-person intelligence you are accustomed to, and you are reliant on the data. And while we are largely addressing the demands of remote investigations during COVID-19, the ability to identify potential misconduct using these methods is bound to become a standard practice over time since prosecutors will inquire about whether the company has analysed or tracked its own data resources.
Tan: Using a combination of data analytics and forensic accounting, and in lieu of reviewing physical documents in support of transactions, third-party data can be reconciled and cross-checked with the company’s own data obtained remotely. When this method is employed, channel stuffing issues can be identified, as well as fake sales reported by a reseller to fraudulently obtain rebates and marketing spend reimbursements. On the ground intelligence can also be used to assess modus operandi and focus an investigation.
“Preparation, which is always essential to a successful interview, becomes even more vital when conducting an interview remotely.”
FW: With investigation teams potentially spread across countries and continents, how important is it to have a centralised system to help manage and monitor workflow, progress and performance? What are the essential elements of such a system?
Tan: Some investigative teams are using shared spaces for sharing and review which is really helpful when a team is working remotely or is working across multiple locations. There has been reluctance to use document sharing technology, and concerns over the security of some cloud-based systems, so you will need to know your organisation’s policies. Whether you can use cloud-based platforms, where your data centres are located and governance around access will be important consideration points.
Zimmern: The move to remote working has changed attitudes to adopting new technology and encouraged teams to think again about how they share information and collaborate. Better use of virtual tools has helped international teams formalise communication channels and include members of the team working in other locations.
FW: What steps should an investigation team take to address data protection and confidentiality concerns, while making key data remotely accessible to those who need it? What are the dangers of failing to ensure documents and interview notes are secured?
Weissmann: First and foremost, you need to understand your IT policies and access regardless of circumstances. You will need to rely heavily on internal IT teams or outside experts to facilitate securing, collecting and reviewing documents. And if you are not sure about something, ask – make sure IT policies give appropriate access to devices, chat apps such as WhatsApp, and messaging backups.
Liu: Remote collections gave people a lot of problems, with issues surrounding getting remote kits in-country, using network connections to collect data, organising meetings with targets to obtain devices, and so on. While in the thick of the lockdown everyone was doing what they could with the resources and protocols in place, now is the time to go back and develop a model for data access and ensure that the processes and protocols that you have for in-person investigations can be enlarged to suit remote needs as well.
“While we often hear that it is business as usual, the reality is that regulators have had to adjust their investigative protocols too.”
FW: Looking ahead, what long-term impact do you believe COVID-19 will have on processes, efficiencies and costs related to conducting corporate investigations? Are digital technologies likely to remain an integral part of the process?
Tan: COVID-19 has certainly accelerated some trends. This is particularly true with regard to the increasing focus on data and the use of technology in investigations. Many investigative teams have been surprised by the amount that you can actually get done without going on site. But at the same time, it has also highlighted the value of being on location – having access to information and being able to evaluate the local environment, all of the things that are intangibles but crucial to a thorough investigation. Investigations are ultimately about people and interaction is essential. I do not think that we are looking at a binary remote/in-person future for investigations; I suspect that a lot of organisations may adopt a hybrid approach that they can flex with their situation and needs.
Mich: Once we come out of this very uncertain period, I think that investigative teams are going to have to look backwards and think about when and where remote investigative steps have worked well and where they have failed to move investigations forward effectively and efficiently. We will also need to consider the ways that remote methods will drive change in other areas. For instance, you have to consider your success measures for remote investigations. We have mentioned several times that everything seems to take longer, so if you have a key performance indicator on time from open to close or your objectives are based on number of open and closed investigations, these metrics might warrant reconsideration to avoid creating artificial deadlines or missed targets.
Weissmann: From an enforcement perspective, there will be no ‘pandemic defence’ for either misconduct or the expectation to investigate. While we often hear that it is business as usual, the reality is that regulators have had to adjust their investigative protocols too. We have seen a measure of reasonableness from enforcement authorities toward companies that are working to continue with investigations and are having challenges stemming from the pandemic, but, as we move ahead, there will be an expectation from those authorities that, remote or in-person, you are going to have to come to grips with those challenges and move your matters forward in a timely manner.
Brian Mich is a partner in Control Risks’ compliance, forensics and intelligence practice in the Americas region. A former prosecutor, he has over 30 years of experience in the private and public sectors conducting fraud and corruption investigations. He specialises in complex internal investigations involving allegations of corruption, accounting fraud, money laundering and other regulatory violations. He also helps companies design, implement, evaluate and improve anti-corruption, anti-money laundering and anti-fraud compliance programmes. He can be contacted on +1 (212) 931 9661 or by email: brian.mich@controlrisks.com.
Ching Liu is the director of Control Risks’ compliance, forensics and intelligence team. He is a forensic specialist in many different operating systems, ranging from personal devices to business networks and mainframe architecture. Since joining Control Risks, he has been involved in numerous civil and criminal cases involving computer fraud and misuse. He frequently assists law enforcement agencies and law firms on the investigation of high-tech computer crimes, such as online counterfeiting and electronic espionage. He can be contacted on +44 (0)20 7970 2317 or by email: ching.liu@controlrisks.com.
Mavis Tan is a partner at Control Risks, based in Hong Kong, and leads the forensics practice for Greater China and North Asia. She specialises in forensic accounting, litigation support and insolvency and has extensive experience leading high profile and confidential investigations in the Asia-Pacific region. She assists clients in responding to complex financial disputes and whistleblower allegations of fraud and corruption, including acting as an expert witness in civil and criminal proceedings. She can be contacted on +852 6963 0040 or by email: hongkong@controlrisks.com.
Michael Zimmern leads the investigations and forensic accounting practice for Control Risks in Europe, the Middle East and Africa (EMEA). As a qualified chartered accountant with more than 15 years’ forensics experience, he advises clients on regulatory, reputational and financial issues. He frequently supports clients on complex, cross-border investigations working alongside governments, regulators and enforcement agencies to help clients manage and respond to risk. He can be contacted on +44 (0)7545 513 362 or by email: michael.zimmern@controlrisks.com.
Andrew Weissmann is co-chair of Jenner & Block’s investigations, compliance and defence practice, with a focus on counselling companies in both domestic and global investigations and litigation. He is a leading trial lawyer and investigator with deep experience in a broad variety of regulatory compliance matters. He has served as a federal prosecutor, Department of Justice (DOJ) fraud section chief, FBI general counsel, and a lead prosecutor in Robert S. Mueller’s Special Counsel’s Office. He can be contacted on +1 (212) 891 1661 or by email: aweissmann@jenner.com.
© Financier Worldwide
THE PANELLISTS
Control Risks
Jenner & Block